zh.hentai-img.com/
0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: zh.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Mon, 27 Nov 2023 21:29:10 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 27 Nov 2023 22:29:10 GMT
Location: https://zh.hentai-img.com/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1BQWmTHBoWDhm14mfmHCde7lSVjXLDuJYqEoiG%2Fcf4jSQChc%2Be%2BB4z3AUxXHlMMjwfoUI%2FTJ8pIaqYg%2BiZ3TQQ4aRz8qBNhte2Z40B6PVeqhpqLrhiBz8yTrnezrdkLdebI6iA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82cd770e8b1660e7-LHR
alt-svc: h2=":443"; ma=60
static.hentai-img.com/img/common/flag/en.gif
1.4 kB URL static.hentai-img.com/img/common/flag/en.gif
IP
File type GIF image data, version 87a, 50 x 26\012- data
Hash 614f51d8a552e93ab1a8d34e693b69f4
0ad32db920908f958f6c07167896091e44d5edee
eb820f959f75beecebc6e1319c2c774a830c8622a80048de1b0ba0ef2b2e2b25
GET /img/common/flag/en.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 1393
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-571"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1438306
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V66sj9Rwqjn8Kiym5c2Hc23blVJSqXjoWf%2BfBWRLBY3hHCGnt%2FAYgWamFdTSLdIuhkDr7a3eAjX6D3%2BbSD2GfGPlAwHNsxl8MrVOap9DhwX0yw4ZpL0kSYx1fMqQwIOq8phSDoPS1FE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6aa863cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/de.gif
200 OK 315 B URL GET HTTP/3 static.hentai-img.com/img/common/flag/de.gif
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type GIF image data, version 87a, 50 x 30\012- data
Hash b5f1834976932223f4eceb4ebe1263bc
75f99653385ba646f06441b8794e0c5bb6f9ec71
1555657d93aaab5a01449521300b72822b3db46909d84285d102725c45de3234
GET /img/common/flag/de.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 315
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-13b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1014346
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4rnqpxULJUMahi%2F4unb60iZARGKpV0vgbMyEaIyYCd3CsidooTXWmgv5JG4imMjehCENvLgetP%2FgDqvcktCB7HAPF9mQ0otJHzJDGRL2BJYv3mFMHHwwruHRRq0xtxzI6W6YsomoXi0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6aae63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/ru.gif
468 B URL static.hentai-img.com/img/common/flag/ru.gif
IP
File type GIF image data, version 87a, 50 x 33\012- data
Hash f4ceb928d7944860271f172b9a5a2df0
92b056a3c2426d7aef8b740ed2725b6f4fd52f40
6ca184b5dd2ff659ee4e354c3c2bc57b0ba45fb9f2e6c86cbc922f681d45fc16
GET /img/common/flag/ru.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 468
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-1d4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1007619
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DpGH45qktzFtX9cGnohrhx1yZzqilJsqzjH%2BLZTGYtf5vtOK2xnF5lhc2Nq4dTJZvV9zZd6VtP%2F1u6gpziUfNnySpjDmRo%2BYHhSirfXVAUClIif5R2tkGys29IkQbJDFuehQeGO63n4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ab063cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/ja.gif
474 B URL static.hentai-img.com/img/common/flag/ja.gif
IP
File type GIF image data, version 87a, 50 x 33\012- data
Hash fc232c3a98b41d61cdecfe025b2d44d8
b5aa1202d489ce8e6ca37dac67baf495d5dd4c07
5a728d100e5b50ce85986a7408725740db27682433c29c221dc2764480eb2078
GET /img/common/flag/ja.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 474
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-1da"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 2218134
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fHboez5St%2FBToBwJi5IIfpxofkTVVr8zQFBUDuT6l4GFLnjr1j7k%2Bcpo4BFF6Ci2jEYHb8xkrBg1b918E7b6RgNEL2wmrPW2RJzRi%2FVuQmz8QKghjhhM6neo%2BamZTU%2BI%2B9M75tzatgo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6aa763cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/fr.gif
525 B URL static.hentai-img.com/img/common/flag/fr.gif
IP
File type GIF image data, version 87a, 50 x 33\012- data
Hash 751bfc9753e8ec32b2af6273c44025ce
513a7ace4670aedc494fafda5a04a6f5f101a60b
7679445cf6d488364207be74a6d2c971fc10fede333050fc6745bf07fe236b59
GET /img/common/flag/fr.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 525
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-20d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1000498
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jQhy49blWG9KNBQ%2FA12olaGCXJE9xVN9bPkydgpz7t6bZMe%2Fsisz1xDL2VEoz%2FIY4c8Ph6R4pIdkwSps9P1dkMyF%2BjKV58CaPrmVloAZ7CdiwPe6g15R1coG17O9YXOYOuzLYWpaSQk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6aab63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/zh.gif
743 B URL static.hentai-img.com/img/common/flag/zh.gif
IP
File type GIF image data, version 87a, 50 x 33\012- data
Hash 5763f939a9e7b54e13997f2d74265e56
eebd3d13ce05866893a86f0a08c5426e8b5f5187
605bc30e975b4b4ea8ca03b3d423d55d9a582a7894bd47107db58e887a95211d
GET /img/common/flag/zh.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 743
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-2e7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1272639
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2Fsb977MjtIoiT4vX%2BNvT8ueujdBWExbuCW39seRM38Mo9S1MqjHYy%2FwDtlLumuGA2DzUIIT2TNJbRYJC5dS4kEytZj8mtXjtVVwnvjTK5DqdZJravez1VEzHiEMAY%2BV9JgXTF8DSlw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ab263cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/ko.gif
1.3 kB URL static.hentai-img.com/img/common/flag/ko.gif
IP
File type GIF image data, version 87a, 50 x 33\012- data
Hash 3db4f525bfa45626a782be27c91435e9
3734ee66a9cd2a9ece15561dd05f9c5aabafd702
621054d86125ef3c436d6126e7be35f29ea4349cda904516ed1259b73c9cd1d8
GET /img/common/flag/ko.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 1335
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-537"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1709937
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Ft5yHtrh%2B7CcNHjw%2FmkeN%2FaiRT%2B2THCn0PPTNIKQc9hRvWzXZQP69f72ECFWGZS2fCC7PAuY6Al1UljaxVU7gsrZG5aC4ZvwoC5VBAmSWVl9WRJxPkTdsKIa3FYkFkV2g%2BHNvrYRrY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ab563cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/es.gif
200 OK 1.3 kB URL GET HTTP/3 static.hentai-img.com/img/common/flag/es.gif
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type GIF image data, version 87a, 50 x 33\012- data
Hash b78318d1bbe6b11d049e3491a7066ba7
9f2ff64dc88431ee0e7fce5ebd1ba25aa923407b
bf158833191c774ea8b2aeaab4e7ae605537ebe32fe79323139b47808ab84ace
GET /img/common/flag/es.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 1335
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-537"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1258837
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YryWb%2F7bLYWiBLXVcgXqK%2FUYxhCihPhXJ1WRVJLvYq5uJoxwjx0Hq7U%2BvIy8vdrFLe78WHcT6PxwgK14m2LUHiQdo%2BLzLlhlXaAZtuzrgf3gR1gdybp1YgnpTzjxv4PTtVLE3FO8BlM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ab863cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/id.gif
200 OK 303 B URL GET HTTP/3 static.hentai-img.com/img/common/flag/id.gif
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type GIF image data, version 87a, 50 x 33\012- data
Hash 87e8ae0f9d667be54bb35cc6d95f5dce
cf7cc9f3f5caa7495d41cc5a45a2e754181847f7
a74faa32d47b6edffdddcd50c26e9678f4867b7cfa314c4ab0d0130a50513c1e
GET /img/common/flag/id.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 303
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-12f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1531119
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f5NrE9jya54v81Okw%2Bjt22ZjYNpGJBU6rJiUnKcYFVlAUDkIsN9jCdHsw1mXNMmbAfRH9fk89wiQdzfitf1XgeYk1v4lzNIMWUAu66lJWJCr1k%2FM8skgSXyoAFRRawACRS0MEXHiUI0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6abc63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/th.gif
200 OK 489 B URL GET HTTP/3 static.hentai-img.com/img/common/flag/th.gif
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type GIF image data, version 87a, 50 x 33\012- data
Hash dade310281854f06b5d86e2bda6a195a
b1ef80054727ee2e6bb6f5064ebe967df29140a5
3a8f0d75a21c4ee76195ec2b853f843f4f3e3448302b09d3e7f3571f0d432e60
GET /img/common/flag/th.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 489
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-1e9"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1451956
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=54RjC679AZq01femBRMxcL9IIh3aCw6KIkXgOpUKgTxHrSzzNVUPnURicOs%2BGHcUrDreC37E8je5fMnvY%2B2HGp59tI76%2FZH1YDaePqw9KZYcfCnxHY3Oclc3CsqNS%2FFa6zxH3Bx%2BlDE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6abd63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/flag/vi.gif
764 B URL static.hentai-img.com/img/common/flag/vi.gif
IP
File type GIF image data, version 87a, 50 x 33\012- data
Hash 3fc67b59f6f19a304a8a127ae2d17283
868c45630f4965cec1cea642f532919eaaea9004
d78e3064389010227967d2d01aa8e16cacfff71d93274d51178cb60f3a930503
GET /img/common/flag/vi.gif HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/gif
content-length: 764
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-2fc"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1270455
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=geV3bS9qKtpvCBQoB7cBOXH0RBFhHDvR32mY0ci2kutRWT1tD8ZJMEKz4%2FTXEimBL3H5eV%2BU%2B%2BIuYVgXYH4lSuPAe8yIBop6fmT4gnEb9b%2BZ9YV0cCvk6w6Nd2e8FOS6RZ6iTZ2VrSs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6abe63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/google_plus.png
200 OK 966 B URL GET HTTP/3 static.hentai-img.com/img/common/social/google_plus.png
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash 9eba4fde04295dbb4fe02beb5e72f2b0
90f4570d583a97bf2893d1bfa293daefae6084bb
4e3100d1d100105cfd2fadc475c9d3a5d82cff77acf877a1e7d8cca502fc35a6
GET /img/common/social/google_plus.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 966
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-3c6"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1194055
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hf8%2BJ7OUv9o7puLUv%2FERCrjXbanb114A6P%2BS6bUBaF0vDw6yJqtC0O4Q3DiXUzJ%2Ftd13%2FPWMBLCt38nOsFJOHJiKcbbnmRG26n46ywvNyDXxKyOijQ539RLkdwmffUFIr4c%2FwuaZ3FU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6abf63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/google.jpg
200 OK 2.9 kB URL GET HTTP/3 static.hentai-img.com/img/common/social/google.jpg
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 64x64, components 3\012- data
Hash d03da4d5a755fafa79537809171d7745
a7d6e98bdce5e7d001806d64e1f7b9740ce56b41
3e434c6b6bf79dd1df0166a0acfd4faeab551cdc02e240e76bb82e9aaaef97c1
GET /img/common/social/google.jpg HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/jpeg
content-length: 2860
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-b2c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1433662
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DYkcAKMaY03vCyTLvHWcwys%2BO56eEaRzPmD2RmlkpGRPAbmFASYEGMm79SsmXGUuvLcztlEiIzkGGHilp%2FynZAJ0W%2BRfwhK%2FNumj17ReHrVjrggKKkwfVOEQ108RDEnpOUcl%2FxZFr68%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ac063cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/twitter.jpg
3.1 kB URL static.hentai-img.com/img/common/social/twitter.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 64x64, components 3\012- data
Hash 332ba12ef50c10ec47fc6fe788ed76cf
e5c36d02a2058526f9b50ed511f729daa23664cc
e4e2dc43599b41d04804f3b10a393dad8416f66a2c4c5924cf1c61730d63dfed
GET /img/common/social/twitter.jpg HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/jpeg
content-length: 3070
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-bfe"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1259727
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bN1WD60cHrAhdFa4TPBSxq0RxU8EPf%2B%2B7uhNx%2B9zM%2FgDvEypTyvhWC4orOyYNO0QaSByL6Vw9hwNdoebQ%2FzqbppvPqADfHS34cZ9%2BjpCvXPLynwtXPMmHjVinEIgVgv%2FvZ5AA48LU1U%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ac263cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/facebook.jpg
200 OK 2.1 kB URL GET HTTP/3 static.hentai-img.com/img/common/social/facebook.jpg
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 64x64, components 3\012- data
Hash 40d8a992e98bb81a3ae223545c985fa4
167a554092a8b3f93659dbcd4b8995668f0e4b86
86551a71ce56e419e94306144f91bd0200d6ca73b7b933e88be448b1f2ea251a
GET /img/common/social/facebook.jpg HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/jpeg
content-length: 2086
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-826"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 2378487
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yXrZwAHl2ibj6yruuFZ%2FndYVb8M9ZILejkCds3iJV1k6CPTm2vsNY%2F9EQuuiqMSKXUGAHEUAGjn3bTJPoQYziaN6XBs9A7VRGWMtCw4Trsa5EH3pU6RlFdVHs4%2Fun1Prop4XgiT0EI0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ac663cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/reddit.png
542 B URL static.hentai-img.com/img/common/social/reddit.png
IP
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash 3713e686f6104795b2f9ce1e249313d6
c4ab6171292d3aeef618c614677a167f230b6ffd
ed28fead9654b1ec127f76da970b98bdaa954061a0a2a1121179debff9a0d153
GET /img/common/social/reddit.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 542
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-21e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1709936
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fTci8Yd4196gPeArexha1aCf4Lt1yFTf8IBMJStI4nDnlYj1gI8zuTht4d9gPxzOWAaDexYFIGEJYgk1wvaam7aAg9ymSOwIeSnP3P8Tx6WVDwhRYfwi748T%2FxGwJrAx6BZHEVoQ7t4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ac863cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/tumblr.jpg
2.4 kB URL static.hentai-img.com/img/common/social/tumblr.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 64x64, components 3\012- data
Hash 5b33546756b674ce2be373044f24c0cf
68dcc328753f7872624504268fcd7334b71c9f76
c1a52b3dc3cf5ea00542ea76f1295b55c7d01d0660e04587d0de18e86cdbb2c7
GET /img/common/social/tumblr.jpg HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/jpeg
content-length: 2407
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-967"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1281733
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rs5%2BEkj8kg8d8xCdtWRdz7bNsGg88bh%2FSywkSXuGdyy%2Fh1eVFt57xtP1X2RrceMaICCqBb6%2BhO%2FhIfSBpivG6Q8X4RefZbbEy1pCS7guvnOALcYP%2FGalxOEFFZun1vVL4wMzCTJw%2Bb0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6aca63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/pinterest.png
458 B URL static.hentai-img.com/img/common/social/pinterest.png
IP
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash 648994670c62d7a329042748a4bee30d
8227437266c5cab384f53caa32d1b387a77049fa
7d2b7976f2ee424f2a5c3efd727ce68d9d30400bfaaf44bf7a5348c914cf244c
GET /img/common/social/pinterest.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 458
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-1ca"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1105995
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vX7C77Pt%2FjeXpJ9EIMMEtdKhzeCBqniszn7Yk7ggEu%2FlvhFu1E23FtRw%2F3xsJSvqfDuGCn1O5qMetr8GvZE%2B0UvevGYZ473auR7aMKIvLWhlwHY%2BlE3TCypHHxCNbp7XbOAXamNBck0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6acd63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/vk_com.png
200 OK 964 B URL GET HTTP/3 static.hentai-img.com/img/common/social/vk_com.png
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash 25e01617b3bdb03a8254a51c52183e09
bed65c5f27acec7a2043c225b4c5e52c031354fb
5e117a1e8a53399ae27ab8aac45f2b8b4daa7f9d208726f29d8eef7c3fe85b3f
GET /img/common/social/vk_com.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 964
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-3c4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 2302446
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UCxd7qEfAfxqb78Upqgva5P4SI1hg6BvHG4pkOwavfS8JmAlI5q51Hwiww%2FZs6%2BktIdZ0zFiQ78J%2FF%2BqhTKAm%2BvcZHjoKfr8UjhaZptLlcQ8IiizH%2BPgHu9OCt6dlk3bEKOnNS7%2FTPg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ad463cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/line.png
200 OK 825 B URL GET HTTP/3 static.hentai-img.com/img/common/social/line.png
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash 299510f9cfb5a76a1ec5174cfb6ae795
0fc4e218da4019ee2b75a6639f981ca1a31187f9
eb1d6f5b8b6289ab1b326d7b116311fd37f4eb296ded36090f333bccb55bde5b
GET /img/common/social/line.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 825
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-339"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1106291
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MNVg9ZKCDs%2FiQoX1I1jQWPv6TAISCjav4Y%2Fm%2Fx2dRSP%2BDBPVAy9H0wDdeCCqARLeW1Lm8W7ph5m7d5h%2Fat4WcC%2BDeNJPo%2FJO2WHzbY%2FOWh6up4P0tXWutcSq7rkpKempOWOToCUjD3w%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ad863cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/hatena.png
501 B URL static.hentai-img.com/img/common/social/hatena.png
IP
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash ab83b4b896bf57fb195debbc7149971f
3c479cb275572b7e29b82100099d7b8a074b689e
d0ba5d480ebfe557338e123f161e74ebbe5f75fa67acfb00196daf8b74e6aa58
GET /img/common/social/hatena.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 501
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-1f5"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1095137
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pnP%2BKCpwMB34Qn0xtIm%2BLlTO7KNnZu9WSbZV6fI51Z%2BNEEQnDiTjA1pw3qYlO5qKpS%2FSf2tydAhFJ%2FvW7f%2BHf0Q41LHV1Jbo%2BtJCOBenNb9Sgh%2F%2BBcVfi1qpn24Mg5RzcYZEkNDLw70%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6add63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/pocket.png
1.1 kB URL static.hentai-img.com/img/common/social/pocket.png
IP
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash 34177c970f2a37a384e877bd07489116
a4b1dc3ae3e2b369bebaeb9a741821bfc2f68a26
57e48d9c3c98955c1d34b7968870bbdef6845441f4e7707c6bef7c4f0bda8e36
GET /img/common/social/pocket.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 1113
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-459"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1280937
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9NiJKbS6pceFr7P0UnZQQUsRzbjutzgbzy7dgKKQ%2BhgmbqHOzbqahxMrFKSw3%2BTWy5Xo48YtHLqn7fHcZ9UhWUN0njYwjn%2FP8bbR%2FMj30r539LqP3eVJ0c3Puq%2FJOyN%2BKc3fmqRoFtA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6adf63cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/mixi.png
822 B URL static.hentai-img.com/img/common/social/mixi.png
IP
File type PNG image data, 64 x 64, 8-bit colormap, non-interlaced\012- data
Hash b95efd042485932bebbd64b36e04239d
05bf771f9bc32761964c9142b5a02146ba00834a
ca1d5623931e628fcbb100eea0802c8819ba74d650f7e20eb8f5ebacb4985c72
GET /img/common/social/mixi.png HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/png
content-length: 822
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-336"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1612370
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CL2wuLOgJM%2B7x27z0SxUHdmtRQdoyiWZPlcMP9Ptmxjn4EnEwhVPl%2F%2BkSlPLEpw2CXFzAamND5cMdq%2FOUl62nY7PZggo8NXMbjplOwAAa7L4RLeXYX0DzXvlBPgky0H1bsxGHeBfLoU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ae963cf-LHR
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/img/common/social/stumble_upon.jpg
5.3 kB URL static.hentai-img.com/img/common/social/stumble_upon.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 64x64, components 3\012- data
Hash 75356d971865d18f361c31b8082bb4fc
c7a9fb21644661b3ecc6a7bb514818fca505b799
3cfcbf3045b013f60c81448975b83ac34e391e3b887a421ab765d9b36ae51350
GET /img/common/social/stumble_upon.jpg HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: image/jpeg
content-length: 5308
last-modified: Fri, 25 Nov 2022 08:27:22 GMT
etag: "63807c6a-14bc"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 2315134
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HtNVWlQdYF%2Fy%2Fas%2FAY2ZT8f%2Bu6oq068Y%2B8XJotyiB1CTBFpHNuU0MqFC1m5r%2Bw73MRpHMHp%2Fc9Fy521igHA%2BqoowxhFiTrfDYDUFDoKkbfSchLc2RAE7z6TRmL7kIYIUkGQ4EGhNFoE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6aeb63cf-LHR
alt-svc: h3=":443"; ma=86400
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:12 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
static.hentai-img.com/js/common/jquery.lazyload.min.js
1.8 kB URL static.hentai-img.com/js/common/jquery.lazyload.min.js
IP
File type ASCII text, with very long lines (3309)
Hash 5c01d7aff077b4ed0804b71c2e3ab4a1
56b4c94cff0d5fdfca579eac85da28a767607644
80351098c2478918bb80008d7836499305bf6f4d4b2abf742b8823255bbb0d8e
GET /js/common/jquery.lazyload.min.js HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 16 Jun 2023 07:58:42 GMT
etag: W/"648c1632-d35"
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Origin, Authorization, Accept
access-control-allow-credentials: true
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 2304962
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15q%2FZ%2Fg16RNMhGqZwGMMAnbNiW0o5taFmzBhIhlKgu8gy8up%2FG9VJTzLLbtLgt47RNw6smSkWKttN8Ldo1fuvYMAh%2BwD3IV4sXNlcK2i9NjtbpRDuWaEDJZWcRLRAavfYjZL7HGrYvM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cd771e6af363cf-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtm.js?id=GTM-M86Q28D
72 kB URL www.googletagmanager.com/gtm.js?id=GTM-M86Q28D
IP
File type ASCII text, with very long lines (3026)
Hash e958588d13a144c247ebe6b4c34d9775
991d11ee82e08ca731a9d0c5eeec00c4f077bcb7
336d507abd3fd96266ef06edabddd860ad9d330cd687bdf98b4bde5c0e2a2016
GET /gtm.js?id=GTM-M86Q28D HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:13 GMT
expires: Mon, 27 Nov 2023 21:29:13 GMT
cache-control: private, max-age=900
last-modified: Mon, 27 Nov 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 71719
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
go.eabids.com/loadeactrl.go?pid=136058&spaceid=8004023&ctrlid=791765
44 kB URL go.eabids.com/loadeactrl.go?pid=136058&spaceid=8004023&ctrlid=791765
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash 8029189e497fdea0688491728c3e2237
f0ffe6d5bd69dd54dcb543478397dec6d5c1319c
6e7a96639523aca5b9d3629b9e9308222ca06bd60256bf542601f425604b7b67
GET /loadeactrl.go?pid=136058&spaceid=8004023&ctrlid=791765 HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:13 GMT
content-type: application/javascript
content-length: 44146
content-encoding: gzip
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token,X-CSRFToken, Authorization
expires: Mon, 03 Jul 2001 06:00:00 GMT
last-modified: Janon, 27 11 2023 21:29:13 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0,post-check=0, pre-check=0
pragma: no-cache
x-backend-server: nl2-web-200
X-Firefox-Spdy: h2
poweredby.jads.co/js/jads2.js
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/js/jads2.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (3758), with no line terminators
Hash bc8141c4650030c41f6a98026b12ce80
af5618f7e467a207d4c64627be580283ab5640cd
5ad0b5133e45b32908a388c8c6dcfca2c23d1d9d3e2ed6a839a742bab1ffde51
GET /js/jads2.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 20 Sep 2023 21:26:09 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"650b6371-eae"
Content-Encoding: gzip
lby2kd27c.com/lv/esnk/1863026/code.js
39 kB URL lby2kd27c.com/lv/esnk/1863026/code.js
IP
File type gzip compressed data, max speed, from Unix\012- data
Hash 1619723da14d4ccbd79a2e06d03aa111
f666c7650ac1e1acdbda15ed528a8967f3ad9f46
1f29c4b01d7d1318d8a0375af2be469242c6cc72ccc494e2c84174d93bb0e8d2
GET /lv/esnk/1863026/code.js HTTP/1.1
Host: lby2kd27c.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: application/javascript
last-modified: Wed, 15 Nov 2023 14:55:11 GMT
vary: Accept-Encoding
etag: W/"6554dbcf-19d6e"
x-js-ab2: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
static.hentai-img.com/css/common/awesome/css/font-awesome.min.css
200 OK 7.5 kB URL GET HTTP/3 static.hentai-img.com/css/common/awesome/css/font-awesome.min.css
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type ASCII text, with very long lines (30837)
Hash 269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
GET /css/common/awesome/css/font-awesome.min.css HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 16 Jun 2023 07:58:42 GMT
etag: W/"648c1632-7918"
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Origin, Authorization, Accept
access-control-allow-credentials: true
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1194768
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sgkfv63PwwJ%2Bdfn9OvEa2MiUSvAMzHMX8NyANOiygSf80BsGFuPVBZm%2BJ0YkJN7nF7ukbfA5gougzU9cBNUqfhuRD2ZMjI6Xmf8wy7rPmI6vesXEFRj7mVy9m0UR05acpAysir%2FbCeg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cd771e6aa663cf-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=G-1PLLYQLZ1L&l=dataLayer&cx=c
200 OK 89 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-1PLLYQLZ1L&l=dataLayer&cx=c
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash 2b8f1d1a709f972d7c96e0958ab48d76
283be8c6e4925626dc6b81cbb1f0c3b9ca810e20
5d6db5d72a96ea7193bba7292de76bbe424d698063a38c349a0342b0bc15ad85
GET /gtag/js?id=G-1PLLYQLZ1L&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:13 GMT
expires: Mon, 27 Nov 2023 21:29:13 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 89367
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
static21.hentai-img.com/upload/20230927/1097/1122417/p=700/576.jpg
448 kB URL static21.hentai-img.com/upload/20230927/1097/1122417/p=700/576.jpg
IP
File type RIFF (little-endian) data, Web/P image\012- data
Size 448 kB (448022 bytes)
Hash d567eb24134a6ac7a4d0eac1e4392c81
d077eea147d8b1a487073a805ddd4df5c2cd6108
ef6b3a828ed4e961eac434e4997d81fad39da552aa838651a24885d8f32ab410
GET /upload/20230927/1097/1122417/p=700/576.jpg HTTP/1.1
Host: static21.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:13 GMT
content-type: image/webp
content-length: 448022
last-modified: Wed, 27 Sep 2023 01:06:53 GMT
etag: "6513802d-27e00"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6nv7yMVqDdQ4ABo%2BoLVzEFzJHejPC6VX%2FjHs1L9A9%2F1HCX8WM8uZT3Yupr2YvEj%2BFyPq8dnBhm%2FIV9TYU6QUfIKGo%2FHhwiFGtgq0i%2BN0zhJvuAHur4c2A4p0ah5vhtYVURiH3bKNcXEHyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd771e6ae363cf-LHR
alt-svc: h3=":443"; ma=86400
stealcurtainsdeeprooted.com/f325dc2bdcd9ba00a1c3fc7fb719f96a/invoke.js
9.3 kB URL stealcurtainsdeeprooted.com/f325dc2bdcd9ba00a1c3fc7fb719f96a/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type Unicode text, UTF-8 text, with very long lines (25107), with no line terminators
Hash a35b6e9b837924deb2d961bc6def1c24
19eddda5be0eee151387095c78dbcc5ee05f6e1b
d231f08e580758bade1f86f89eded8338dc5991aba4a964228c809e2b1a313f2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /f325dc2bdcd9ba00a1c3fc7fb719f96a/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2d2e2d19bbc8e5cdcfad40a16a8bd068
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
stealcurtainsdeeprooted.com/f325dc2bdcd9ba00a1c3fc7fb719f96a/invoke.js
9.3 kB URL stealcurtainsdeeprooted.com/f325dc2bdcd9ba00a1c3fc7fb719f96a/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type Unicode text, UTF-8 text, with very long lines (25099), with no line terminators
Hash 5ff24bed75c20add9f3220c6487b175e
d54055342da25d64d5a7d769bd58f91d1ec2a15a
74f1aeb8fb6e9689cb77f55c500482ddcf90f84eafb9d37ef00aecf3a4600b00
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /f325dc2bdcd9ba00a1c3fc7fb719f96a/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 40015721ca31e4b17c73be9cb3c435ae
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
stealcurtainsdeeprooted.com/5e6875da5961e81ed9244698fd54f94d/invoke.js
200 OK 11 kB URL GET HTTP/1.1 stealcurtainsdeeprooted.com/5e6875da5961e81ed9244698fd54f94d/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectstealcurtainsdeeprooted.com
FingerprintD2:80:AC:40:05:55:8B:BC:9B:C8:7C:26:56:42:AF:54:04:5F:9B:61
ValidityMon, 30 Oct 2023 06:01:37 GMT - Sun, 28 Jan 2024 06:01:36 GMT
File type exported SGML document, ASCII text, with very long lines (29669), with no line terminators
Hash bfb594809726105fe7b9023e4780c835
3079d7d50659999d356c64525c9577c8b10c0e41
4f82a253757202285202ad55f2034471cd6800c628cb583323dd22c94ea3547d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /5e6875da5961e81ed9244698fd54f94d/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e261b14eb59dd95c674320edda4db740
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
stealcurtainsdeeprooted.com/05/56/52/055652d312c99a6037d12337a6a1a7a4.js
25 kB URL stealcurtainsdeeprooted.com/05/56/52/055652d312c99a6037d12337a6a1a7a4.js
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with very long lines (62508), with no line terminators
Hash 09b6716608a83251da3ae16b4dd77399
ad266fb258151d67570318946cae6bd5f95c278a
bc1a44b4b5c2ffb19f366fce15c95980e8fe16fdd30da0e54ba925f2c973a418
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /05/56/52/055652d312c99a6037d12337a6a1a7a4.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5249f0b378ed0a1d381de0f088cc45d0
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
stealcurtainsdeeprooted.com/a7/bf/87/a7bf874835d806f885e035b6acb3f0eb.js
200 OK 15 kB URL GET HTTP/1.1 stealcurtainsdeeprooted.com/a7/bf/87/a7bf874835d806f885e035b6acb3f0eb.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectstealcurtainsdeeprooted.com
FingerprintD2:80:AC:40:05:55:8B:BC:9B:C8:7C:26:56:42:AF:54:04:5F:9B:61
ValidityMon, 30 Oct 2023 06:01:37 GMT - Sun, 28 Jan 2024 06:01:36 GMT
File type ASCII text, with very long lines (42871), with no line terminators
Hash 22d853c628f6c40add6284e9027c548a
4cf6b29e420219e5f0618f700c1001d81a03bacc
eaf913990d73d5eec354c14cb569a640657ef6ebc69ee89cd7d4e8c189e8ddc3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /a7/bf/87/a7bf874835d806f885e035b6acb3f0eb.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d0707d484ed27ba26b82bc91b9ca32df
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
cdn.tsyndicate.com/sdk/v1/bi.js
3.1 kB URL cdn.tsyndicate.com/sdk/v1/bi.js
IP
File type C source, ASCII text, with very long lines (7708)
Hash 132db549c9f97232cccb62af9f2156b9
27a33f324e81bb08d48875a20ef18d1f22d90af9
566f0492535dba4934209ea2b08a9ee357f4c7febf4defc717e0cb1d789bb0e5
GET /sdk/v1/bi.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:13 GMT
content-type: application/javascript
content-length: 3084
server: nginx
last-modified: Mon, 02 Oct 2023 10:01:05 GMT
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
etag: W/"651a94e1-1e65"
content-encoding: gzip
age: 4610916
accept-ranges: bytes
X-Firefox-Spdy: h2
stealcurtainsdeeprooted.com/7fd078e363f567e6039e684e541f9020/invoke.js
11 kB URL stealcurtainsdeeprooted.com/7fd078e363f567e6039e684e541f9020/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type exported SGML document, ASCII text, with very long lines (29633), with no line terminators
Hash 8b01cf7a24cbbf0ac226004ad03efd40
1b9ee3fbfac048a62d706f81bcca8fb8dca5b440
be36eeefed3b2e0543e87060ad08685c8d86336193396f172689156d1e180714
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /7fd078e363f567e6039e684e541f9020/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: aa6051a432f52b9802c48105c606cd48
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash ab08b21b37480bf609deaf73dcbf1e34
4121333c3a37ff481b30918ce3a1aa643cf813c2
d8c99d9c9d12731615d29afd9aba86e213ce6c7dfb8938334de50d3edfd78fcd
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Mon, 27 Nov 2023 21:29:13 GMT
Last-Modified: Mon, 27 Nov 2023 21:03:55 GMT
Server: ECAcc (ska/F749)
X-Cache: Miss from cloudfront
Via: 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: I7_tNiBjBrQtGjcZFOTdKdPrfOUa4rCe5bbRrJggz85sncsDugbhsA==
Age: 1518
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash ab08b21b37480bf609deaf73dcbf1e34
4121333c3a37ff481b30918ce3a1aa643cf813c2
d8c99d9c9d12731615d29afd9aba86e213ce6c7dfb8938334de50d3edfd78fcd
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Mon, 27 Nov 2023 21:29:13 GMT
Last-Modified: Mon, 27 Nov 2023 21:03:05 GMT
Server: ECAcc (ska/F7B4)
X-Cache: Miss from cloudfront
Via: 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: r4sT_e6db_TLH-ZNNlNTKybaPN5YE8RjqrJe-7xYsr1yG_S3Ii8cDA==
Age: 1568
proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 2131cb49e1f488fbc0e2cd14971b2ae3
db0a3a1d8e53b5617b3678a0db988ff7a5195f0e
bcec843b373e8ae763f550a00920b4e1119151bc89c2d35bf6d38be3830deaa3
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:13 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://zh.hentai-img.com
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=9164269f-e84a-4914-a100-2d9889367a22:2:1; expires=Thu, 24 Nov 2033 21:29:13 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 3055e7185a24fb6ee823e8ef20c6ba7d
0d30039f96f7ec68bb4c9d9a9f28d8121ab9aade
d99b7473626661999cab52b5e3f0abab65dc41346e5aa78a1cdcee49f0ac5372
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:13 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://zh.hentai-img.com
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=43c65482-e515-4fba-b0f7-cfee88ffe273:3:1; expires=Thu, 24 Nov 2033 21:29:13 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 75b0f32cb83fd177727c7a224a19dd46
7572e8635cd5185fef00aca69d3bd21180e84875
442bd12af8483e2709b4a88a27c4dc3c59bf9f4dfffa1f6f8808f68b2674ec50
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:13 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://zh.hentai-img.com
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; expires=Thu, 24 Nov 2033 21:29:13 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
stealcurtainsdeeprooted.com/5e6875da5961e81ed9244698fd54f94d/invoke.js
200 OK 11 kB URL GET HTTP/1.1 stealcurtainsdeeprooted.com/5e6875da5961e81ed9244698fd54f94d/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectstealcurtainsdeeprooted.com
FingerprintD2:80:AC:40:05:55:8B:BC:9B:C8:7C:26:56:42:AF:54:04:5F:9B:61
ValidityMon, 30 Oct 2023 06:01:37 GMT - Sun, 28 Jan 2024 06:01:36 GMT
File type exported SGML document, ASCII text, with very long lines (29645), with no line terminators
Hash ab389eb553e869e8443ea5ce8b1d413c
99933dee24e85258e537b0c878aeab937c749989
7e966df18e51b839e894d8bb7222fdf8de406716bc4ebc2ddf86d91c7056b918
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /5e6875da5961e81ed9244698fd54f94d/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 011853d2e33f3c1963436255c3bba3cc
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
poweredby.jads.co/js/jads2.js
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/js/jads2.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (3758), with no line terminators
Hash bc8141c4650030c41f6a98026b12ce80
af5618f7e467a207d4c64627be580283ab5640cd
5ad0b5133e45b32908a388c8c6dcfca2c23d1d9d3e2ed6a839a742bab1ffde51
GET /js/jads2.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 20 Sep 2023 21:26:09 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"650b6371-eae"
Content-Encoding: gzip
stealcurtainsdeeprooted.com/7fd078e363f567e6039e684e541f9020/invoke.js
11 kB URL stealcurtainsdeeprooted.com/7fd078e363f567e6039e684e541f9020/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type exported SGML document, ASCII text, with very long lines (29621), with no line terminators
Hash 8280dbac993f7385a5294c9387095ddc
af63c23c513e062d0ea596e9c6b0a2c386d50e16
5970a29e72e1bfc03e52b1f0d213aff20c1c6bf11afaa14fc01db3d085f22259
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /7fd078e363f567e6039e684e541f9020/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2ce5912a074c0e4955b9c4e2b85fa552
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
stealcurtainsdeeprooted.com/5e6875da5961e81ed9244698fd54f94d/invoke.js
200 OK 11 kB URL GET HTTP/1.1 stealcurtainsdeeprooted.com/5e6875da5961e81ed9244698fd54f94d/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectstealcurtainsdeeprooted.com
FingerprintD2:80:AC:40:05:55:8B:BC:9B:C8:7C:26:56:42:AF:54:04:5F:9B:61
ValidityMon, 30 Oct 2023 06:01:37 GMT - Sun, 28 Jan 2024 06:01:36 GMT
File type exported SGML document, ASCII text, with very long lines (29636), with no line terminators
Hash dfb26f8b62d5a6ce7d725f2941ee6458
7a764db12212de2e050196cd6ec97fae828d0fdd
225e32da6ed4d952497f5934a0872450c91379bc7a5af6779a426828f2ada5c9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /5e6875da5961e81ed9244698fd54f94d/invoke.js HTTP/1.1
Host: stealcurtainsdeeprooted.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 154e3f7485ea73b090527ede823e0f93
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
region1.analytics.google.com/g/collect?v=2&tid=G-1PLLYQLZ1L>m=45je3b81v874625503z8831581666&_p=1701120556375&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=352905256.1701120557&ul=en-us&sr=1280x1024&_s=1&sid=1701120557&sct=1&seg=0&dl=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&dt=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526%20-%20Hentai%20Image&en=page_view&_fv=1&_nsi=1&_ss=1&ep.useAmpClientId=true&tfd=6640
0 B URL region1.analytics.google.com/g/collect?v=2&tid=G-1PLLYQLZ1L>m=45je3b81v874625503z8831581666&_p=1701120556375&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=352905256.1701120557&ul=en-us&sr=1280x1024&_s=1&sid=1701120557&sct=1&seg=0&dl=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&dt=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526%20-%20Hentai%20Image&en=page_view&_fv=1&_nsi=1&_ss=1&ep.useAmpClientId=true&tfd=6640
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-1PLLYQLZ1L>m=45je3b81v874625503z8831581666&_p=1701120556375&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=352905256.1701120557&ul=en-us&sr=1280x1024&_s=1&sid=1701120557&sct=1&seg=0&dl=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&dt=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526%20-%20Hentai%20Image&en=page_view&_fv=1&_nsi=1&_ss=1&ep.useAmpClientId=true&tfd=6640 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://zh.hentai-img.com
date: Mon, 27 Nov 2023 21:29:14 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
poweredby.jads.co/js/jads2.js
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/js/jads2.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (3758), with no line terminators
Hash bc8141c4650030c41f6a98026b12ce80
af5618f7e467a207d4c64627be580283ab5640cd
5ad0b5133e45b32908a388c8c6dcfca2c23d1d9d3e2ed6a839a742bab1ffde51
GET /js/jads2.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 20 Sep 2023 21:26:09 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"650b6371-eae"
Content-Encoding: gzip
lcdn.tsyndicate.com/sdk/v1/b.b.js
200 OK 2.6 kB URL GET HTTP/2 lcdn.tsyndicate.com/sdk/v1/b.b.js
IP
Requested by https://tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
Certificate IssuerSectigo Limited
Subjectlcdn.tsyndicate.com
FingerprintAA:DB:E6:65:05:5A:83:46:D1:77:83:25:84:3D:B2:B5:F5:99:97:00
ValidityWed, 08 Mar 2023 00:00:00 GMT - Sun, 07 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (2590)
Hash b0a8eae036a72f605538b002e33f7023
5916ea9eeb0b676d6f44637601c40d0dc69542d1
7b9affd37cf01ac1a4c5f4a4ccb1936f0412ff771fb24e36a55682d2bf0ac554
GET /sdk/v1/b.b.js HTTP/1.1
Host: lcdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: application/javascript
content-length: 2640
server: nginx
last-modified: Tue, 25 Jul 2023 12:28:26 GMT
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
etag: W/"64bfbfea-1f37"
content-encoding: gzip
age: 10109142
accept-ranges: bytes
X-Firefox-Spdy: h2
questioningsanctifypuberty.com/watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
0 B URL questioningsanctifypuberty.com/watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1 HTTP/1.1
Host: questioningsanctifypuberty.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Location: https://questioningsanctifypuberty.com/watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=bdaa6039ebb7fe8b56a0e30809e3734c5300ce66bbdf32e780bc1259a3cdba06cd5ed3298869c63330b54726ca7cc4d2bbcb9284c0dc707fa9fe7a686188f4d6c3bbf4b7048102d26acf66d08aae7e8544623a412014cbad6627182b251822&pst=1701120614&rmtc=t
Set-Cookie: u_pl=15475157; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTQ3NTE1NywiayI6IjVlNjg3NWRhNTk2MWU4MWVkOTI0NDY5OGZkNTRmOTRkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjo1LCJwdCI6NCwicGsiOiJrc2UzM3pwZyIsImNwa3MiOnsiMjgiOiJkNzljZmZkM2EwZDU5ZjYxMWI3NDJmNGQxZjY2NTg5YSJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aC5oZW50YWktaW1nLmNvbS9pbWFnZS9kZWx0YXJ1bmUtbm9lbGxlLWhvbGlkYXktY29sbGVjdGlvbi1wYXJ0LTItcjM0L2F0dGFjaG1lbnQvNTc2LyJ9fQ.vcLH6QYmXZhN53jvyTVdvT2i2IY_bZAvbSm_Iq4oOmk; expires=Mon, 27 Nov 2023 21:30:14 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ebcae111a075099d7370486c6b024eeb
Strict-Transport-Security: max-age=0; includeSubdomains
probablebeeper.com/watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1
307 Temporary Redirect 0 B URL GET HTTP/1.1 probablebeeper.com/watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectprobablebeeper.com
Fingerprint2D:44:B6:9E:D6:A1:25:68:14:D5:E2:98:4C:8C:42:7B:35:63:C7:FA
ValidityTue, 21 Nov 2023 13:55:00 GMT - Mon, 19 Feb 2024 13:54:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1 HTTP/1.1
Host: probablebeeper.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Location: https://probablebeeper.com/watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1&shu=9fd1aa377d3006b1fb14290a900ce880c74297159365348c2eac50449f4e40e8179b338d4f06ba2331f617ac04fcedf9b8f838be82c6fcb45155489840fdf61d220a6212e0a7db1bb26601517012b88ce56fd5dbe53769d913e1ac5ec831b0&pst=1701120614&rmtc=t
Set-Cookie: u_pl=16448109; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjQ0ODEwOSwiayI6IjdmZDA3OGUzNjNmNTY3ZTYwMzllNjg0ZTU0MWY5MDIwIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjoyNSwicHQiOjQsInBrIjoiY2NtaHRmcGdwIiwiY3BrcyI6eyIyOSI6IjI3ZDBhN2M0ODhjNTBmMmU5ZjU4N2Y3N2VjMDI3Y2ExIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3poLmhlbnRhaS1pbWcuY29tL2ltYWdlL2RlbHRhcnVuZS1ub2VsbGUtaG9saWRheS1jb2xsZWN0aW9uLXBhcnQtMi1yMzQvYXR0YWNobWVudC81NzYvIn19.8lyMNv-MQfnZgTkVtQxZlEw4vxtyDWxm_IiO192CCA8; expires=Mon, 27 Nov 2023 21:30:14 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a14346db4baf03463968942334d627e9
Strict-Transport-Security: max-age=0; includeSubdomains
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
mountedgrasshomesick.com/pixel/nvwbdp?key=f325dc2bdcd9ba00a1c3fc7fb719f96a
0 B URL mountedgrasshomesick.com/pixel/nvwbdp?key=f325dc2bdcd9ba00a1c3fc7fb719f96a
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/nvwbdp?key=f325dc2bdcd9ba00a1c3fc7fb719f96a HTTP/1.1
Host: mountedgrasshomesick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
statesmansubstance.com/watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
307 Temporary Redirect 0 B URL GET HTTP/1.1 statesmansubstance.com/watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectstatesmansubstance.com
Fingerprint97:C0:B6:70:6C:F2:9D:F2:F5:91:C8:32:7D:93:8E:D1:70:CB:A0:79
ValiditySat, 25 Nov 2023 08:17:32 GMT - Fri, 23 Feb 2024 08:17:31 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1 HTTP/1.1
Host: statesmansubstance.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Location: https://statesmansubstance.com/watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=dd6ece74fdd55fa899e22ee9ff9736179c95c84becbbd69f1232c64043a83272c35893bf2ff21108b29da621a6efaf215425e51fc0c7394d3ece437fb48cf887cae8953e4973d37d65da55a4488cbabae6297109910cf25c7d96fd0c722af9&pst=1701120614&rmtc=t
Set-Cookie: u_pl=15475157; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTQ3NTE1NywiayI6IjVlNjg3NWRhNTk2MWU4MWVkOTI0NDY5OGZkNTRmOTRkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjo1LCJwdCI6NCwicGsiOiJrc2UzM3pwZyIsImNwa3MiOnsiMjgiOiJkNzljZmZkM2EwZDU5ZjYxMWI3NDJmNGQxZjY2NTg5YSJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aC5oZW50YWktaW1nLmNvbS9pbWFnZS9kZWx0YXJ1bmUtbm9lbGxlLWhvbGlkYXktY29sbGVjdGlvbi1wYXJ0LTItcjM0L2F0dGFjaG1lbnQvNTc2LyJ9fQ.vcLH6QYmXZhN53jvyTVdvT2i2IY_bZAvbSm_Iq4oOmk; expires=Mon, 27 Nov 2023 21:30:14 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 62c85df5d7c0134bb594228a716e80e3
Strict-Transport-Security: max-age=0; includeSubdomains
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
poweredby.jads.co/js/jads.js
301 Moved Permanently 178 B URL GET HTTP/1.1 poweredby.jads.co/js/jads.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/jads.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: jads2.js
go.eabids.com/eactrl.go
200 OK 3.3 kB IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectgo.eabids.com
FingerprintE5:44:EA:89:06:0E:AD:1B:B6:06:EB:98:BB:4A:C6:55:B7:01:14:8E
ValidityThu, 05 Oct 2023 21:00:10 GMT - Wed, 03 Jan 2024 21:00:09 GMT
File type JSON data\012- , ASCII text, with very long lines (5489), with no line terminators
Hash ec17ae8f92992438e16978197ec875a9
eb83d3fbf08dafa4d4106cc78e933769043d07cc
2596448b9bb1672c956a8496c8a0a3d75d3a4b0f31c51fc359851aaf79ce9a99
POST /eactrl.go HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 1214
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: application/json;charset=utf-8
content-length: 3325
content-encoding: gzip
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://zh.hentai-img.com
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token,X-CSRFToken, Authorization
access-control-allow-credentials: true
expires: Mon, 03 Jul 2001 06:00:00 GMT
last-modified: Janon, 27 11 2023 21:29:14 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0,post-check=0, pre-check=0
pragma: no-cache
x-backend-server: nl2-web-202
X-Firefox-Spdy: h2
fistdoggie.com/watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
307 Temporary Redirect 0 B URL GET HTTP/1.1 fistdoggie.com/watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectfistdoggie.com
FingerprintCF:50:1C:A5:CC:6A:4C:CA:73:98:E1:4C:58:32:84:36:4C:D1:FD:17
ValiditySat, 25 Nov 2023 07:54:38 GMT - Fri, 23 Feb 2024 07:54:37 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1 HTTP/1.1
Host: fistdoggie.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Location: https://fistdoggie.com/watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=c8822e2e5e05492dcb4e10314ad3ac04ff59ec87d795618763bd7e3448773bd606eb6bd933b08eb63b2669da2802b0cc5f67e6c8904bad1c5f2457de946d52a0d0c00ff69906e3f92e95b686fe28a6b7d8c7a503dcae85da79582b4ac609ea&pst=1701120614&rmtc=t
Set-Cookie: u_pl=16448109; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjQ0ODEwOSwiayI6IjdmZDA3OGUzNjNmNTY3ZTYwMzllNjg0ZTU0MWY5MDIwIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjoyNSwicHQiOjQsInBrIjoiY2NtaHRmcGdwIiwiY3BrcyI6eyIyOSI6IjI3ZDBhN2M0ODhjNTBmMmU5ZjU4N2Y3N2VjMDI3Y2ExIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3poLmhlbnRhaS1pbWcuY29tL2ltYWdlL2RlbHRhcnVuZS1ub2VsbGUtaG9saWRheS1jb2xsZWN0aW9uLXBhcnQtMi1yMzQvYXR0YWNobWVudC81NzYvIn19.8lyMNv-MQfnZgTkVtQxZlEw4vxtyDWxm_IiO192CCA8; expires=Mon, 27 Nov 2023 21:30:14 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 31d0bdea8cb2ef3a3f646def13ec4e78
Strict-Transport-Security: max-age=0; includeSubdomains
revisionplatoonhusband.com/ntv.json?key=f325dc2bdcd9ba00a1c3fc7fb719f96a&vstc=4
17 kB URL revisionplatoonhusband.com/ntv.json?key=f325dc2bdcd9ba00a1c3fc7fb719f96a&vstc=4
IP
ASN #39572 DataWeb Global Group B.V.
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (16919), with no line terminators
Hash 31d43a0da0de379117b80966239eceb5
10334cb3f8d68358e1f7f08bb18498eadc328b26
d21a37b5ae5cb09d8623a9dbf0d31762035d8a3d2caedb0c729a78e635f2a6a5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ntv.json?key=f325dc2bdcd9ba00a1c3fc7fb719f96a&vstc=4 HTTP/1.1
Host: revisionplatoonhusband.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: application/json
Content-Length: 16920
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=16443288; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
pdhtkv49=true; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
uncs49=1; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
nlecf325dc2bdcd9ba00a1c3fc7fb719f96a=[3637745,2229215,2229212,2229214]; expires=Mon, 27 Nov 2023 21:29:19 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 366882c53881b576918dc19030fb3c22
Strict-Transport-Security: max-age=0; includeSubdomains
cdn.tsyndicate.com/sdk/v1/bi.js
3.1 kB URL cdn.tsyndicate.com/sdk/v1/bi.js
IP
File type C source, ASCII text, with very long lines (7708)
Hash 132db549c9f97232cccb62af9f2156b9
27a33f324e81bb08d48875a20ef18d1f22d90af9
566f0492535dba4934209ea2b08a9ee357f4c7febf4defc717e0cb1d789bb0e5
GET /sdk/v1/bi.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: application/javascript
content-length: 3084
server: nginx
last-modified: Mon, 02 Oct 2023 10:01:05 GMT
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
etag: W/"651a94e1-1e65"
content-encoding: gzip
age: 4610917
accept-ranges: bytes
X-Firefox-Spdy: h2
deskfrontfreely.com/watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
307 Temporary Redirect 0 B URL GET HTTP/1.1 deskfrontfreely.com/watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectdeskfrontfreely.com
Fingerprint5F:5A:75:13:04:62:4E:9B:25:15:20:68:9A:95:42:F9:93:AB:32:28
ValidityTue, 07 Nov 2023 08:02:15 GMT - Mon, 05 Feb 2024 08:02:14 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1 HTTP/1.1
Host: deskfrontfreely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Location: https://deskfrontfreely.com/watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=820adcba5fe1d4ad9b01b0988c48d3424fb8d1093827e523d280ac048a83afd55462f3bd5b03f8590ef099442c56a6e2150aa8ac976e854717e779e40a478fdca852042cdb51b029eef3bf317dd4c6fa06b21f8a436b284b0b643a4521a1a80a503fcb&pst=1701120614&rmtc=t
Set-Cookie: u_pl=15475157; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTQ3NTE1NywiayI6IjVlNjg3NWRhNTk2MWU4MWVkOTI0NDY5OGZkNTRmOTRkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjo1LCJwdCI6NCwicGsiOiJrc2UzM3pwZyIsImNwa3MiOnsiMjgiOiJkNzljZmZkM2EwZDU5ZjYxMWI3NDJmNGQxZjY2NTg5YSJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aC5oZW50YWktaW1nLmNvbS9pbWFnZS9kZWx0YXJ1bmUtbm9lbGxlLWhvbGlkYXktY29sbGVjdGlvbi1wYXJ0LTItcjM0L2F0dGFjaG1lbnQvNTc2LyJ9fQ.vcLH6QYmXZhN53jvyTVdvT2i2IY_bZAvbSm_Iq4oOmk; expires=Mon, 27 Nov 2023 21:30:14 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 269bd77a69c68e99702107564abf2c93
Strict-Transport-Security: max-age=0; includeSubdomains
go.xlivrdr.com/smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707
0 B URL go.xlivrdr.com/smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707 HTTP/1.1
Host: go.xlivrdr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Mon, 27 Nov 2023 21:29:14 GMT
content-length: 0
location: https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: _var=808614.32246_OWQzYzU1NjU=; Path=/; Expires=Wed, 27 Dec 2023 21:29:14 GMT; HttpOnly; SameSite=Strict
__cflb=02DiuDFRFiBZBvMSLtqFVfs5Aboo4dwjq98Pu7GHiP49A; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:14 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd772b6bc056b9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
questioningsanctifypuberty.com/watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=bdaa6039ebb7fe8b56a0e30809e3734c5300ce66bbdf32e780bc1259a3cdba06cd5ed3298869c63330b54726ca7cc4d2bbcb9284c0dc707fa9fe7a686188f4d6c3bbf4b7048102d26acf66d08aae7e8544623a412014cbad6627182b251822&pst=1701120614&rmtc=t
200 OK 2.5 kB URL GET HTTP/1.1 questioningsanctifypuberty.com/watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=bdaa6039ebb7fe8b56a0e30809e3734c5300ce66bbdf32e780bc1259a3cdba06cd5ed3298869c63330b54726ca7cc4d2bbcb9284c0dc707fa9fe7a686188f4d6c3bbf4b7048102d26acf66d08aae7e8544623a412014cbad6627182b251822&pst=1701120614&rmtc=t
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectquestioningsanctifypuberty.com
Fingerprint59:F5:C3:CB:DB:C8:B0:1E:36:9F:06:05:45:A1:EF:D1:C5:2D:1D:0C
ValidityTue, 21 Nov 2023 13:37:40 GMT - Mon, 19 Feb 2024 13:37:39 GMT
File type HTML document text\012- HTML document, ASCII text, with very long lines (3163)
Hash 35d14d98c8e362ef76485d97c3ed4fc8
c57143db885be725186b8068e56aafcd6390154b
0919b4de3c66c07b0020ea6520f535d0cd43017e7b8e7a250356988e7d7d0e13
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1053825173394.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=bdaa6039ebb7fe8b56a0e30809e3734c5300ce66bbdf32e780bc1259a3cdba06cd5ed3298869c63330b54726ca7cc4d2bbcb9284c0dc707fa9fe7a686188f4d6c3bbf4b7048102d26acf66d08aae7e8544623a412014cbad6627182b251822&pst=1701120614&rmtc=t HTTP/1.1
Host: questioningsanctifypuberty.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=15475157; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTQ3NTE1NywiayI6IjVlNjg3NWRhNTk2MWU4MWVkOTI0NDY5OGZkNTRmOTRkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjo1LCJwdCI6NCwicGsiOiJrc2UzM3pwZyIsImNwa3MiOnsiMjgiOiJkNzljZmZkM2EwZDU5ZjYxMWI3NDJmNGQxZjY2NTg5YSJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aC5oZW50YWktaW1nLmNvbS9pbWFnZS9kZWx0YXJ1bmUtbm9lbGxlLWhvbGlkYXktY29sbGVjdGlvbi1wYXJ0LTItcjM0L2F0dGFjaG1lbnQvNTc2LyJ9fQ.vcLH6QYmXZhN53jvyTVdvT2i2IY_bZAvbSm_Iq4oOmk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:14 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; expires=Mon, 04 Dec 2023 21:29:14 GMT; secure; SameSite=None
iprc2c3f73342e51f34466ee213c8af3ef60=3569681; expires=Tue, 28 Nov 2023 01:29:14 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 28 Nov 2023 21:29:14 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 53dcb0ef866244883fa714435e312dc3
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
cdn.pncloudfl.com/pn/46d/3e2/1a1/46d3e21a1a226dcd47b8172fb0109e352e443bdf.gif
58 kB URL cdn.pncloudfl.com/pn/46d/3e2/1a1/46d3e21a1a226dcd47b8172fb0109e352e443bdf.gif
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 36ef13ef2cd746afb8e5cc3ccc78ad66
39eb8eaf8129081474cbe9f826240ab3e8c801de
c33924ade2c78ad80e5ded55496c511f68d317ac45fe475127110fff657516eb
GET /pn/46d/3e2/1a1/46d3e21a1a226dcd47b8172fb0109e352e443bdf.gif HTTP/1.1
Host: cdn.pncloudfl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/webp
content-length: 58408
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cache-control: max-age=172800
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=gif, origSize=216925
content-disposition: inline; filename="46d3e21a1a226dcd47b8172fb0109e352e443bdf.webp"
etag: e2b7a4f06d3d2a0821fef4b6a73c6c72
expires: Tue, 28 Nov 2023 07:09:52 GMT
last-modified: Tue, 11 Jul 2023 13:54:56 GMT
vary: Accept
x-openstack-request-id: tx98866dedd8d940acab192-0064ad6368
x-proxy-cache: HIT
x-timestamp: 1689083695.43375
x-trans-id: tx98866dedd8d940acab192-0064ad6368
cf-cache-status: HIT
age: 137963
accept-ranges: bytes
access-control-allow-origin: *
server: cloudflare
cf-ray: 82cd772d0aa856a5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.pncloudfl.com/pn/15e/dd7/d1f/15edd7d1f8bed792037ca3ba9d2e0f737824602d.png
35 kB URL cdn.pncloudfl.com/pn/15e/dd7/d1f/15edd7d1f8bed792037ca3ba9d2e0f737824602d.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash fe154d28654e964dad18d2cd7d02b329
ff8e80c0b3122952e3abb8e0674ec9481858fbe0
e6d93dc8c19c40edb0e7ddfc9536738944cd6dbef5b3a1d0d9902f1ed49a3cf0
GET /pn/15e/dd7/d1f/15edd7d1f8bed792037ca3ba9d2e0f737824602d.png HTTP/1.1
Host: cdn.pncloudfl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/webp
content-length: 35092
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cache-control: max-age=172800
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=png, origSize=57692
content-disposition: inline; filename="15edd7d1f8bed792037ca3ba9d2e0f737824602d.webp"
etag: 11d58eb64e3d6da01cc37c336e810d09
expires: Tue, 28 Nov 2023 02:26:44 GMT
last-modified: Mon, 23 Dec 2019 09:00:30 GMT
vary: Accept
x-openstack-request-id: txa5fb54df0d2c42caadcf8-0061b096e8
x-proxy-cache: HIT
x-timestamp: 1577091629.21201
x-trans-id: txa5fb54df0d2c42caadcf8-0061b096e8
cf-cache-status: HIT
age: 154950
accept-ranges: bytes
access-control-allow-origin: *
server: cloudflare
cf-ray: 82cd772d0aad56a5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.pncloudfl.com/pn/60e/2ff/94b/60e2ff94b54c66aa2f634b00630b994c2fe7936d.gif
200 OK 143 kB URL GET HTTP/2 cdn.pncloudfl.com/pn/60e/2ff/94b/60e2ff94b54c66aa2f634b00630b994c2fe7936d.gif
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintC6:42:10:11:EB:FA:38:01:62:34:DA:19:86:B6:89:D4:EF:B3:37:A8
ValidityFri, 31 Mar 2023 00:00:00 GMT - Sat, 30 Mar 2024 23:59:59 GMT
File type RIFF (little-endian) data, Web/P image\012- data
Size 143 kB (142898 bytes)
Hash a3ef7f4652e064704fb9063bd2c44761
f83f6204fcc6dd4d51a6f737641961ca5a7ce1b3
ee156c275bc22e471034353c9756885a303aed35c194098a42e017d07b0d40a8
GET /pn/60e/2ff/94b/60e2ff94b54c66aa2f634b00630b994c2fe7936d.gif HTTP/1.1
Host: cdn.pncloudfl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/webp
content-length: 142898
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cache-control: max-age=172800
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=gif, origSize=367393
content-disposition: inline; filename="60e2ff94b54c66aa2f634b00630b994c2fe7936d.webp"
etag: 9fb78950119432648d8d5fb853c3eba4
expires: Wed, 29 Nov 2023 05:20:36 GMT
last-modified: Tue, 02 May 2023 12:11:05 GMT
vary: Accept
x-openstack-request-id: tx607d5e6bd8c04629a2dab-0064ad512f
x-proxy-cache: HIT
x-timestamp: 1683029464.37580
x-trans-id: tx607d5e6bd8c04629a2dab-0064ad512f
cf-cache-status: HIT
age: 58119
accept-ranges: bytes
access-control-allow-origin: *
server: cloudflare
cf-ray: 82cd772d2ac856a5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
probablebeeper.com/watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1&shu=9fd1aa377d3006b1fb14290a900ce880c74297159365348c2eac50449f4e40e8179b338d4f06ba2331f617ac04fcedf9b8f838be82c6fcb45155489840fdf61d220a6212e0a7db1bb26601517012b88ce56fd5dbe53769d913e1ac5ec831b0&pst=1701120614&rmtc=t
2.5 kB URL probablebeeper.com/watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1&shu=9fd1aa377d3006b1fb14290a900ce880c74297159365348c2eac50449f4e40e8179b338d4f06ba2331f617ac04fcedf9b8f838be82c6fcb45155489840fdf61d220a6212e0a7db1bb26601517012b88ce56fd5dbe53769d913e1ac5ec831b0&pst=1701120614&rmtc=t
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectprobablebeeper.com
Fingerprint2D:44:B6:9E:D6:A1:25:68:14:D5:E2:98:4C:8C:42:7B:35:63:C7:FA
ValidityTue, 21 Nov 2023 13:55:00 GMT - Mon, 19 Feb 2024 13:54:59 GMT
File type HTML document text\012- HTML document, ASCII text, with very long lines (3144)
Hash 8ba98fa23f8c2cfdcd365e55f35cbb52
64da274e67b2a57b6fe9b3f0442053ba7c80e084
42146c553111ee9c427468163992ad47d047560d0ec8c840a6b239622ffad208
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1659110350222.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=43c65482-e515-4fba-b0f7-cfee88ffe273%3A3%3A1&shu=9fd1aa377d3006b1fb14290a900ce880c74297159365348c2eac50449f4e40e8179b338d4f06ba2331f617ac04fcedf9b8f838be82c6fcb45155489840fdf61d220a6212e0a7db1bb26601517012b88ce56fd5dbe53769d913e1ac5ec831b0&pst=1701120614&rmtc=t HTTP/1.1
Host: probablebeeper.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=16448109; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjQ0ODEwOSwiayI6IjdmZDA3OGUzNjNmNTY3ZTYwMzllNjg0ZTU0MWY5MDIwIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjoyNSwicHQiOjQsInBrIjoiY2NtaHRmcGdwIiwiY3BrcyI6eyIyOSI6IjI3ZDBhN2M0ODhjNTBmMmU5ZjU4N2Y3N2VjMDI3Y2ExIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3poLmhlbnRhaS1pbWcuY29tL2ltYWdlL2RlbHRhcnVuZS1ub2VsbGUtaG9saWRheS1jb2xsZWN0aW9uLXBhcnQtMi1yMzQvYXR0YWNobWVudC81NzYvIn19.8lyMNv-MQfnZgTkVtQxZlEw4vxtyDWxm_IiO192CCA8
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=43c65482-e515-4fba-b0f7-cfee88ffe273:3:1; expires=Mon, 04 Dec 2023 21:29:14 GMT; secure; SameSite=None
iprc90bed77059d0f6abd346720821aa9361=3569676; expires=Tue, 28 Nov 2023 01:29:15 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
pdhtkv25=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs25=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 70873af74bbf2d95e5259f308daf4005
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
fistdoggie.com/watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=c8822e2e5e05492dcb4e10314ad3ac04ff59ec87d795618763bd7e3448773bd606eb6bd933b08eb63b2669da2802b0cc5f67e6c8904bad1c5f2457de946d52a0d0c00ff69906e3f92e95b686fe28a6b7d8c7a503dcae85da79582b4ac609ea&pst=1701120614&rmtc=t
2.1 kB URL fistdoggie.com/watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=c8822e2e5e05492dcb4e10314ad3ac04ff59ec87d795618763bd7e3448773bd606eb6bd933b08eb63b2669da2802b0cc5f67e6c8904bad1c5f2457de946d52a0d0c00ff69906e3f92e95b686fe28a6b7d8c7a503dcae85da79582b4ac609ea&pst=1701120614&rmtc=t
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectfistdoggie.com
FingerprintCF:50:1C:A5:CC:6A:4C:CA:73:98:E1:4C:58:32:84:36:4C:D1:FD:17
ValiditySat, 25 Nov 2023 07:54:38 GMT - Fri, 23 Feb 2024 07:54:37 GMT
File type HTML document, ASCII text, with very long lines (2564)
Hash 21e9caf4099315fb3e48c1727172694c
02404fdca9ae15cbb124217469508923af13a084
764e609dcab17af4889a77d7afd780b5a51068fe5e5c4804631719387c54cb43
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1263828052961.js?key=7fd078e363f567e6039e684e541f9020&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=c8822e2e5e05492dcb4e10314ad3ac04ff59ec87d795618763bd7e3448773bd606eb6bd933b08eb63b2669da2802b0cc5f67e6c8904bad1c5f2457de946d52a0d0c00ff69906e3f92e95b686fe28a6b7d8c7a503dcae85da79582b4ac609ea&pst=1701120614&rmtc=t HTTP/1.1
Host: fistdoggie.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=16448109; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjQ0ODEwOSwiayI6IjdmZDA3OGUzNjNmNTY3ZTYwMzllNjg0ZTU0MWY5MDIwIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjoyNSwicHQiOjQsInBrIjoiY2NtaHRmcGdwIiwiY3BrcyI6eyIyOSI6IjI3ZDBhN2M0ODhjNTBmMmU5ZjU4N2Y3N2VjMDI3Y2ExIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3poLmhlbnRhaS1pbWcuY29tL2ltYWdlL2RlbHRhcnVuZS1ub2VsbGUtaG9saWRheS1jb2xsZWN0aW9uLXBhcnQtMi1yMzQvYXR0YWNobWVudC81NzYvIn19.8lyMNv-MQfnZgTkVtQxZlEw4vxtyDWxm_IiO192CCA8
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; expires=Mon, 04 Dec 2023 21:29:14 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
pdhtkv25=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs25=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4c5f2797f77d7bd95a84a68bbfa26a5c
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
statesmansubstance.com/watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=dd6ece74fdd55fa899e22ee9ff9736179c95c84becbbd69f1232c64043a83272c35893bf2ff21108b29da621a6efaf215425e51fc0c7394d3ece437fb48cf887cae8953e4973d37d65da55a4488cbabae6297109910cf25c7d96fd0c722af9&pst=1701120614&rmtc=t
2.1 kB URL statesmansubstance.com/watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=dd6ece74fdd55fa899e22ee9ff9736179c95c84becbbd69f1232c64043a83272c35893bf2ff21108b29da621a6efaf215425e51fc0c7394d3ece437fb48cf887cae8953e4973d37d65da55a4488cbabae6297109910cf25c7d96fd0c722af9&pst=1701120614&rmtc=t
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectstatesmansubstance.com
Fingerprint97:C0:B6:70:6C:F2:9D:F2:F5:91:C8:32:7D:93:8E:D1:70:CB:A0:79
ValiditySat, 25 Nov 2023 08:17:32 GMT - Fri, 23 Feb 2024 08:17:31 GMT
File type HTML document, ASCII text, with very long lines (2576)
Hash 25663aa0dab6b6769ac156faef4d0f61
8a2f569565705422166017431a27845cee59a009
ec866b3c075e159b49811e2a8839b14e386fbd723479172e3d90b4c1a47791d8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.925011493008.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=dd6ece74fdd55fa899e22ee9ff9736179c95c84becbbd69f1232c64043a83272c35893bf2ff21108b29da621a6efaf215425e51fc0c7394d3ece437fb48cf887cae8953e4973d37d65da55a4488cbabae6297109910cf25c7d96fd0c722af9&pst=1701120614&rmtc=t HTTP/1.1
Host: statesmansubstance.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=15475157; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTQ3NTE1NywiayI6IjVlNjg3NWRhNTk2MWU4MWVkOTI0NDY5OGZkNTRmOTRkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjo1LCJwdCI6NCwicGsiOiJrc2UzM3pwZyIsImNwa3MiOnsiMjgiOiJkNzljZmZkM2EwZDU5ZjYxMWI3NDJmNGQxZjY2NTg5YSJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aC5oZW50YWktaW1nLmNvbS9pbWFnZS9kZWx0YXJ1bmUtbm9lbGxlLWhvbGlkYXktY29sbGVjdGlvbi1wYXJ0LTItcjM0L2F0dGFjaG1lbnQvNTc2LyJ9fQ.vcLH6QYmXZhN53jvyTVdvT2i2IY_bZAvbSm_Iq4oOmk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; expires=Mon, 04 Dec 2023 21:29:14 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1cc15b4ea356451192d18242133074ee
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
cdn.tsyndicate.com/sdk/v1/bi.js
3.1 kB URL cdn.tsyndicate.com/sdk/v1/bi.js
IP
File type C source, ASCII text, with very long lines (7708)
Hash 132db549c9f97232cccb62af9f2156b9
27a33f324e81bb08d48875a20ef18d1f22d90af9
566f0492535dba4934209ea2b08a9ee357f4c7febf4defc717e0cb1d789bb0e5
GET /sdk/v1/bi.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: application/javascript
content-length: 3084
server: nginx
last-modified: Mon, 02 Oct 2023 10:01:05 GMT
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
etag: W/"651a94e1-1e65"
content-encoding: gzip
age: 4610918
accept-ranges: bytes
X-Firefox-Spdy: h2
mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2tcVRS%2Brx1BqwuVbgSFwYW0UifvzY9OxoLFWiPFmsS2ko2b%2B%2BvNXHPfu49735s3ySpakO4cwUV19fJN0mAMxf4Bgry4KQEhs5GApktxKWIXrmSmA9ED95zz3e8svu%2Fc%2B%2Flmdkx8ZPRo%2BQOzrrSmc62aXz23omJhclddvFUN%2FJp%2Fqbqi4ovNS9XBJNn%2Bm4Hfqvnnq%2B9Jvmrm6n7g%2B4EfVBeUlaEZzE1ZqGSvE9Q6fq1ZrwWtJgb2%2F9hlHhz1IPrH5EUoMX6q9%2FABFC8RR99flW41NcmFd6NM09RY9MXOR%2FFqbPIY0UkbWg9hvDObhnFjQu6egol3Zg5g%2BlsTB2BqTLxfArB4ZyYTrL%2F9RCnTkDGYeBZ5v4TUJRQtwc1tKHFIAC6wuIQ4urdobE7XnrB0wo5J5fFfUPmYVH47izi6f0WrQfWm0VmqTOwwCAuoQQnVLZFk%2B0jXPah8Hzz9DEr8TOYeX0ccbS05baBEMXWvVAkVltByCOo8ZJOjPGShhyzxEImjKm11Qt9vhyxsNOabnPNGg%2FPW%2FEXREo3mfOgj4xN5Q6TJEFwPwe0GEruBVfXlIdmFzX6E6xVwwoNLx8T7cAN9USCXBLkjyClBrgjylCDvF9tCu7or7gntMhbMan1WG8XIpN1Num3SrozJZnJMXpiu5p%2Ff72JVHlXDRr0leJ0JLjqM%2Bj4NeCPk7ZC1g07YuUjhVAHlTk3drqsxOfvWIyRqTE5dGIDRfTi9D66eB80C0HzUrvugvVFz3sd6fL8n45SqN1TUrXETQZgCSVpBuuZt6mPy0lRJ%2B9M%2FIfnB5b1zf5dffHwe3BZIbIFP1E8EXX1ndMPkZOuGyR15sJSkKlLrdPKAN1OaytO778u13Fhx7aobfvs2nxCTdu%2BWdOl1GgsVdx357ooSQtoFY7kkP1xzK5ItZ653JbNxllxffmfhWpRY6ZwycQmqDp8rwdWYPHNwdfo1X1noQdkSNisQZQdkFlBmHzzZgEsOLu%2B%2BvPd08NofcIbA6pMZlnjIs2Jk6%2BzkUisCLU8wZQXcfzA76TfdHXRtBTS9jTgq0LcF%2BroA1UO47MwoTezB5YdfT%2BIbMF0ZMW0rW0xb%2FdV0tWPy6ulHk%2FTrJB3DqaOqbIV%2BKP26ZGGHhW3qi07Y7DDaCWSbtWiA1I2lPPP6vwAAAP%2F%2FAQAA%2F%2F8b80wJgQQAAA%3D%3D
7 B URL mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2tcVRS%2Brx1BqwuVbgSFwYW0UifvzY9OxoLFWiPFmsS2ko2b%2B%2BvNXHPfu49735s3ySpakO4cwUV19fJN0mAMxf4Bgry4KQEhs5GApktxKWIXrmSmA9ED95zz3e8svu%2Fc%2B%2Flmdkx8ZPRo%2BQOzrrSmc62aXz23omJhclddvFUN%2FJp%2Fqbqi4ovNS9XBJNn%2Bm4Hfqvnnq%2B9Jvmrm6n7g%2B4EfVBeUlaEZzE1ZqGSvE9Q6fq1ZrwWtJgb2%2F9hlHhz1IPrH5EUoMX6q9%2FABFC8RR99flW41NcmFd6NM09RY9MXOR%2FFqbPIY0UkbWg9hvDObhnFjQu6egol3Zg5g%2BlsTB2BqTLxfArB4ZyYTrL%2F9RCnTkDGYeBZ5v4TUJRQtwc1tKHFIAC6wuIQ4urdobE7XnrB0wo5J5fFfUPmYVH47izi6f0WrQfWm0VmqTOwwCAuoQQnVLZFk%2B0jXPah8Hzz9DEr8TOYeX0ccbS05baBEMXWvVAkVltByCOo8ZJOjPGShhyzxEImjKm11Qt9vhyxsNOabnPNGg%2FPW%2FEXREo3mfOgj4xN5Q6TJEFwPwe0GEruBVfXlIdmFzX6E6xVwwoNLx8T7cAN9USCXBLkjyClBrgjylCDvF9tCu7or7gntMhbMan1WG8XIpN1Num3SrozJZnJMXpiu5p%2Ff72JVHlXDRr0leJ0JLjqM%2Bj4NeCPk7ZC1g07YuUjhVAHlTk3drqsxOfvWIyRqTE5dGIDRfTi9D66eB80C0HzUrvugvVFz3sd6fL8n45SqN1TUrXETQZgCSVpBuuZt6mPy0lRJ%2B9M%2FIfnB5b1zf5dffHwe3BZIbIFP1E8EXX1ndMPkZOuGyR15sJSkKlLrdPKAN1OaytO778u13Fhx7aobfvs2nxCTdu%2BWdOl1GgsVdx357ooSQtoFY7kkP1xzK5ItZ653JbNxllxffmfhWpRY6ZwycQmqDp8rwdWYPHNwdfo1X1noQdkSNisQZQdkFlBmHzzZgEsOLu%2B%2BvPd08NofcIbA6pMZlnjIs2Jk6%2BzkUisCLU8wZQXcfzA76TfdHXRtBTS9jTgq0LcF%2BroA1UO47MwoTezB5YdfT%2BIbMF0ZMW0rW0xb%2FdV0tWPy6ulHk%2FTrJB3DqaOqbIV%2BKP26ZGGHhW3qi07Y7DDaCWSbtWiA1I2lPPP6vwAAAP%2F%2FAQAA%2F%2F8b80wJgQQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2tcVRS%2Brx1BqwuVbgSFwYW0UifvzY9OxoLFWiPFmsS2ko2b%2B%2BvNXHPfu49735s3ySpakO4cwUV19fJN0mAMxf4Bgry4KQEhs5GApktxKWIXrmSmA9ED95zz3e8svu%2Fc%2B%2Flmdkx8ZPRo%2BQOzrrSmc62aXz23omJhclddvFUN%2FJp%2Fqbqi4ovNS9XBJNn%2Bm4Hfqvnnq%2B9Jvmrm6n7g%2B4EfVBeUlaEZzE1ZqGSvE9Q6fq1ZrwWtJgb2%2F9hlHhz1IPrH5EUoMX6q9%2FABFC8RR99flW41NcmFd6NM09RY9MXOR%2FFqbPIY0UkbWg9hvDObhnFjQu6egol3Zg5g%2BlsTB2BqTLxfArB4ZyYTrL%2F9RCnTkDGYeBZ5v4TUJRQtwc1tKHFIAC6wuIQ4urdobE7XnrB0wo5J5fFfUPmYVH47izi6f0WrQfWm0VmqTOwwCAuoQQnVLZFk%2B0jXPah8Hzz9DEr8TOYeX0ccbS05baBEMXWvVAkVltByCOo8ZJOjPGShhyzxEImjKm11Qt9vhyxsNOabnPNGg%2FPW%2FEXREo3mfOgj4xN5Q6TJEFwPwe0GEruBVfXlIdmFzX6E6xVwwoNLx8T7cAN9USCXBLkjyClBrgjylCDvF9tCu7or7gntMhbMan1WG8XIpN1Num3SrozJZnJMXpiu5p%2Ff72JVHlXDRr0leJ0JLjqM%2Bj4NeCPk7ZC1g07YuUjhVAHlTk3drqsxOfvWIyRqTE5dGIDRfTi9D66eB80C0HzUrvugvVFz3sd6fL8n45SqN1TUrXETQZgCSVpBuuZt6mPy0lRJ%2B9M%2FIfnB5b1zf5dffHwe3BZIbIFP1E8EXX1ndMPkZOuGyR15sJSkKlLrdPKAN1OaytO778u13Fhx7aobfvs2nxCTdu%2BWdOl1GgsVdx357ooSQtoFY7kkP1xzK5ItZ653JbNxllxffmfhWpRY6ZwycQmqDp8rwdWYPHNwdfo1X1noQdkSNisQZQdkFlBmHzzZgEsOLu%2B%2BvPd08NofcIbA6pMZlnjIs2Jk6%2BzkUisCLU8wZQXcfzA76TfdHXRtBTS9jTgq0LcF%2BroA1UO47MwoTezB5YdfT%2BIbMF0ZMW0rW0xb%2FdV0tWPy6ulHk%2FTrJB3DqaOqbIV%2BKP26ZGGHhW3qi07Y7DDaCWSbtWiA1I2lPPP6vwAAAP%2F%2FAQAA%2F%2F8b80wJgQQAAA%3D%3D HTTP/1.1
Host: mountedgrasshomesick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6ea8298ee9286b451f792d9b27717a3f
Strict-Transport-Security: max-age=0; includeSubdomains
banquetunarmedgrater.com/advertisers.js
0 B URL banquetunarmedgrater.com/advertisers.js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /advertisers.js HTTP/1.1
Host: banquetunarmedgrater.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: application/javascript
content-length: 0
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=172800
x-request-id: 7d1acf6cf03dab211714393fbff8bbb2
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Mon, 27 Nov 2023 21:29:15 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4FzqMkTP8AWOdjJmwmUFo6yT7Rn1JTbByViRykQlbxQi6suoEUHOYLyA0%2F1HpaQ6vL5x%2Fr4KJxCFAKrNr7CwiIEwYo3IfHySZYcr%2BACcMEZ%2BtUlWnSM9HDkee5DLIxtevK9ZsTq5kcZqGLA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd772d2838771a-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
poweredby.jads.co/adshow.php?adzone=818858
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=818858
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (400), with CRLF, LF line terminators
Hash 1b7f44cb8cc87476436fd36eec23c7cb
3a9225aea39252f5ce95398e88d8d81df0dbfe7f
a53d3e88a680784c9e869ed4468c034fe8cab758f76a20dbe81e35bcd2a68fb0
GET /adshow.php?adzone=818858 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=1545af51060e34967c70483f92083b97; expires=Tue, 26-Nov-2024 21:29:14 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YTowOnt9; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
poweredby.jads.co/adshow.php?adzone=818858
200 OK 1.8 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=818858
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1626), with CRLF, LF line terminators
Hash 9efb7fc53fec92bd387a442b4cb9189d
5b24a5dc8e5f938c35a34d9589cdc141a081109c
dcc05718396ec06fbf315e75883286e29bda4bcb3e61caa5990918c8da01be02
GET /adshow.php?adzone=818858 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=1545af51060e34967c70483f92083b97; expires=Tue, 26-Nov-2024 21:29:14 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YTowOnt9; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
poweredby.jads.co/adshow.php?adzone=818858
200 OK 1.8 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=818858
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1626), with CRLF, LF line terminators
Hash 9efb7fc53fec92bd387a442b4cb9189d
5b24a5dc8e5f938c35a34d9589cdc141a081109c
dcc05718396ec06fbf315e75883286e29bda4bcb3e61caa5990918c8da01be02
GET /adshow.php?adzone=818858 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=1545af51060e34967c70483f92083b97; expires=Tue, 26-Nov-2024 21:29:14 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YTowOnt9; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
adsmediabox.com/jrt-cb.php?r=136058&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
1.3 kB URL adsmediabox.com/jrt-cb.php?r=136058&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
IP
ASN #43350 NForce Entertainment B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (386)
Hash cefcc3b47934057a27aefc2daab646af
2221fb957b27a574e12b3a6e3047e73e27efdcce
9ce7f04a83a49e68885b3540a950a18b57743d1098525a48cd7769afdb312f38
GET /jrt-cb.php?r=136058&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242 HTTP/1.1
Host: adsmediabox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
go.eabids.com/eactrl.go
200 OK 17 B IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectgo.eabids.com
FingerprintE5:44:EA:89:06:0E:AD:1B:B6:06:EB:98:BB:4A:C6:55:B7:01:14:8E
ValidityThu, 05 Oct 2023 21:00:10 GMT - Wed, 03 Jan 2024 21:00:09 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash b872e7ac3d38661b8bcb1fa6783f94f1
9c392d3ab493fd1deed08d940fb5eb8fd172bacf
705f5f7b4bdf30dca8101d29f5dd2c9eef7348c0777f4dfe7abddfb52b5486b5
POST /eactrl.go HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 3982
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: text/plain; charset=utf-8
content-length: 17
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://zh.hentai-img.com
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token,X-CSRFToken, Authorization
access-control-allow-credentials: true
expires: Mon, 03 Jul 2001 06:00:00 GMT
last-modified: Janon, 27 11 2023 21:29:15 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0,post-check=0, pre-check=0
pragma: no-cache
x-backend-server: nl2-web-202
X-Firefox-Spdy: h2
static.eabids.com/data/bannerpools/112022/34523.gif
58 kB URL static.eabids.com/data/bannerpools/112022/34523.gif
IP
File type GIF image data, version 89a, 728 x 120\012- data
Hash 4b0227ff437d3f5785a6627671227141
8d0dc0790431e3f4e7e1c50f7995843d5c69ad60
ba4f530f1bb26a04b3ade209713c1170b654db0347747d33e7555c7cd9a86c29
GET /data/bannerpools/112022/34523.gif HTTP/1.1
Host: static.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/gif
content-length: 58466
last-modified: Thu, 28 Apr 2022 13:46:17 GMT
etag: "626a9aa9-e462"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-backend-server: nl2-static-224
accept-ranges: bytes
X-Firefox-Spdy: h2
mountedgrasshomesick.com/65/aa/28/65aa283021630dfd9030555c4c61a78c.js
25 kB URL mountedgrasshomesick.com/65/aa/28/65aa283021630dfd9030555c4c61a78c.js
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with very long lines (62388), with no line terminators
Hash 38d39ad21949ca04f77b2e0c45b0fd68
83b37b9d0b77f0aa2ff30b7d798c4ec153a55c45
bc76fb0700da0445410a9c060dbebe49a2c629e17d675d071b85d5fac86b90a5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /65/aa/28/65aa283021630dfd9030555c4c61a78c.js HTTP/1.1
Host: mountedgrasshomesick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c5b3c68e076a7fe7d04d71eeccdcbbcb
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
static.eabids.com/data/bannerpools/112022/34159.gif
200 OK 52 kB URL GET HTTP/2 static.eabids.com/data/bannerpools/112022/34159.gif
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectstatic.eabids.com
FingerprintE9:DD:1B:37:D8:1B:5D:D5:D9:23:EC:67:54:40:A0:7E:A7:02:D3:7F
ValidityThu, 05 Oct 2023 21:00:19 GMT - Wed, 03 Jan 2024 21:00:18 GMT
File type GIF image data, version 89a, 728 x 180\012- data
Hash 3e73e5074bcc4e08cb0ddc6c7f146b2b
e64c52055b552decc72468fca0d5d3c09885f6d7
1908f2c1b7852ae4adca24f42e43ffb075ee219c68884d5e5bfe431b7f89837c
GET /data/bannerpools/112022/34159.gif HTTP/1.1
Host: static.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/gif
content-length: 51965
last-modified: Thu, 28 Apr 2022 13:46:37 GMT
etag: "626a9abd-cafd"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-backend-server: nl2-static-224
accept-ranges: bytes
X-Firefox-Spdy: h2
deskfrontfreely.com/watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=820adcba5fe1d4ad9b01b0988c48d3424fb8d1093827e523d280ac048a83afd55462f3bd5b03f8590ef099442c56a6e2150aa8ac976e854717e779e40a478fdca852042cdb51b029eef3bf317dd4c6fa06b21f8a436b284b0b643a4521a1a80a503fcb&pst=1701120614&rmtc=t
200 OK 2.1 kB URL GET HTTP/1.1 deskfrontfreely.com/watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=820adcba5fe1d4ad9b01b0988c48d3424fb8d1093827e523d280ac048a83afd55462f3bd5b03f8590ef099442c56a6e2150aa8ac976e854717e779e40a478fdca852042cdb51b029eef3bf317dd4c6fa06b21f8a436b284b0b643a4521a1a80a503fcb&pst=1701120614&rmtc=t
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectdeskfrontfreely.com
Fingerprint5F:5A:75:13:04:62:4E:9B:25:15:20:68:9A:95:42:F9:93:AB:32:28
ValidityTue, 07 Nov 2023 08:02:15 GMT - Mon, 05 Feb 2024 08:02:14 GMT
File type HTML document, ASCII text, with very long lines (2568)
Hash 9d6c6d2d4f18fb603e7b375ae9ce30af
967ffed3850735a7489873b2d114cae6049dc863
c8c39fb3c2e707b9f113e7e578d8973667843e1104dafe8b58133325383168ce
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.222154876040.js?key=5e6875da5961e81ed9244698fd54f94d&kw=%5B%22deltarune%22%2C%22noelle%22%2C%22holiday%22%2C%22collection%22%2C%22part%22%2C%222%22%2C%22r34%22%2C%22-%22%2C%22576%22%2C%221526%22%2C%22-%22%2C%22hentai%22%2C%22image%22%5D&refer=https%3A%2F%2Fzh.hentai-img.com%2Fimage%2Fdeltarune-noelle-holiday-collection-part-2-r34%2Fattachment%2F576%2F&tz=0&dev=e&res=14.3095&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1&shu=820adcba5fe1d4ad9b01b0988c48d3424fb8d1093827e523d280ac048a83afd55462f3bd5b03f8590ef099442c56a6e2150aa8ac976e854717e779e40a478fdca852042cdb51b029eef3bf317dd4c6fa06b21f8a436b284b0b643a4521a1a80a503fcb&pst=1701120614&rmtc=t HTTP/1.1
Host: deskfrontfreely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=15475157; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTQ3NTE1NywiayI6IjVlNjg3NWRhNTk2MWU4MWVkOTI0NDY5OGZkNTRmOTRkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzI2ODE1LCJwaWQiOjE0MjQ1NiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjo1LCJwdCI6NCwicGsiOiJrc2UzM3pwZyIsImNwa3MiOnsiMjgiOiJkNzljZmZkM2EwZDU5ZjYxMWI3NDJmNGQxZjY2NTg5YSJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aC5oZW50YWktaW1nLmNvbS9pbWFnZS9kZWx0YXJ1bmUtbm9lbGxlLWhvbGlkYXktY29sbGVjdGlvbi1wYXJ0LTItcjM0L2F0dGFjaG1lbnQvNTc2LyJ9fQ.vcLH6QYmXZhN53jvyTVdvT2i2IY_bZAvbSm_Iq4oOmk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; expires=Mon, 04 Dec 2023 21:29:15 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 28 Nov 2023 21:29:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0c674d1668d0873c6bfeeffaab0c58ec
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
poweredby.jads.co/adshow.php?adzone=681607
200 OK 1.8 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=681607
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1626), with CRLF, LF line terminators
Hash daff2d033531246f4e6f38291afd6601
142d9590864abc6be0eacfb880d275ec100721e9
96dc41fd187cc52bfe74643f7dada38203507c540ae5dbf178a1a6d8e9d51f74
GET /adshow.php?adzone=681607 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=1545af51060e34967c70483f92083b97; expires=Tue, 26-Nov-2024 21:29:14 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
imps32597=1; expires=Tue, 28-Nov-2023 21:29:15 GMT; Max-Age=86400; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTQ7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259199; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
friendshipmale.com/sfp.js
200 OK 30 kB URL GET HTTP/2 friendshipmale.com/sfp.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Hash 924e967bca1d599992556a8d139b1c5a
222b09dbf164ddc03d39100fd0524a22018d28b2
ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 95ebcb66fc6d0761a8a1f8c9760e2b9b
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Mon, 27 Nov 2023 21:29:14 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1o3wjzJKgMQbPdE2iuboJ3EUMearzGTgWTvg8zLfx3vSAw4LfHtmnaZ0t%2Bq6KS6jUYNIiVr%2Ff2LJJvNQtJI1mAaycQjkO8aF0s%2BfixQFUErbgLtKdPMBequ3b%2B2uno0AuuaYRU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd772a5ff188aa-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
convalescemeltallpurpose.com/pixel/purst?dl=0&th=0&sc=0&rs=6549&rd=6549&fd=1015&bv=23.11.v.7&tmpl=70
200 OK 0 B URL GET HTTP/1.1 convalescemeltallpurpose.com/pixel/purst?dl=0&th=0&sc=0&rs=6549&rd=6549&fd=1015&bv=23.11.v.7&tmpl=70
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectconvalescemeltallpurpose.com
FingerprintA7:AC:F0:64:6E:2C:BF:45:B4:17:AE:74:31:45:EA:EF:58:6A:92:2D
ValiditySat, 25 Nov 2023 07:58:40 GMT - Fri, 23 Feb 2024 07:58:39 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=6549&rd=6549&fd=1015&bv=23.11.v.7&tmpl=70 HTTP/1.1
Host: convalescemeltallpurpose.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
poweredby.jads.co/js/jads2.js
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/js/jads2.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (3758), with no line terminators
Hash bc8141c4650030c41f6a98026b12ce80
af5618f7e467a207d4c64627be580283ab5640cd
5ad0b5133e45b32908a388c8c6dcfca2c23d1d9d3e2ed6a839a742bab1ffde51
GET /js/jads2.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 20 Sep 2023 21:26:09 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"650b6371-eae"
Content-Encoding: gzip
hentai-cosplays.com/api/w/?m=html&search_type=merge&language=zh&count=4&domain=hentai-cosplays.com&tag[]=english
1.7 kB URL hentai-cosplays.com/api/w/?m=html&search_type=merge&language=zh&count=4&domain=hentai-cosplays.com&tag[]=english
IP
Hash 2fde9cdeb894375d44f38afb1328d8ef
78699314a7e56548a933e19a909c1c577443d96e
1910e3d262baeb95f4ad6bd4e64d74aeeececf70de0229494a3f4287f9819bab
POST /api/w/?m=html&search_type=merge&language=zh&count=4&domain=hentai-cosplays.com&tag[]=english HTTP/1.1
Host: hentai-cosplays.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, User-Agent, User-Agent
access-control-allow-origin: *
fastcgi-cache: HIT
x-frame-options: SAMEORIGIN, SAMEORIGIN
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UsO%2FUcPz0hi9j5Ncorz7XXy%2F9KNUyPMPA%2FohUiFwUQxi2eA8B%2Bsyp7QA%2FY%2BcjoPBG4giqMPg4Czy%2Frnj5%2Bi9l9paG%2BK7Bco2IvCaDUwuhzhf49yNFZJ441J6bFQOEOHzl66fvkrK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cd772a8bab63f5-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
poweredby.jads.co/js/jads2.js
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/js/jads2.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (3758), with no line terminators
Hash bc8141c4650030c41f6a98026b12ce80
af5618f7e467a207d4c64627be580283ab5640cd
5ad0b5133e45b32908a388c8c6dcfca2c23d1d9d3e2ed6a839a742bab1ffde51
GET /js/jads2.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 20 Sep 2023 21:26:09 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"650b6371-eae"
Content-Encoding: gzip
mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2tcVRS%2BLx1B6qZKN4KLwYWo1Ml78yOTsWAx1kgwJrGtZH1%2Fvck19737uPe9eZOsUgva5QguqquXb5IGYyj2D1Bk4qYEhcxGApouxaUIRVzJTAdGD9xzzne%2Fs%2Fi%2Bc%2B%2Bnu9k58ZHRs7UPzLbSms42Kn751XUVC5O78sqtcuBX%2FKvldRXP1a%2BWu6NkO28GfqPiv1Z%2BT%2FJNM1v1A98P%2FKC8qKwMTXd2zEIlR62g0vIr9WolaNTRtf%2FHLvPgqAfROScvQInhMxuPHkLxAeLo2%2BvSbaYmufJulGmaGouOOPgo3oxNHiOatqH1EMYHk2kYNyTk3gxMfDBxANPZGzkAU0Pi%2FRKAxQcTmWCd%2FadKmYaMwcRzyDsDSD2AogNwcwdKnBKAC6ysIo7urxib062nLB2xQ1J68hdUPiSl3y4jjh4saNUt3zQ6S5WJHbphAdUdQLUHSLJjpNseVH4Mnn4CJX4ms0%2BWEUd7q04bKFGM3Ss1gAoH0LIH6jxko6M8ZKGHLPEQibMybbRC32%2BGLKzV5uuc81qN88b8nGiIWn0%2B9JHxkbwe0qQHrnvgdgeJ3cGm%2BvyUHMJmP8BtFHDCg0uHxPtwBx1RIJcEuSPIKUGuCPKUIO8U%2B0K7qivuC%2B0yFkxqdVJrRd%2Bk7V26b9K2jMluck6eH6%2Fmn9%2FvYVOelcNatSF4lQkuWoz6Pg14LeTNkDWDVtiao3CqgHIzY7fbakguv%2FUYiRqSmStdMHoMp4%2FB1SXQLADN%2B82qD7rRr8%2F72I4fbMg4peoNFbUr3EQQpkCSlpBuebv6nLw4VvLyhceQ%2FOTa4UtHzwav%2FAFuCyS2wMfqR4K2vtu%2FYXKyd8PkjjxcTVIVqW06esCbKU3lhcP35VZurFi67npfv81HxKg9uiVdukxjoeK2I98sKCGkXTSWS%2FLdkluXbC1zGwuZjbNkee2dxaUosdI5ZeIBqDpd%2FRtcDUnp9vfjr3npp8%2Bg7AA2KxBlJ2QSUOYYPNmBS6bqnSGwejrDkhnkWdG3VTa91IpAyymmrID7D2bTftfdRduWQNM7iKMCHVugowtQ3YPLLvbTxJ5ce%2FTlKL4C06U%2B07a0x7TVXwxJ8%2Faf4%2F2O0q%2BjdA6nzsqyEfqh9KuShS0WNqkvWmG9xWgrkE3WoAFSN5Ty4uv%2FAgAA%2F%2F8BAAD%2F%2F2p0iJ%2BBBAAA
7 B URL mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2tcVRS%2BLx1B6qZKN4KLwYWo1Ml78yOTsWAx1kgwJrGtZH1%2Fvck19737uPe9eZOsUgva5QguqquXb5IGYyj2D1Bk4qYEhcxGApouxaUIRVzJTAdGD9xzzne%2Fs%2Fi%2Bc%2B%2Bnu9k58ZHRs7UPzLbSms42Kn751XUVC5O78sqtcuBX%2FKvldRXP1a%2BWu6NkO28GfqPiv1Z%2BT%2FJNM1v1A98P%2FKC8qKwMTXd2zEIlR62g0vIr9WolaNTRtf%2FHLvPgqAfROScvQInhMxuPHkLxAeLo2%2BvSbaYmufJulGmaGouOOPgo3oxNHiOatqH1EMYHk2kYNyTk3gxMfDBxANPZGzkAU0Pi%2FRKAxQcTmWCd%2FadKmYaMwcRzyDsDSD2AogNwcwdKnBKAC6ysIo7urxib062nLB2xQ1J68hdUPiSl3y4jjh4saNUt3zQ6S5WJHbphAdUdQLUHSLJjpNseVH4Mnn4CJX4ms0%2BWEUd7q04bKFGM3Ss1gAoH0LIH6jxko6M8ZKGHLPEQibMybbRC32%2BGLKzV5uuc81qN88b8nGiIWn0%2B9JHxkbwe0qQHrnvgdgeJ3cGm%2BvyUHMJmP8BtFHDCg0uHxPtwBx1RIJcEuSPIKUGuCPKUIO8U%2B0K7qivuC%2B0yFkxqdVJrRd%2Bk7V26b9K2jMluck6eH6%2Fmn9%2FvYVOelcNatSF4lQkuWoz6Pg14LeTNkDWDVtiao3CqgHIzY7fbakguv%2FUYiRqSmStdMHoMp4%2FB1SXQLADN%2B82qD7rRr8%2F72I4fbMg4peoNFbUr3EQQpkCSlpBuebv6nLw4VvLyhceQ%2FOTa4UtHzwav%2FAFuCyS2wMfqR4K2vtu%2FYXKyd8PkjjxcTVIVqW06esCbKU3lhcP35VZurFi67npfv81HxKg9uiVdukxjoeK2I98sKCGkXTSWS%2FLdkluXbC1zGwuZjbNkee2dxaUosdI5ZeIBqDpd%2FRtcDUnp9vfjr3npp8%2Bg7AA2KxBlJ2QSUOYYPNmBS6bqnSGwejrDkhnkWdG3VTa91IpAyymmrID7D2bTftfdRduWQNM7iKMCHVugowtQ3YPLLvbTxJ5ce%2FTlKL4C06U%2B07a0x7TVXwxJ8%2Faf4%2F2O0q%2BjdA6nzsqyEfqh9KuShS0WNqkvWmG9xWgrkE3WoAFSN5Ty4uv%2FAgAA%2F%2F8BAAD%2F%2F2p0iJ%2BBBAAA
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2tcVRS%2BLx1B6qZKN4KLwYWo1Ml78yOTsWAx1kgwJrGtZH1%2Fvck19737uPe9eZOsUgva5QguqquXb5IGYyj2D1Bk4qYEhcxGApouxaUIRVzJTAdGD9xzzne%2Fs%2Fi%2Bc%2B%2Bnu9k58ZHRs7UPzLbSms42Kn751XUVC5O78sqtcuBX%2FKvldRXP1a%2BWu6NkO28GfqPiv1Z%2BT%2FJNM1v1A98P%2FKC8qKwMTXd2zEIlR62g0vIr9WolaNTRtf%2FHLvPgqAfROScvQInhMxuPHkLxAeLo2%2BvSbaYmufJulGmaGouOOPgo3oxNHiOatqH1EMYHk2kYNyTk3gxMfDBxANPZGzkAU0Pi%2FRKAxQcTmWCd%2FadKmYaMwcRzyDsDSD2AogNwcwdKnBKAC6ysIo7urxib062nLB2xQ1J68hdUPiSl3y4jjh4saNUt3zQ6S5WJHbphAdUdQLUHSLJjpNseVH4Mnn4CJX4ms0%2BWEUd7q04bKFGM3Ss1gAoH0LIH6jxko6M8ZKGHLPEQibMybbRC32%2BGLKzV5uuc81qN88b8nGiIWn0%2B9JHxkbwe0qQHrnvgdgeJ3cGm%2BvyUHMJmP8BtFHDCg0uHxPtwBx1RIJcEuSPIKUGuCPKUIO8U%2B0K7qivuC%2B0yFkxqdVJrRd%2Bk7V26b9K2jMluck6eH6%2Fmn9%2FvYVOelcNatSF4lQkuWoz6Pg14LeTNkDWDVtiao3CqgHIzY7fbakguv%2FUYiRqSmStdMHoMp4%2FB1SXQLADN%2B82qD7rRr8%2F72I4fbMg4peoNFbUr3EQQpkCSlpBuebv6nLw4VvLyhceQ%2FOTa4UtHzwav%2FAFuCyS2wMfqR4K2vtu%2FYXKyd8PkjjxcTVIVqW06esCbKU3lhcP35VZurFi67npfv81HxKg9uiVdukxjoeK2I98sKCGkXTSWS%2FLdkluXbC1zGwuZjbNkee2dxaUosdI5ZeIBqDpd%2FRtcDUnp9vfjr3npp8%2Bg7AA2KxBlJ2QSUOYYPNmBS6bqnSGwejrDkhnkWdG3VTa91IpAyymmrID7D2bTftfdRduWQNM7iKMCHVugowtQ3YPLLvbTxJ5ce%2FTlKL4C06U%2B07a0x7TVXwxJ8%2Faf4%2F2O0q%2BjdA6nzsqyEfqh9KuShS0WNqkvWmG9xWgrkE3WoAFSN5Ty4uv%2FAgAA%2F%2F8BAAD%2F%2F2p0iJ%2BBBAAA HTTP/1.1
Host: mountedgrasshomesick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8d173dfe0c78a18fbf45708541b34d73
Strict-Transport-Security: max-age=0; includeSubdomains
mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSzWtcVRy9rxlB6qZKN4KLwYWo1Ml785HJWLAYayQYk9hWsr5fb3LNfe8%2B7n1v3iSr1Ip0OYKL6urlTNJgDMX%2BAYpM3JSgkNlIQNOluBShiCuZ6cDoD%2B7v457f4pxz72e72TnxkdGztQ%2FMttKazjYqfvnVdRULk7vyyq1y4Ff8q%2BV1Fc%2FVr5a7o2Q7bwZ%2Bo%2BK%2FVn5P8k0zW%2FUD3w%2F8oLyorAxNd3aMQiVHraDS8iv1aiVo1NG1%2F59d5sFRD6JzTl6AEsNnNh49hOIDxNG316XbTE1y5d0o0zQ1Fh1x8FG8GZs8RjRtQ%2BshjA8m2zBuSMi9CzDxwUQBTGdvpABMDYn3SwAWH0xognX2nzJlGjIGE88h7wwg9QCKDsDNHShxSgAusLKKOLq%2FYmxOt56idIQOSenJX1D5kJR%2Bu4w4erCgVbd80%2BgsVSZ26IYFVHcA1R4gyY6RbntQ%2BTF4%2BgmU%2BJnMPllGHO2tOm2gRDFWr9QAKhxAyx6o85CNjvKQhR6yxEMkzsq00Qp9vxmysFabr3POazXOG%2FNzoiFq9fnQR8ZH9HpIkx647oHbHSR2B5vq81NyCJv9ALdRwAkPLh0S78MddESBXBLkjiCnBLkiyFOCvFPsC%2B2qrrgvtMtYMKnVSa0VfZO2d%2Bm%2BSdsyJrvJOXl%2BbM0%2Fv9%2FDpjwrh7VqQ%2FAqE1y0GPV9GvBayJshawatsDVH4VQB5S6M1W6rIbn81mMkakguXOmC0WM4fQyuLoFmAWjeb1Z90I1%2Bfd7HdvxgQ8YpVW%2BoqF3hJoIwBZK0hHTL29Xn5MUxk5dnfoXkJ9cOXzp6NnjlD3BbILEFPlY%2FErT13f4Nk5O9GyZ35OFqkqpIbdPRA95MaSpnDt%2BXW7mxYum66339Nh8Bo%2FbolnTpMo2FituOfLOghJB20VguyXdLbl2ytcxtLGQ2zpLltXcWl6LESueUiQeg6nT1b3A1JKXb34%2B%2F5qWfPoWyA9isQJSdkElAmWPwZAcumbJ3hsDq6Q5LZpBnRd9W2fRSKwItpzNlBdx%2FZjbtd91dtG0JNL2DOCrQsQU6ugDVPbjsYj9N7Mm1R1%2BO4iswXeozbUt7TFv9xZA0b%2F858vfx2ORROodTZ2XZCP1Q%2BlXJwhYLm9QXrbDeYrQVyCZr0ACpG0p58fV%2FAQAA%2F%2F8BAAD%2F%2F2z2INOBBAAA
200 OK 7 B URL GET HTTP/1.1 mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSzWtcVRy9rxlB6qZKN4KLwYWo1Ml785HJWLAYayQYk9hWsr5fb3LNfe8%2B7n1v3iSr1Ip0OYKL6urlTNJgDMX%2BAYpM3JSgkNlIQNOluBShiCuZ6cDoD%2B7v457f4pxz72e72TnxkdGztQ%2FMttKazjYqfvnVdRULk7vyyq1y4Ff8q%2BV1Fc%2FVr5a7o2Q7bwZ%2Bo%2BK%2FVn5P8k0zW%2FUD3w%2F8oLyorAxNd3aMQiVHraDS8iv1aiVo1NG1%2F59d5sFRD6JzTl6AEsNnNh49hOIDxNG316XbTE1y5d0o0zQ1Fh1x8FG8GZs8RjRtQ%2BshjA8m2zBuSMi9CzDxwUQBTGdvpABMDYn3SwAWH0xognX2nzJlGjIGE88h7wwg9QCKDsDNHShxSgAusLKKOLq%2FYmxOt56idIQOSenJX1D5kJR%2Bu4w4erCgVbd80%2BgsVSZ26IYFVHcA1R4gyY6RbntQ%2BTF4%2BgmU%2BJnMPllGHO2tOm2gRDFWr9QAKhxAyx6o85CNjvKQhR6yxEMkzsq00Qp9vxmysFabr3POazXOG%2FNzoiFq9fnQR8ZH9HpIkx647oHbHSR2B5vq81NyCJv9ALdRwAkPLh0S78MddESBXBLkjiCnBLkiyFOCvFPsC%2B2qrrgvtMtYMKnVSa0VfZO2d%2Bm%2BSdsyJrvJOXl%2BbM0%2Fv9%2FDpjwrh7VqQ%2FAqE1y0GPV9GvBayJshawatsDVH4VQB5S6M1W6rIbn81mMkakguXOmC0WM4fQyuLoFmAWjeb1Z90I1%2Bfd7HdvxgQ8YpVW%2BoqF3hJoIwBZK0hHTL29Xn5MUxk5dnfoXkJ9cOXzp6NnjlD3BbILEFPlY%2FErT13f4Nk5O9GyZ35OFqkqpIbdPRA95MaSpnDt%2BXW7mxYum66339Nh8Bo%2FbolnTpMo2FituOfLOghJB20VguyXdLbl2ytcxtLGQ2zpLltXcWl6LESueUiQeg6nT1b3A1JKXb34%2B%2F5qWfPoWyA9isQJSdkElAmWPwZAcumbJ3hsDq6Q5LZpBnRd9W2fRSKwItpzNlBdx%2FZjbtd91dtG0JNL2DOCrQsQU6ugDVPbjsYj9N7Mm1R1%2BO4iswXeozbUt7TFv9xZA0b%2F858vfx2ORROodTZ2XZCP1Q%2BlXJwhYLm9QXrbDeYrQVyCZr0ACpG0p58fV%2FAQAA%2F%2F8BAAD%2F%2F2z2INOBBAAA
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectmountedgrasshomesick.com
Fingerprint21:CA:EC:BD:0B:86:4F:AB:70:0B:4C:93:27:5A:4C:30:5A:67:BF:31
ValiditySat, 25 Nov 2023 08:10:03 GMT - Fri, 23 Feb 2024 08:10:02 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSzWtcVRy9rxlB6qZKN4KLwYWo1Ml785HJWLAYayQYk9hWsr5fb3LNfe8%2B7n1v3iSr1Ip0OYKL6urlTNJgDMX%2BAYpM3JSgkNlIQNOluBShiCuZ6cDoD%2B7v457f4pxz72e72TnxkdGztQ%2FMttKazjYqfvnVdRULk7vyyq1y4Ff8q%2BV1Fc%2FVr5a7o2Q7bwZ%2Bo%2BK%2FVn5P8k0zW%2FUD3w%2F8oLyorAxNd3aMQiVHraDS8iv1aiVo1NG1%2F59d5sFRD6JzTl6AEsNnNh49hOIDxNG316XbTE1y5d0o0zQ1Fh1x8FG8GZs8RjRtQ%2BshjA8m2zBuSMi9CzDxwUQBTGdvpABMDYn3SwAWH0xognX2nzJlGjIGE88h7wwg9QCKDsDNHShxSgAusLKKOLq%2FYmxOt56idIQOSenJX1D5kJR%2Bu4w4erCgVbd80%2BgsVSZ26IYFVHcA1R4gyY6RbntQ%2BTF4%2BgmU%2BJnMPllGHO2tOm2gRDFWr9QAKhxAyx6o85CNjvKQhR6yxEMkzsq00Qp9vxmysFabr3POazXOG%2FNzoiFq9fnQR8ZH9HpIkx647oHbHSR2B5vq81NyCJv9ALdRwAkPLh0S78MddESBXBLkjiCnBLkiyFOCvFPsC%2B2qrrgvtMtYMKnVSa0VfZO2d%2Bm%2BSdsyJrvJOXl%2BbM0%2Fv9%2FDpjwrh7VqQ%2FAqE1y0GPV9GvBayJshawatsDVH4VQB5S6M1W6rIbn81mMkakguXOmC0WM4fQyuLoFmAWjeb1Z90I1%2Bfd7HdvxgQ8YpVW%2BoqF3hJoIwBZK0hHTL29Xn5MUxk5dnfoXkJ9cOXzp6NnjlD3BbILEFPlY%2FErT13f4Nk5O9GyZ35OFqkqpIbdPRA95MaSpnDt%2BXW7mxYum66339Nh8Bo%2FbolnTpMo2FituOfLOghJB20VguyXdLbl2ytcxtLGQ2zpLltXcWl6LESueUiQeg6nT1b3A1JKXb34%2B%2F5qWfPoWyA9isQJSdkElAmWPwZAcumbJ3hsDq6Q5LZpBnRd9W2fRSKwItpzNlBdx%2FZjbtd91dtG0JNL2DOCrQsQU6ugDVPbjsYj9N7Mm1R1%2BO4iswXeozbUt7TFv9xZA0b%2F858vfx2ORROodTZ2XZCP1Q%2BlXJwhYLm9QXrbDeYrQVyCZr0ACpG0p58fV%2FAQAA%2F%2F8BAAD%2F%2F2z2INOBBAAA HTTP/1.1
Host: mountedgrasshomesick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 93ac26d40192678f773223e7751c8053
Strict-Transport-Security: max-age=0; includeSubdomains
poweredby.jads.co/js/jads2.js
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/js/jads2.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (3758), with no line terminators
Hash bc8141c4650030c41f6a98026b12ce80
af5618f7e467a207d4c64627be580283ab5640cd
5ad0b5133e45b32908a388c8c6dcfca2c23d1d9d3e2ed6a839a742bab1ffde51
GET /js/jads2.js HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://zh.hentai-img.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 20 Sep 2023 21:26:09 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"650b6371-eae"
Content-Encoding: gzip
mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSzWtcVRy9rx1B6qZKN4KLwYWo1Ml785HJWLAYayQYk9hWsr5fb3LNfe8%2B7n1v3iSr1ELpcgQX1dXLmaTBGIr9AxSZuClBIbORgKZLcSlCEVcyk4HRH9zfxz2%2FxTnn3ns72RnxkdHT1Y%2FMltKazjQqfvn1NRULk7vy8u1y4Ff8a%2BU1Fc%2FWr5W7o2Q7bwd%2Bo%2BK%2FUf5A8g0zU%2FUD3w%2F8oLygrAxNd2aMQiWHraDS8iv1aiVo1NG1%2F59d5sFRD6JzRl6CEsPn1p88huIDxNG3N6TbSE1y9f0o0zQ1Fh2x%2F0m8EZs8RjRtQ%2BshjPcn2zBuSMiDCzDx%2FkQBTGd3pABMDYn3SwAW709ognX2zpkyDRmDiReQdwaQegBFB%2BDmLpQ4IQAXWF5BHD1cNjanm%2BcoHaFDUnr2F1Q%2BJKXfriCOHs1r1S3fMjpLlYkdumEB1R1AtQdIsiOkWx5UfgSefgYlfiYzz5YQR7srThsoUYzVKzWACgfQsgfqPGSjozxkoYcs8RCJ0zJttELfb4YsrNXm6pzzWo3zxtysaIhafS70kfERvR7SpAeue%2BB2G4ndxob6%2FIQcwGY%2FwK0XcMKDS4fE%2B3gbHVEglwS5I8gpQa4I8pQg7xR7QruqKx4K7TIWTGp1UmtF36TtHbpn0raMyU5yRl4cW%2FPP7w%2BwIU%2FLYa3aELzKBBctRn2fBrwW8mbImkErbM1SOFVAuQtjtVtqSK688xSJGpILV7tg9AhOH4Gry6BZAJr3m1UfdL1fn%2FOxFT9al3FK1Vsqale4iSBMgSQtId30dvQZeXnM5NWLZ5D8%2BPrBK4fPB6%2F9AW4LJLbAp%2BpHgra%2B379pcrJ70%2BSOPF5JUhWpLTp6wFspTeXFgw%2FlZm6sWLzhel%2B%2Fy0fAqD28LV26RGOh4rYj38wrIaRdMJZL8t2iW5NsNXPr85mNs2Rp9b2FxSix0jll4gGoOln5G1wNSenO9%2BOvefmne1B2AJsViLJjMgkocwSebMMlU%2FbOEFg93WFJCXlW9G2VTS%2B1ItByOlNWwP1nZtN%2Bx91H25ZA07uIowIdW6CjC1Ddg8su9dPEHl9%2F8uUovgLTpT7TtrTLtNVfDEnzzp8jf5%2BO0q%2FnTjt1WpaN0A%2BlX5UsbLGwSX3RCustRluBbLIGDZC6oZSX3vwXAAD%2F%2FwEAAP%2F%2FzMCWC4EEAAA%3D
7 B URL mountedgrasshomesick.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSzWtcVRy9rx1B6qZKN4KLwYWo1Ml785HJWLAYayQYk9hWsr5fb3LNfe8%2B7n1v3iSr1ELpcgQX1dXLmaTBGIr9AxSZuClBIbORgKZLcSlCEVcyk4HRH9zfxz2%2FxTnn3ns72RnxkdHT1Y%2FMltKazjQqfvn1NRULk7vy8u1y4Ff8a%2BU1Fc%2FWr5W7o2Q7bwd%2Bo%2BK%2FUf5A8g0zU%2FUD3w%2F8oLygrAxNd2aMQiWHraDS8iv1aiVo1NG1%2F59d5sFRD6JzRl6CEsPn1p88huIDxNG3N6TbSE1y9f0o0zQ1Fh2x%2F0m8EZs8RjRtQ%2BshjPcn2zBuSMiDCzDx%2FkQBTGd3pABMDYn3SwAW709ognX2zpkyDRmDiReQdwaQegBFB%2BDmLpQ4IQAXWF5BHD1cNjanm%2BcoHaFDUnr2F1Q%2BJKXfriCOHs1r1S3fMjpLlYkdumEB1R1AtQdIsiOkWx5UfgSefgYlfiYzz5YQR7srThsoUYzVKzWACgfQsgfqPGSjozxkoYcs8RCJ0zJttELfb4YsrNXm6pzzWo3zxtysaIhafS70kfERvR7SpAeue%2BB2G4ndxob6%2FIQcwGY%2FwK0XcMKDS4fE%2B3gbHVEglwS5I8gpQa4I8pQg7xR7QruqKx4K7TIWTGp1UmtF36TtHbpn0raMyU5yRl4cW%2FPP7w%2BwIU%2FLYa3aELzKBBctRn2fBrwW8mbImkErbM1SOFVAuQtjtVtqSK688xSJGpILV7tg9AhOH4Gry6BZAJr3m1UfdL1fn%2FOxFT9al3FK1Vsqale4iSBMgSQtId30dvQZeXnM5NWLZ5D8%2BPrBK4fPB6%2F9AW4LJLbAp%2BpHgra%2B379pcrJ70%2BSOPF5JUhWpLTp6wFspTeXFgw%2FlZm6sWLzhel%2B%2Fy0fAqD28LV26RGOh4rYj38wrIaRdMJZL8t2iW5NsNXPr85mNs2Rp9b2FxSix0jll4gGoOln5G1wNSenO9%2BOvefmne1B2AJsViLJjMgkocwSebMMlU%2FbOEFg93WFJCXlW9G2VTS%2B1ItByOlNWwP1nZtN%2Bx91H25ZA07uIowIdW6CjC1Ddg8su9dPEHl9%2F8uUovgLTpT7TtrTLtNVfDEnzzp8jf5%2BO0q%2FnTjt1WpaN0A%2BlX5UsbLGwSX3RCustRluBbLIGDZC6oZSX3vwXAAD%2F%2FwEAAP%2F%2FzMCWC4EEAAA%3D
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSzWtcVRy9rx1B6qZKN4KLwYWo1Ml785HJWLAYayQYk9hWsr5fb3LNfe8%2B7n1v3iSr1ELpcgQX1dXLmaTBGIr9AxSZuClBIbORgKZLcSlCEVcyk4HRH9zfxz2%2FxTnn3ns72RnxkdHT1Y%2FMltKazjQqfvn1NRULk7vy8u1y4Ff8a%2BU1Fc%2FWr5W7o2Q7bwd%2Bo%2BK%2FUf5A8g0zU%2FUD3w%2F8oLygrAxNd2aMQiWHraDS8iv1aiVo1NG1%2F59d5sFRD6JzRl6CEsPn1p88huIDxNG3N6TbSE1y9f0o0zQ1Fh2x%2F0m8EZs8RjRtQ%2BshjPcn2zBuSMiDCzDx%2FkQBTGd3pABMDYn3SwAW709ognX2zpkyDRmDiReQdwaQegBFB%2BDmLpQ4IQAXWF5BHD1cNjanm%2BcoHaFDUnr2F1Q%2BJKXfriCOHs1r1S3fMjpLlYkdumEB1R1AtQdIsiOkWx5UfgSefgYlfiYzz5YQR7srThsoUYzVKzWACgfQsgfqPGSjozxkoYcs8RCJ0zJttELfb4YsrNXm6pzzWo3zxtysaIhafS70kfERvR7SpAeue%2BB2G4ndxob6%2FIQcwGY%2FwK0XcMKDS4fE%2B3gbHVEglwS5I8gpQa4I8pQg7xR7QruqKx4K7TIWTGp1UmtF36TtHbpn0raMyU5yRl4cW%2FPP7w%2BwIU%2FLYa3aELzKBBctRn2fBrwW8mbImkErbM1SOFVAuQtjtVtqSK688xSJGpILV7tg9AhOH4Gry6BZAJr3m1UfdL1fn%2FOxFT9al3FK1Vsqale4iSBMgSQtId30dvQZeXnM5NWLZ5D8%2BPrBK4fPB6%2F9AW4LJLbAp%2BpHgra%2B379pcrJ70%2BSOPF5JUhWpLTp6wFspTeXFgw%2FlZm6sWLzhel%2B%2Fy0fAqD28LV26RGOh4rYj38wrIaRdMJZL8t2iW5NsNXPr85mNs2Rp9b2FxSix0jll4gGoOln5G1wNSenO9%2BOvefmne1B2AJsViLJjMgkocwSebMMlU%2FbOEFg93WFJCXlW9G2VTS%2B1ItByOlNWwP1nZtN%2Bx91H25ZA07uIowIdW6CjC1Ddg8su9dPEHl9%2F8uUovgLTpT7TtrTLtNVfDEnzzp8jf5%2BO0q%2FnTjt1WpaN0A%2BlX5UsbLGwSX3RCustRluBbLIGDZC6oZSX3vwXAAD%2F%2FwEAAP%2F%2FzMCWC4EEAAA%3D HTTP/1.1
Host: mountedgrasshomesick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2500362f9ce2f3d09204d9f2f33fce4f
Strict-Transport-Security: max-age=0; includeSubdomains
poweredby.jads.co/adshow.php?adzone=681607
200 OK 1.8 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=681607
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1626), with CRLF, LF line terminators
Hash 236d1c1e2e6615cf0408a407201e954b
829b8a46cf0f6bf8f8eaab27649cb4cd26e90bb2
561037938c75bec34d9634fbdcec8f83ae42abf4d8a79360184ed361fad8f13a
GET /adshow.php?adzone=681607 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=af2afe4414d1dda45c083412caea41c6; expires=Tue, 26-Nov-2024 21:29:15 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
imps32597=1; expires=Tue, 28-Nov-2023 21:29:15 GMT; Max-Age=86400; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTU7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:15 GMT; Max-Age=259200; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:15 GMT; Max-Age=259200; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
cdn.cloudimagesb.com/cti/5d/60/ed/5d60edea793259cd719bfa3d19bcae3e/1628587069.jpg
200 OK 28 kB URL GET HTTP/2 cdn.cloudimagesb.com/cti/5d/60/ed/5d60edea793259cd719bfa3d19bcae3e/1628587069.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 321x240, components 3\012- data
Hash f4fabf64be47ce667e0cfc150667b36c
234d722efa06cbedfdad9c1bb497a942997741dd
272b7875492a55c6f53a4e4704e715cc5b3cc4e5093758cbfedd95441bfe98d8
GET /cti/5d/60/ed/5d60edea793259cd719bfa3d19bcae3e/1628587069.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/jpeg
content-length: 27606
server: nginx/1.21.6
last-modified: Tue, 10 Aug 2021 09:17:59 GMT
etag: "61124447-6bd6"
expires: Wed, 29 Nov 2023 21:29:15 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/cti/4e/61/98/4e619871efbab123abb0e0121e08e11d/1628586907.jpg
23 kB URL cdn.cloudimagesb.com/cti/4e/61/98/4e619871efbab123abb0e0121e08e11d/1628586907.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x240, components 3\012- data
Hash c6f19781c79ff746b99178f813cfbff2
5c307e43c63001535aa3a3683777dbb1a7f0775b
816b5a5d078f27271fa2d7c210d708f386a6f9fbd9242531b07f0b051382870d
GET /cti/4e/61/98/4e619871efbab123abb0e0121e08e11d/1628586907.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/jpeg
content-length: 22883
server: nginx/1.21.6
last-modified: Tue, 10 Aug 2021 09:15:16 GMT
etag: "611243a4-5963"
expires: Wed, 29 Nov 2023 21:29:15 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/cti/51/bb/80/51bb807c8b914e3cc08eace2b0587473/1628586935.jpg
30 kB URL cdn.cloudimagesb.com/cti/51/bb/80/51bb807c8b914e3cc08eace2b0587473/1628586935.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x240, components 3\012- data
Hash a87779ccaaa4021b0b4f33812742679a
87322480f885dc0b6463c182b7bdb3eb60ab2592
a8f8dbc930527f94496d5a9883b6034e27a673090a89b518596d6e2b656df96f
GET /cti/51/bb/80/51bb807c8b914e3cc08eace2b0587473/1628586935.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/jpeg
content-length: 30127
server: nginx/1.21.6
last-modified: Tue, 10 Aug 2021 09:15:44 GMT
etag: "611243c0-75af"
expires: Wed, 29 Nov 2023 21:29:15 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/b9/5d/e2/b95de288caeec55111c172964c8a9c84/1662036680.jpg
21 kB URL cdn.cloudimagesb.com/si/b9/5d/e2/b95de288caeec55111c172964c8a9c84/1662036680.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 320x240, components 3\012- data
Hash 8f4953c1b8baece7bb7d226247561ce2
da5d440970606602026d7900a55ae2fd27a3f170
8fd9df7d8e48ff2519631e82e01519d4f1c65abd41ec977c18abb58df9832919
GET /si/b9/5d/e2/b95de288caeec55111c172964c8a9c84/1662036680.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/jpeg
content-length: 20566
server: nginx/1.21.6
last-modified: Thu, 01 Sep 2022 12:51:28 GMT
etag: "6310aad0-5056"
expires: Wed, 29 Nov 2023 21:29:15 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/cti/bb/16/b7/bb16b71b76fc43a6abd135721b32a822/1658915518.png
200 OK 145 kB URL GET HTTP/2 cdn.cloudimagesb.com/cti/bb/16/b7/bb16b71b76fc43a6abd135721b32a822/1658915518.png
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced\012- data
Size 145 kB (145012 bytes)
Hash 620dee7dda3ab0a55fef5e66735e48e1
c03458e7950bed758e4352ec7a78bb434a3164b1
8552142726040854ba6a1d57037aa513e8cb424e3e5b96f017fb742f7c9255c3
GET /cti/bb/16/b7/bb16b71b76fc43a6abd135721b32a822/1658915518.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/png
content-length: 145012
server: nginx/1.21.6
last-modified: Wed, 27 Jul 2022 09:52:06 GMT
etag: "62e10ac6-23674"
expires: Wed, 29 Nov 2023 21:29:15 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
lcdn.tsyndicate.com/sdk/v1/b.b.js
200 OK 2.6 kB URL GET HTTP/2 lcdn.tsyndicate.com/sdk/v1/b.b.js
IP
Requested by https://tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
Certificate IssuerSectigo Limited
Subjectlcdn.tsyndicate.com
FingerprintAA:DB:E6:65:05:5A:83:46:D1:77:83:25:84:3D:B2:B5:F5:99:97:00
ValidityWed, 08 Mar 2023 00:00:00 GMT - Sun, 07 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (2590)
Hash b0a8eae036a72f605538b002e33f7023
5916ea9eeb0b676d6f44637601c40d0dc69542d1
7b9affd37cf01ac1a4c5f4a4ccb1936f0412ff771fb24e36a55682d2bf0ac554
GET /sdk/v1/b.b.js HTTP/1.1
Host: lcdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: application/javascript
content-length: 2640
server: nginx
last-modified: Tue, 25 Jul 2023 12:28:26 GMT
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
etag: W/"64bfbfea-1f37"
content-encoding: gzip
age: 10109143
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/cti/18/f8/38/18f83825a2a74bc259a3fd10a1236848/1658915435.png
200 OK 185 kB URL GET HTTP/2 cdn.cloudimagesb.com/cti/18/f8/38/18f83825a2a74bc259a3fd10a1236848/1658915435.png
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 160 x 600, 8-bit/color RGBA, non-interlaced\012- data
Size 185 kB (185150 bytes)
Hash 69cbf6dd022575e7dcaa17248e7e4643
daf78102256bb6d153facc728e9fe73be02138e6
41110fdcc38e4d9358f19dd9440d766d798d159e2bc6dd69197321df9d1b9582
GET /cti/18/f8/38/18f83825a2a74bc259a3fd10a1236848/1658915435.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: image/png
content-length: 185150
server: nginx/1.21.6
last-modified: Wed, 27 Jul 2022 09:50:43 GMT
etag: "62e10a73-2d33e"
expires: Wed, 29 Nov 2023 21:29:15 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/bi/5e/ae/89/5eae89e4e30730a12704840c870a1f42/1676971375.jpg
115 kB URL cdn.cloudimagesb.com/bi/5e/ae/89/5eae89e4e30730a12704840c870a1f42/1676971375.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Windows), datetime=2023:02:16 20:10:33], baseline, precision 8, 160x600, components 3\012- data
Size 115 kB (115308 bytes)
Hash 8a2e6c34bb8aa1eb3cf2182077c611e4
e7ef8e9f8ae26e9618213935a37e2c4ba449672b
3275faaf58f022f3dafd4fff564a2a609e7e007921b16f36b6ae6669770eb9e3
GET /bi/5e/ae/89/5eae89e4e30730a12704840c870a1f42/1676971375.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: image/jpeg
content-length: 115308
server: nginx/1.21.6
last-modified: Tue, 21 Feb 2023 09:23:03 GMT
etag: "63f48d77-1c26c"
expires: Wed, 29 Nov 2023 21:29:16 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/bi/c2/34/f2/c234f215db9b352179236c328b5ce88b/1654690450.jpg
200 OK 20 kB URL GET HTTP/2 cdn.cloudimagesb.com/bi/c2/34/f2/c234f215db9b352179236c328b5ce88b/1654690450.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 300x250, components 3\012- data
Hash c6374228a4f6e662ac32eb3cd1b2bb1a
f7b2c7e8f976349f77d35a96a2fcb02a22a2cd0c
10e31cb67e1bf64a96f4e3cc2458b714b9581c727bb8876e9cc20cd0ef70f76f
GET /bi/c2/34/f2/c234f215db9b352179236c328b5ce88b/1654690450.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: image/jpeg
content-length: 20342
server: nginx/1.21.6
last-modified: Wed, 08 Jun 2022 12:14:18 GMT
etag: "62a0929a-4f76"
expires: Wed, 29 Nov 2023 21:29:16 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/bi/c9/30/92/c930922e74afa3140a5710ad84399bba/1671441449.jpg
80 kB URL cdn.cloudimagesb.com/bi/c9/30/92/c930922e74afa3140a5710ad84399bba/1671441449.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Windows), datetime=2022:12:01 15:39:57], baseline, precision 8, 300x250, components 3\012- data
Hash dd1ab1d017281941bde39edcd1bfd15a
ac04d1e98c6397154bd0b41cdb2ab5dc30cf97a2
0f3541e49583be6ef74439f1ae06827140471becc8710902e491dff1582750c7
GET /bi/c9/30/92/c930922e74afa3140a5710ad84399bba/1671441449.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: image/jpeg
content-length: 80019
server: nginx/1.21.6
last-modified: Mon, 19 Dec 2022 09:17:36 GMT
etag: "63a02c30-13893"
expires: Wed, 29 Nov 2023 21:29:16 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
chartersettlingtense.com/sbar.json?key=a7bf874835d806f885e035b6acb3f0eb&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
4.1 kB URL chartersettlingtense.com/sbar.json?key=a7bf874835d806f885e035b6acb3f0eb&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (5914), with no line terminators
Hash 78aa4d3a9ab20690bcac299960f53e68
6ab9fe0d3ad414365ae08f0026c05fc2594d8d83
9f94010dcfb3f0b53863152779ec92dc8ff457023065ee391508f806f23cfbf9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=a7bf874835d806f885e035b6acb3f0eb&uuid=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1 HTTP/1.1
Host: chartersettlingtense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:16 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zh.hentai-img.com
Access-Control-Allow-Origin: https://zh.hentai-img.com
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=16484303; expires=Tue, 28 Nov 2023 21:29:16 GMT; secure; SameSite=None
uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; expires=Mon, 04 Dec 2023 21:29:16 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 28 Nov 2023 21:29:16 GMT; secure; SameSite=None
uncs=1; expires=Tue, 28 Nov 2023 21:29:16 GMT; secure; SameSite=None
pdhtkv29=true; expires=Tue, 28 Nov 2023 21:29:16 GMT; secure; SameSite=None
uncs29=1; expires=Tue, 28 Nov 2023 21:29:16 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 04834064303e1df4acc36998b303f4b8
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
go.xlivrdr.com/smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707
0 B URL go.xlivrdr.com/smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707 HTTP/1.1
Host: go.xlivrdr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: __cflb=02DiuDFRFiBZBvMSLtqFVfs5Aboo4dwjq98Pu7GHiP49A
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Mon, 27 Nov 2023 21:29:16 GMT
content-length: 0
location: https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
set-cookie: _var=808614.32246_OWQzYzU1NjU=; Path=/; Expires=Wed, 27 Dec 2023 21:29:16 GMT; HttpOnly; SameSite=Strict
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd77355eca712f-OSL
alt-svc: h3=":443"; ma=86400
go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=a&output=js
200 OK 0 B URL GET HTTP/2 go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=a&output=js
IP
Requested by https://adsmediabox.com/jrt-cb.php?r=136058&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
Certificate IssuerLet's Encrypt
Subjectgo.eabids.com
FingerprintE5:44:EA:89:06:0E:AD:1B:B6:06:EB:98:BB:4A:C6:55:B7:01:14:8E
ValidityThu, 05 Oct 2023 21:00:10 GMT - Wed, 03 Jan 2024 21:00:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=a&output=js HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
x-backend-server: nl2-web-200
X-Firefox-Spdy: h2
i.jads.co/1x1.gif
200 OK 28 kB IP
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 250x250, components 3\012- data
Hash 2acfb73fd2df022a7dad5595adef5bda
939b803ea641bd427b7599f92a816262e7a5bf48
3d4610a2ab69d08e54685d0d3cfcf03ec663bacff8cc89a1e0a2904a7769e641
GET /1x1.gif HTTP/1.1
Host: i.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Cookie: surferid=af2afe4414d1dda45c083412caea41c6; juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTU7fQ%3D%3D; juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; imps32597=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:16 GMT
Connection: Keep-Alive
ETag: "1478208967"
Cache-Control: max-age=19157140
Content-Length: 27460
Content-Type: image/jpeg
Last-Modified: Thu, 03 Nov 2016 21:36:07 GMT
Accept-Ranges: bytes
X-HW: 1701120556.dop009.sk1.t,1701120556.cds259.sk1.shn,1701120556.dop009.sk1.t,1701120556.cds217.sk1.c
lcdn.tsyndicate.com/sdk/v1/b.b.js
200 OK 2.6 kB URL GET HTTP/2 lcdn.tsyndicate.com/sdk/v1/b.b.js
IP
Requested by https://tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
Certificate IssuerSectigo Limited
Subjectlcdn.tsyndicate.com
FingerprintAA:DB:E6:65:05:5A:83:46:D1:77:83:25:84:3D:B2:B5:F5:99:97:00
ValidityWed, 08 Mar 2023 00:00:00 GMT - Sun, 07 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (2590)
Hash b0a8eae036a72f605538b002e33f7023
5916ea9eeb0b676d6f44637601c40d0dc69542d1
7b9affd37cf01ac1a4c5f4a4ccb1936f0412ff771fb24e36a55682d2bf0ac554
GET /sdk/v1/b.b.js HTTP/1.1
Host: lcdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: application/javascript
content-length: 2640
server: nginx
last-modified: Tue, 25 Jul 2023 12:28:26 GMT
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
etag: W/"64bfbfea-1f37"
content-encoding: gzip
age: 10109144
accept-ranges: bytes
X-Firefox-Spdy: h2
creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
28 kB URL creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 7dc4b59430c5e6bd357fc95b52fa36d5
6b6d88a5bd83c1fea6103706ec9d5db26f3e0747
e23b82a266f7b480a9b04198808f7ecbb63f9d0109930b683fcf26aed908b493
GET /widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1 HTTP/1.1
Host: creative.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tsyndicate.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: text/html
last-modified: Thu, 23 Nov 2023 14:37:17 GMT
expires: Mon, 27 Nov 2023 21:29:12 GMT
cache-control: max-age=10
strict-transport-security: max-age=15768000
pragma: public
report-to: { "endpoints":[{ "url": "https://go.stripchat.com/report" }], "group": "default", "max_age": 1048576 }
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: HIT
age: 8
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd772eee7fb518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
i.jads.co/1x1.gif
200 OK 28 kB IP
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 250x250, components 3\012- data
Hash 2acfb73fd2df022a7dad5595adef5bda
939b803ea641bd427b7599f92a816262e7a5bf48
3d4610a2ab69d08e54685d0d3cfcf03ec663bacff8cc89a1e0a2904a7769e641
GET /1x1.gif HTTP/1.1
Host: i.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Cookie: surferid=af2afe4414d1dda45c083412caea41c6; juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTU7fQ%3D%3D; juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; imps32597=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:16 GMT
Connection: Keep-Alive
ETag: "1478208967"
Cache-Control: max-age=19157140
Content-Length: 27460
Content-Type: image/jpeg
Last-Modified: Thu, 03 Nov 2016 21:36:07 GMT
Accept-Ranges: bytes
X-HW: 1701120556.dop224.sk1.t,1701120556.cds015.sk1.shn,1701120556.cds015.sk1.c
i.jads.co/network/user500/32597-1558023252-0200684001558023252.gif
885 kB URL i.jads.co/network/user500/32597-1558023252-0200684001558023252.gif
IP
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type GIF image data, version 89a, 300 x 250\012- data
Size 885 kB (884555 bytes)
Hash 051e6d57dd92b8763bc23d3f1d6cea9f
31d60d2b93444598be4faefee9166bb7ec852bd8
a4aeb045247bb2beac927582b171e6462d14d1b1ef8ec3e7bf8bd91e2d3b522b
GET /network/user500/32597-1558023252-0200684001558023252.gif HTTP/1.1
Host: i.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Cookie: surferid=af2afe4414d1dda45c083412caea41c6; juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTU7fQ%3D%3D; juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; imps32597=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:16 GMT
Connection: Keep-Alive
ETag: "1558023252"
Cache-Control: max-age=6307140
Content-Length: 884555
Content-Type: image/gif
Last-Modified: Thu, 16 May 2019 16:14:12 GMT
Accept-Ranges: bytes
X-HW: 1701120556.dop213.sk1.t,1701120556.cds022.sk1.shn,1701120556.dop213.sk1.t,1701120556.cds222.sk1.c
i.jads.co/network/user500/32597-1558023252-0200684001558023252.gif
885 kB URL i.jads.co/network/user500/32597-1558023252-0200684001558023252.gif
IP
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type GIF image data, version 89a, 300 x 250\012- data
Size 885 kB (884555 bytes)
Hash 051e6d57dd92b8763bc23d3f1d6cea9f
31d60d2b93444598be4faefee9166bb7ec852bd8
a4aeb045247bb2beac927582b171e6462d14d1b1ef8ec3e7bf8bd91e2d3b522b
GET /network/user500/32597-1558023252-0200684001558023252.gif HTTP/1.1
Host: i.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Cookie: surferid=af2afe4414d1dda45c083412caea41c6; juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTU7fQ%3D%3D; juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; imps32597=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:16 GMT
Connection: Keep-Alive
ETag: "1558023252"
Cache-Control: max-age=6307140
Content-Length: 884555
Content-Type: image/gif
Last-Modified: Thu, 16 May 2019 16:14:12 GMT
Accept-Ranges: bytes
X-HW: 1701120556.dop009.sk1.t,1701120556.cds259.sk1.shn,1701120556.dop009.sk1.t,1701120556.cds222.sk1.c
i.jads.co/1x1.gif
200 OK 28 kB IP
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 250x250, components 3\012- data
Hash 2acfb73fd2df022a7dad5595adef5bda
939b803ea641bd427b7599f92a816262e7a5bf48
3d4610a2ab69d08e54685d0d3cfcf03ec663bacff8cc89a1e0a2904a7769e641
GET /1x1.gif HTTP/1.1
Host: i.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Cookie: surferid=af2afe4414d1dda45c083412caea41c6; juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTU7fQ%3D%3D; juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; imps32597=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:16 GMT
Connection: Keep-Alive
ETag: "1478208967"
Cache-Control: max-age=19157140
Content-Length: 27460
Content-Type: image/jpeg
Last-Modified: Thu, 03 Nov 2016 21:36:07 GMT
Accept-Ranges: bytes
X-HW: 1701120556.dop205.sk1.t,1701120556.cds253.sk1.shn,1701120556.cds253.sk1.c
r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
200 OK 1.1 kB URL GET HTTP/1.1 r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerLet's Encrypt
Subjectr.trackwilltrk.com
Fingerprint7C:C7:38:E4:D4:9A:D8:A7:4E:3B:33:43:DA:B9:1E:86:98:DA:B1:71
ValidityTue, 14 Nov 2023 07:21:50 GMT - Mon, 12 Feb 2024 07:21:49 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (386)
Hash 56b39c6650bd7e7a4aff5c9bd9b51e89
4cc63a653c55a40002f5df4baf362212d22fb077
a73d9e345c6f24347da2d71d08791c88ca3441627e5bedbff226f969e430141d
GET /s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6= HTTP/1.1
Host: r.trackwilltrk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.24.0
Date: Mon, 27 Nov 2023 21:29:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Set-Cookie: uid=CsU-0E9-pp; Path=/; Domain=trackwilltrk.com; Expires=Tue, 28 Nov 2023 21:29:16 GMT; HttpOnly
X-Request-Id: 1e7df6b8-97e7-4760-a93a-feec31bf5a2e
Content-Encoding: gzip
enoughglide.com/pixel/purst?dl=0&th=0&sc=0&rs=8284&rd=8284&fd=472&bv=23.11.v.8&tmpl=136
200 OK 0 B URL GET HTTP/1.1 enoughglide.com/pixel/purst?dl=0&th=0&sc=0&rs=8284&rd=8284&fd=472&bv=23.11.v.8&tmpl=136
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectenoughglide.com
Fingerprint9C:D5:C4:69:0A:FD:2B:44:30:58:65:5D:00:12:B4:DB:5A:F8:BB:63
ValiditySat, 25 Nov 2023 08:18:08 GMT - Fri, 23 Feb 2024 08:18:07 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=8284&rd=8284&fd=472&bv=23.11.v.8&tmpl=136 HTTP/1.1
Host: enoughglide.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:16 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
200 OK 1.1 kB URL GET HTTP/1.1 r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerLet's Encrypt
Subjectr.trackwilltrk.com
Fingerprint7C:C7:38:E4:D4:9A:D8:A7:4E:3B:33:43:DA:B9:1E:86:98:DA:B1:71
ValidityTue, 14 Nov 2023 07:21:50 GMT - Mon, 12 Feb 2024 07:21:49 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (386)
Hash 28bf4b89ec85d8e767e9df8875dc7928
5ffc498d104c61caa35cf658efb48579c1215ec8
14cb7576fb0940093b06823c6d7bdb75d505239f60d1943051f2a7880961c549
GET /s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6= HTTP/1.1
Host: r.trackwilltrk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.24.0
Date: Mon, 27 Nov 2023 21:29:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Set-Cookie: uid=f2Uz0E9zp; Path=/; Domain=trackwilltrk.com; Expires=Tue, 28 Nov 2023 21:29:16 GMT; HttpOnly
X-Request-Id: e7c4542e-342d-40e8-8c17-fb5add13a0af
Content-Encoding: gzip
r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
200 OK 1.1 kB URL GET HTTP/1.1 r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerLet's Encrypt
Subjectr.trackwilltrk.com
Fingerprint7C:C7:38:E4:D4:9A:D8:A7:4E:3B:33:43:DA:B9:1E:86:98:DA:B1:71
ValidityTue, 14 Nov 2023 07:21:50 GMT - Mon, 12 Feb 2024 07:21:49 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (386)
Hash 28bf4b89ec85d8e767e9df8875dc7928
5ffc498d104c61caa35cf658efb48579c1215ec8
14cb7576fb0940093b06823c6d7bdb75d505239f60d1943051f2a7880961c549
GET /s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6= HTTP/1.1
Host: r.trackwilltrk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.24.0
Date: Mon, 27 Nov 2023 21:29:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Set-Cookie: uid=D2Iz0Er-p; Path=/; Domain=trackwilltrk.com; Expires=Tue, 28 Nov 2023 21:29:16 GMT; HttpOnly
X-Request-Id: f7b141e6-dc4c-4934-a0ed-5063392e93e0
Content-Encoding: gzip
go.xlivrdr.com/smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707
0 B URL go.xlivrdr.com/smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /smartpop/128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344?userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&sourceId=271333&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&p1=3803312&buttonColor=%23930606&liveBadgeColor=%23ff0707 HTTP/1.1
Host: go.xlivrdr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: __cflb=02DiuDFRFiBZBvMSLtqFVfs5Aboo4dwjq98Pu7GHiP49A
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Mon, 27 Nov 2023 21:29:16 GMT
content-length: 0
location: https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
set-cookie: _var=808614.32246_OWQzYzU1NjU=; Path=/; Expires=Wed, 27 Dec 2023 21:29:16 GMT; HttpOnly; SameSite=Strict
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd7736c8b4712f-OSL
alt-svc: h3=":443"; ma=86400
chartersettlingtense.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSTYgcRRitTlYQFTGSiwdhDh4iZGerp7t3egwYjDGyGJOYH3KU6q7q2XKru5qq7unJXgwGYk4ywYvH3jebLMYQjPeAzHqRgJKOGPbgevYs5OJFZnZg9DvU96reV%2FDeq7q5Ve4TipLtXfhYb0ql2ErQpq1jV2XGdWVb5y63XNqmJ1pXZbbqn2gNp4sZvOPSoE3fbn0o4g290qEupS51W2ekEYkersxYyPx%2Bz233aNvvtN3Ax9D8f29LB5Y54IN98jokb15Y%2F%2FkhZDxBln5%2FWtiNQufHP0hLxQptMOA7V7KNTFcZ0gVMjIMk25lPQ9uGkG8OQWc7cwfQg%2B2pA0SyIc4zF1G2M5eJaHDnQGmkIDJE%2FGVUgwmEmkCyCWJ9A5I%2FIUDMce48svTuOW0qdu2AZVO2IUvP%2F4asGrL0x1Fk6YNTSg5bl7QqC6kzi2FSQw4nkP0J8nIXxaYDWe0iLr6A5L%2BQlednkaXb563SkHzvLdoL3U7P6y53%2FYQv%2B17PX%2B75SbgsXJcGYdzxve7qLCIpJ5DJBEqMwOxhlNZBKR2UiYMyd5DyvRYLegml3SRKPC%2F04zj2vDgOwlUecM8PE4oynnoYochHiNUIsbmO3FzHhrz9hNyDKX%2BEXa9h%2BRJs0RDnk88x4DUqQVBZgooRVJKgKgiqQX2HK9ux9V2ubBm5896Zd68e66K%2Fxe7ooi8yspXvkyOz%2FP758ldsiL0W60ZJ2PVDL%2BAhXU3CMBDUC6JVFkdeQkUEK2tIewjMOtiUDTn67p%2FIZUMOHR8iYruwahexfA2sfBOsGnc7FGx97IcUm9mDdZEVTC7LtN%2BOdQqua%2BTFEoprzpbaJ2%2FMlKwtdSDixyeferNCbGrkpsZn8ieCvro1vqgrsn1RV5Y8PJ8XMpWbbPrKlwpWiMP3PhLXKm342mk7%2Bva9eEpM4f3LwhZnWcZl1rfku1OSc2HOaBML8mjNXhXRhdKunypNVuZnL7x%2FZi3NjbBW6mwCJhtCvvoLsWzIqy9%2BOvvBx25egTQTmLJGWj4m84LUE8T5ddh8od9qAqMWM1HuoCrrselEi0MlG9I%2B8juUeHzy66evPPvt0Q9gUQ0r%2FnNxgbfsLfSNA1bcQJbWGJgaA1WDqRFseXhc5GYhIFLOOFLG2Y6UUbcPArZyryWChCaCdkSU9KKkyyjvJX4vYj1XdKOAuShsI8RLx%2F8FAAD%2F%2FwEAAP%2F%2F4Nz3JZ0EAAA%3D
7 B URL chartersettlingtense.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSTYgcRRitTlYQFTGSiwdhDh4iZGerp7t3egwYjDGyGJOYH3KU6q7q2XKru5qq7unJXgwGYk4ywYvH3jebLMYQjPeAzHqRgJKOGPbgevYs5OJFZnZg9DvU96reV%2FDeq7q5Ve4TipLtXfhYb0ql2ErQpq1jV2XGdWVb5y63XNqmJ1pXZbbqn2gNp4sZvOPSoE3fbn0o4g290qEupS51W2ekEYkersxYyPx%2Bz233aNvvtN3Ax9D8f29LB5Y54IN98jokb15Y%2F%2FkhZDxBln5%2FWtiNQufHP0hLxQptMOA7V7KNTFcZ0gVMjIMk25lPQ9uGkG8OQWc7cwfQg%2B2pA0SyIc4zF1G2M5eJaHDnQGmkIDJE%2FGVUgwmEmkCyCWJ9A5I%2FIUDMce48svTuOW0qdu2AZVO2IUvP%2F4asGrL0x1Fk6YNTSg5bl7QqC6kzi2FSQw4nkP0J8nIXxaYDWe0iLr6A5L%2BQlednkaXb563SkHzvLdoL3U7P6y53%2FYQv%2B17PX%2B75SbgsXJcGYdzxve7qLCIpJ5DJBEqMwOxhlNZBKR2UiYMyd5DyvRYLegml3SRKPC%2F04zj2vDgOwlUecM8PE4oynnoYochHiNUIsbmO3FzHhrz9hNyDKX%2BEXa9h%2BRJs0RDnk88x4DUqQVBZgooRVJKgKgiqQX2HK9ux9V2ubBm5896Zd68e66K%2Fxe7ooi8yspXvkyOz%2FP758ldsiL0W60ZJ2PVDL%2BAhXU3CMBDUC6JVFkdeQkUEK2tIewjMOtiUDTn67p%2FIZUMOHR8iYruwahexfA2sfBOsGnc7FGx97IcUm9mDdZEVTC7LtN%2BOdQqua%2BTFEoprzpbaJ2%2FMlKwtdSDixyeferNCbGrkpsZn8ieCvro1vqgrsn1RV5Y8PJ8XMpWbbPrKlwpWiMP3PhLXKm342mk7%2Bva9eEpM4f3LwhZnWcZl1rfku1OSc2HOaBML8mjNXhXRhdKunypNVuZnL7x%2FZi3NjbBW6mwCJhtCvvoLsWzIqy9%2BOvvBx25egTQTmLJGWj4m84LUE8T5ddh8od9qAqMWM1HuoCrrselEi0MlG9I%2B8juUeHzy66evPPvt0Q9gUQ0r%2FnNxgbfsLfSNA1bcQJbWGJgaA1WDqRFseXhc5GYhIFLOOFLG2Y6UUbcPArZyryWChCaCdkSU9KKkyyjvJX4vYj1XdKOAuShsI8RLx%2F8FAAD%2F%2FwEAAP%2F%2F4Nz3JZ0EAAA%3D
IP
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSTYgcRRitTlYQFTGSiwdhDh4iZGerp7t3egwYjDGyGJOYH3KU6q7q2XKru5qq7unJXgwGYk4ywYvH3jebLMYQjPeAzHqRgJKOGPbgevYs5OJFZnZg9DvU96reV%2FDeq7q5Ve4TipLtXfhYb0ql2ErQpq1jV2XGdWVb5y63XNqmJ1pXZbbqn2gNp4sZvOPSoE3fbn0o4g290qEupS51W2ekEYkersxYyPx%2Bz233aNvvtN3Ax9D8f29LB5Y54IN98jokb15Y%2F%2FkhZDxBln5%2FWtiNQufHP0hLxQptMOA7V7KNTFcZ0gVMjIMk25lPQ9uGkG8OQWc7cwfQg%2B2pA0SyIc4zF1G2M5eJaHDnQGmkIDJE%2FGVUgwmEmkCyCWJ9A5I%2FIUDMce48svTuOW0qdu2AZVO2IUvP%2F4asGrL0x1Fk6YNTSg5bl7QqC6kzi2FSQw4nkP0J8nIXxaYDWe0iLr6A5L%2BQlednkaXb563SkHzvLdoL3U7P6y53%2FYQv%2B17PX%2B75SbgsXJcGYdzxve7qLCIpJ5DJBEqMwOxhlNZBKR2UiYMyd5DyvRYLegml3SRKPC%2F04zj2vDgOwlUecM8PE4oynnoYochHiNUIsbmO3FzHhrz9hNyDKX%2BEXa9h%2BRJs0RDnk88x4DUqQVBZgooRVJKgKgiqQX2HK9ux9V2ubBm5896Zd68e66K%2Fxe7ooi8yspXvkyOz%2FP758ldsiL0W60ZJ2PVDL%2BAhXU3CMBDUC6JVFkdeQkUEK2tIewjMOtiUDTn67p%2FIZUMOHR8iYruwahexfA2sfBOsGnc7FGx97IcUm9mDdZEVTC7LtN%2BOdQqua%2BTFEoprzpbaJ2%2FMlKwtdSDixyeferNCbGrkpsZn8ieCvro1vqgrsn1RV5Y8PJ8XMpWbbPrKlwpWiMP3PhLXKm342mk7%2Bva9eEpM4f3LwhZnWcZl1rfku1OSc2HOaBML8mjNXhXRhdKunypNVuZnL7x%2FZi3NjbBW6mwCJhtCvvoLsWzIqy9%2BOvvBx25egTQTmLJGWj4m84LUE8T5ddh8od9qAqMWM1HuoCrrselEi0MlG9I%2B8juUeHzy66evPPvt0Q9gUQ0r%2FnNxgbfsLfSNA1bcQJbWGJgaA1WDqRFseXhc5GYhIFLOOFLG2Y6UUbcPArZyryWChCaCdkSU9KKkyyjvJX4vYj1XdKOAuShsI8RLx%2F8FAAD%2F%2FwEAAP%2F%2F4Nz3JZ0EAAA%3D HTTP/1.1
Host: chartersettlingtense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: u_pl=16484303; uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:16 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6b9ded435fa7beaa772bce9cb64169c9
Strict-Transport-Security: max-age=0; includeSubdomains
ads.eabids.com/adspace/3918383.js
207 B URL ads.eabids.com/adspace/3918383.js
IP
File type ASCII text, with no line terminators
Hash 6fe97763cc8709a508c2c50c09a516a3
ed4b5267fb3f90a085c4cdbaf584a59788f6ebb1
4483d426a5c0d255564dd32700e9860374184bd66c96f653c80ffee922081c58
GET /adspace/3918383.js HTTP/1.1
Host: ads.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: application/javascript; charset=utf-8
content-length: 207
content-encoding: gzip
expires: Mon, 03 Jul 2001 06:00:00 GMT
last-modified: Janon, 27 11 2023 21:29:16 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0,post-check=0, pre-check=0
pragma: no-cache
x-backend-server: nl2-web-201
X-Firefox-Spdy: h2
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: dEdxUPNeQd2x7nXk7wQjTm049kiBblue+idUQQ4zUyE0gMefrCpEYWmiGH2nvC08TFO/yDXCoHe2ueOkGHSa9w==
x-amz-request-id: BQ8FC22TSNZKMNPP
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.fxmnba.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5133
expires: Tue, 28 Nov 2023 01:29:16 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773908ea1c02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ads.eabids.com/banner.go?spaceid=3918383
1.3 kB URL ads.eabids.com/banner.go?spaceid=3918383
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1254), with no line terminators
Hash 4323dd3c543180e2f2a488d8c1e579b9
8870ba686dd097e6d62f78012816b0548e05017e
519272844a149d1eb080282e4927d7d4c28c91b367a57109158bd891fa559929
GET /banner.go?spaceid=3918383 HTTP/1.1
Host: ads.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: text/html; charset=utf-8
content-length: 1254
expires: Mon, 03 Jul 2001 06:00:00 GMT
last-modified: Janon, 27 11 2023 21:29:16 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0,post-check=0, pre-check=0
pragma: no-cache
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-backend-server: nl2-web-201
X-Firefox-Spdy: h2
cdn.barscreative1.com/sb/au/29/79/b6/2979b6cd81afad6251e222515b2d8311/1663145782.html
200 OK 1.3 kB URL GET HTTP/2 cdn.barscreative1.com/sb/au/29/79/b6/2979b6cd81afad6251e222515b2d8311/1663145782.html
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
Fingerprint55:06:B7:F1:EF:E9:55:FB:7C:8C:4F:5D:DB:05:C9:15:19:90:9B:2F
ValiditySat, 11 Nov 2023 03:00:51 GMT - Fri, 09 Feb 2024 03:00:50 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (340)
Hash 2c52aab9fe02bdb1d8b23725b62a7124
0395624814bad5d374cb1374502a5e7ea00fefbe
31b3f8c2a3070aee33f1e874cf09b70cb75f4a030c9571ed01b45a12034e68d7
GET /sb/au/29/79/b6/2979b6cd81afad6251e222515b2d8311/1663145782.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Wed, 14 Sep 2022 08:56:26 GMT
etag: W/"6321973a-6ef"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Mon, 27 Nov 2023 22:29:16 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
12ezo5v60.com/chicken.gif?z=1989865&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=KLhzr1LnQQ5agnmF-6Y4q-3ubDXfgaU0GH_uccIAGi9eUEannwVw2qepmBmD5Mf7VtRz5rzde1PoG5RL8K3hdxZ7wt64uyL13r-XRGScl7F_VIR8Itde730PkutcQmG7YQV1jeASdPE5Cd-LIk3Qkghkeve5dYpCtHSIKL-9QnTMlsMXDemaOIiiUU_NBdu7WSejAvrTDmH0q-lGTvP9G6P0vYaLyXEK4Bdy3_7CmOETgB3FdsaLf-mcEihKHvTEzkDMjMeX5ns1y1E7EL7okRz2TR8AMpOl2T1QXSQ7ZwgVU1I2OeXfkOLdSVGIwbFLjJR_w4kl3qXZFlk2_90URGCsSaE57Yq3UTeEQnMtQGhPXXMugrZ7zDCUU98TQra-lvfGZYO449BILpHROF0MCoeH9jOYKQ1vbUQSiOKl_jkeESlIkS_-Q5zsbm7KgJPX183HTP6-UegrjOTPMzhRPQacYGXWqOGWRKM6cOi7KaRn9azGT-_QIpx704_2LdlDW59MTVKDSVxXjFaH7EzHHAR37CW_1WPk-KVl5qfQAAP6Yi-MvHJc2tDPAuYH_-GuENvfEb-bw0PcUMXT3bZarNJsEt_Jy5ZH7bqxhTQwAikarqxTlU68IpXB05aOjv1OVzVc4V2aUv7Jr6-ELqxsJPLzC3vhI3Y7peb6MQLlLkNwTPvRz2bSqJef1hFKS93miOVXF9bb3MPsQoILOwddYbYVzR9X6yGmjO3ZGRRndG0SsFLT_5_tQuQdAzbM6GQNuw8rnEsBMZFdxYSsGMQi1mbFWlrWIfLzW_ZeIpMhySmrc1eA8Cuh_KPJoX9etU5EKpYUpT434mZldP_rx-xmpE7r9SV1R-ChkMy1KILjW_7viAIBkb8vxNVgICLOtzJ0aiPbl7CJRuQt0LutnHlp3byMsSXLOTaAvQCE3Y159o3PP9E5rFr1KpbAnbTWSe4YzcbBc7MS5trZsN8i8fUwiku44VneargVi6gusRigkAO7tBJgxZOWWGR_T912RUD4vTpxP-3weUUwe2m8yYgo7OiBYWKpX8VcX-PyrsFkn0Mi3EJrRLmpRRGc7aeW2dkhR0co3DJe4FNe-LtgwBnokS5bYa_XgcZs45n2GY4laV3Jq62LmczXriF8R0qC4Da0dksUSiYzRgaoiwDRhWlULjCF7go9dXfZArlVpFd9nISLjD4w0CJ34nFGqlueWme_hv1hrPxIP1fAbV1myKOAtwFu1a5OfHcJXJ4MYaJ4OoM0sDgjdR9dcXhx1drmdH4xjIfiuUW1D4ibMzOpwM1uC9lGUVkYgzz9a3varRMHh7cMDc98dV75aFiRx-XdHqdSptuKL_3iryc3uHux6VlB-nD97yIJlyLodUqXBnCOkLoUB5I7ifOj2ISZ_VR98qLruutz-IugSndiUmtOI0DRX-Ukz0_M4pBQenmjChezMeaG2S3BjFktpZb3-4H1wB1nwxwEihAmfIjdKjuCTAftzn4HzTO0Klut7VQ-PSkHj4KIBsEWivjvV3XVDUgdOZScrAYGZSgIW7k_fQ4X85yDjpdwmbXGu1gP8nv-blRgM9x1iUhCYanvrty1gmYR8cFVPAjoN5T9YKqdHaLb8-L79lJ8X1cFooBwTEmXCXDRoXXOLWUHsNfzPme7YUGSEIpE79m5vfTTRCgRFh1mrT05bP6OwIeNLfCTirjx65x2P7-2jJGM3ZkmwaLULUV6u8xhcRzxKo3GErJaqS0PPE8LTfKWqvi9JotZowIHxkgVfryGgjeZLZQhoUmafRVRsuZWFfEiM7KkiT53EstqnKPMPD3TFFzL9cASZyYisVWqKqTCc4rYd4t7PGWkKmx-9BBRx7Ga0m6r8RKAwqjeQWq7c0J7ThiTDl61UrnMPfLM_7tpHaHWX5NIbx7nV0g6zYTatf6Pp1V9sFTsYX8K5meKa_EwFKhtnlSZChpYWYPpJMiykPuFwGG3Fbm7bmw6D7sbrmMO0yDQ9vO9QdcVdQsYPaIfeZN1JmsLuerU9JsbEwpaLs1PQ0hG0Ifa1ul7sqDe7rQr1jbeGF2bO85P0ze_J8ZsXcLHn9CigVOUE2K_IE1WEjdbc1eAlutMXv4cqRQ-kTaGz8OxmBFnLtN7OVAFxdektydkhwn8bn3euZRR1kLYp0u6SCtBhi_4jzzYaII2nANpWLxqDQy1NvSZmzrr5m0fc4RGisvC2QrmbrURjn8rthVn0OKYVTXd6nlofk4x0JvLx2YxHyG8W7C__f0BQmnoH2WUU-TPnm0I0qEKMkP2K42LRPDs-7mZxDywXIz44pLkLoK5OMiGMFvfkIYL6uLhPEIVzaZd_XQpHPIgNsUKnV-p7-TJGDHpBsXBGBsg0LT4RmWfZ9BojaSTa5DEE_QQbiMAPXh_Yvie2F430LP8HVS2sDdcubFO9Pr10g-9eWXAEc7LqA51j24GCZhHx0A8C6ez9vp4GlEI_LKcrGYY43ro2j1GeB9Y7TzZaYWuAApvZAvIzMPj1JsypV6Whiltf8zdIvVzATthGWQRvAZBexTceMd6HJSYL5jvtGA7UfNlgJHeYWudBHwJNi7P8V2bbfvhs1xJXC0htVUrHLhrUQzDsxoDV_RSMXKuJJzsbYWhCVOgNl1wFyJJqLInCivi5IvkYXJtD_igvhOCTe7g6ogCBlqy7RXmhu42_fFX1sSVj6-oI4HtMxSkWFFpp_lvAU2RR8mzmvV3NjKwqVPya4p_uKop8hgIBy8e5vVJX81SQczsRZZzux7LnublpaLOmq5IzXhvY6JBEOKBs5oWVWLaieqCj3c5U8huSiuMnCB_o6Ja3D70mR5DllZh4vTkMQQF9VjERQzaPH6FfaH-iF2kEjbYbPKv9rLvXMrKoHbZ8cKMhJ85t7HnZRembVhoj-pfqNyYWv163LF0zcv7eVx267r0XqOfnfOP1kfOhnFbUNtFrSHVTVNUPHlpMX7Uoar9RBJDFRk819jWNwOONxEg9EqDBi97ohBsjKkevP8t--WGEZaWkxa8Q1NbAUkLWT_Pi1zYSuMv-R9NuIetSu9Xb-V7SrEJ9RDaHU4Dl8MuIVUdF0vXeu7Q3n530aSDo-3bDgpPGJN5iPm7CAF6KiWiLruKFZ6liLyMlJkgVPNFw0ftS1WH9ZOwkFHnh-y3suP8wQWcAlJoEtSLnyShIPcHDUVVTPWj0XasLgSQGa6sq-l_JGYcCwO1vuzPzT6JZEjJOjGTSU4avpZ_7sRbKi42fkVWiLMdio_Wg1f3jCD1SlG4qf5K7rpN9qzz_EKxBcvNyTQMGJL3fJQClW38_IVeU9ZL4KocnBcVVUyyH8Ro-irL28RCMn1-C_ekNQW2iEZf5rNkagP9a2jklXIJkkTpx0DH_jpfH_eYwBF0xtMFCj3YnWn_TVQYIF_YbkIsS4GuPbFZ_n_riKg5JhZHCE8otn9ydQfUvVROPCGQGPte2RMfqHRFzj0bjf-wiM7inF0ndgepSo_TUM7sek4Fkeya6murXT2VXhvZQ_9Z4RbSGgZAzfQsOdQL7FELEEB_dvtweOu_5Lw7-Q8iOCpC8gd1trla65IO0f9-cjtTF2yesoTqAZYzNLbMLGbWOW82PDK-hZUnRMXG42YLaCPKesFnVPYBGxgSE_h4j4SU67QDCuVu6Bew6ghtLjsZen3WrPNqzrN_4itYaoK0FIej5k5I7LQVO8ZzrEgl5MqZg0ag8JIprneHq-hqCSGb76jH0AvdBj8KRznXu7bCGPXxr3jUyXyzG1vBuuIDnt9Zj8ac0Jdtdye-fYpTTPPeCKo_RYvIvFXK58t_ELdVw3R09Doc7vw3haQyP8xhoyw9NOkEYXOMlyT8qVE7k0UA2o195I8thiL79Z-opxh9Uzv8cp9zfB9Ro1R3FASNZcsyhrnAWiC3cTUsrVt1PgyQ5_CdHRZjGvOIXNtG9QwtHil8F30fIkRsCiDOYfxSK6janzKC3sy0T4yvd8KMpts5fbBr384J8dSd9H4k-b9Q51wBJDIQcdDCngm8cbQgvu8V8dlU7BDadHq38FxbvEzs2zpRi-aFEAZJk3IzHgY2MMdZguorS1o1lGlhlwI80noilq2ZFbCzFZSmL5f6BlOjw7Wm_Fr9nsuzJD5fcWBfQYnq0onll4dgVPO-p5jRPBL1Mw==&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1
200 OK 43 B URL GET HTTP/2 12ezo5v60.com/chicken.gif?z=1989865&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=KLhzr1LnQQ5agnmF-6Y4q-3ubDXfgaU0GH_uccIAGi9eUEannwVw2qepmBmD5Mf7VtRz5rzde1PoG5RL8K3hdxZ7wt64uyL13r-XRGScl7F_VIR8Itde730PkutcQmG7YQV1jeASdPE5Cd-LIk3Qkghkeve5dYpCtHSIKL-9QnTMlsMXDemaOIiiUU_NBdu7WSejAvrTDmH0q-lGTvP9G6P0vYaLyXEK4Bdy3_7CmOETgB3FdsaLf-mcEihKHvTEzkDMjMeX5ns1y1E7EL7okRz2TR8AMpOl2T1QXSQ7ZwgVU1I2OeXfkOLdSVGIwbFLjJR_w4kl3qXZFlk2_90URGCsSaE57Yq3UTeEQnMtQGhPXXMugrZ7zDCUU98TQra-lvfGZYO449BILpHROF0MCoeH9jOYKQ1vbUQSiOKl_jkeESlIkS_-Q5zsbm7KgJPX183HTP6-UegrjOTPMzhRPQacYGXWqOGWRKM6cOi7KaRn9azGT-_QIpx704_2LdlDW59MTVKDSVxXjFaH7EzHHAR37CW_1WPk-KVl5qfQAAP6Yi-MvHJc2tDPAuYH_-GuENvfEb-bw0PcUMXT3bZarNJsEt_Jy5ZH7bqxhTQwAikarqxTlU68IpXB05aOjv1OVzVc4V2aUv7Jr6-ELqxsJPLzC3vhI3Y7peb6MQLlLkNwTPvRz2bSqJef1hFKS93miOVXF9bb3MPsQoILOwddYbYVzR9X6yGmjO3ZGRRndG0SsFLT_5_tQuQdAzbM6GQNuw8rnEsBMZFdxYSsGMQi1mbFWlrWIfLzW_ZeIpMhySmrc1eA8Cuh_KPJoX9etU5EKpYUpT434mZldP_rx-xmpE7r9SV1R-ChkMy1KILjW_7viAIBkb8vxNVgICLOtzJ0aiPbl7CJRuQt0LutnHlp3byMsSXLOTaAvQCE3Y159o3PP9E5rFr1KpbAnbTWSe4YzcbBc7MS5trZsN8i8fUwiku44VneargVi6gusRigkAO7tBJgxZOWWGR_T912RUD4vTpxP-3weUUwe2m8yYgo7OiBYWKpX8VcX-PyrsFkn0Mi3EJrRLmpRRGc7aeW2dkhR0co3DJe4FNe-LtgwBnokS5bYa_XgcZs45n2GY4laV3Jq62LmczXriF8R0qC4Da0dksUSiYzRgaoiwDRhWlULjCF7go9dXfZArlVpFd9nISLjD4w0CJ34nFGqlueWme_hv1hrPxIP1fAbV1myKOAtwFu1a5OfHcJXJ4MYaJ4OoM0sDgjdR9dcXhx1drmdH4xjIfiuUW1D4ibMzOpwM1uC9lGUVkYgzz9a3varRMHh7cMDc98dV75aFiRx-XdHqdSptuKL_3iryc3uHux6VlB-nD97yIJlyLodUqXBnCOkLoUB5I7ifOj2ISZ_VR98qLruutz-IugSndiUmtOI0DRX-Ukz0_M4pBQenmjChezMeaG2S3BjFktpZb3-4H1wB1nwxwEihAmfIjdKjuCTAftzn4HzTO0Klut7VQ-PSkHj4KIBsEWivjvV3XVDUgdOZScrAYGZSgIW7k_fQ4X85yDjpdwmbXGu1gP8nv-blRgM9x1iUhCYanvrty1gmYR8cFVPAjoN5T9YKqdHaLb8-L79lJ8X1cFooBwTEmXCXDRoXXOLWUHsNfzPme7YUGSEIpE79m5vfTTRCgRFh1mrT05bP6OwIeNLfCTirjx65x2P7-2jJGM3ZkmwaLULUV6u8xhcRzxKo3GErJaqS0PPE8LTfKWqvi9JotZowIHxkgVfryGgjeZLZQhoUmafRVRsuZWFfEiM7KkiT53EstqnKPMPD3TFFzL9cASZyYisVWqKqTCc4rYd4t7PGWkKmx-9BBRx7Ga0m6r8RKAwqjeQWq7c0J7ThiTDl61UrnMPfLM_7tpHaHWX5NIbx7nV0g6zYTatf6Pp1V9sFTsYX8K5meKa_EwFKhtnlSZChpYWYPpJMiykPuFwGG3Fbm7bmw6D7sbrmMO0yDQ9vO9QdcVdQsYPaIfeZN1JmsLuerU9JsbEwpaLs1PQ0hG0Ifa1ul7sqDe7rQr1jbeGF2bO85P0ze_J8ZsXcLHn9CigVOUE2K_IE1WEjdbc1eAlutMXv4cqRQ-kTaGz8OxmBFnLtN7OVAFxdektydkhwn8bn3euZRR1kLYp0u6SCtBhi_4jzzYaII2nANpWLxqDQy1NvSZmzrr5m0fc4RGisvC2QrmbrURjn8rthVn0OKYVTXd6nlofk4x0JvLx2YxHyG8W7C__f0BQmnoH2WUU-TPnm0I0qEKMkP2K42LRPDs-7mZxDywXIz44pLkLoK5OMiGMFvfkIYL6uLhPEIVzaZd_XQpHPIgNsUKnV-p7-TJGDHpBsXBGBsg0LT4RmWfZ9BojaSTa5DEE_QQbiMAPXh_Yvie2F430LP8HVS2sDdcubFO9Pr10g-9eWXAEc7LqA51j24GCZhHx0A8C6ez9vp4GlEI_LKcrGYY43ro2j1GeB9Y7TzZaYWuAApvZAvIzMPj1JsypV6Whiltf8zdIvVzATthGWQRvAZBexTceMd6HJSYL5jvtGA7UfNlgJHeYWudBHwJNi7P8V2bbfvhs1xJXC0htVUrHLhrUQzDsxoDV_RSMXKuJJzsbYWhCVOgNl1wFyJJqLInCivi5IvkYXJtD_igvhOCTe7g6ogCBlqy7RXmhu42_fFX1sSVj6-oI4HtMxSkWFFpp_lvAU2RR8mzmvV3NjKwqVPya4p_uKop8hgIBy8e5vVJX81SQczsRZZzux7LnublpaLOmq5IzXhvY6JBEOKBs5oWVWLaieqCj3c5U8huSiuMnCB_o6Ja3D70mR5DllZh4vTkMQQF9VjERQzaPH6FfaH-iF2kEjbYbPKv9rLvXMrKoHbZ8cKMhJ85t7HnZRembVhoj-pfqNyYWv163LF0zcv7eVx267r0XqOfnfOP1kfOhnFbUNtFrSHVTVNUPHlpMX7Uoar9RBJDFRk819jWNwOONxEg9EqDBi97ohBsjKkevP8t--WGEZaWkxa8Q1NbAUkLWT_Pi1zYSuMv-R9NuIetSu9Xb-V7SrEJ9RDaHU4Dl8MuIVUdF0vXeu7Q3n530aSDo-3bDgpPGJN5iPm7CAF6KiWiLruKFZ6liLyMlJkgVPNFw0ftS1WH9ZOwkFHnh-y3suP8wQWcAlJoEtSLnyShIPcHDUVVTPWj0XasLgSQGa6sq-l_JGYcCwO1vuzPzT6JZEjJOjGTSU4avpZ_7sRbKi42fkVWiLMdio_Wg1f3jCD1SlG4qf5K7rpN9qzz_EKxBcvNyTQMGJL3fJQClW38_IVeU9ZL4KocnBcVVUyyH8Ro-irL28RCMn1-C_ekNQW2iEZf5rNkagP9a2jklXIJkkTpx0DH_jpfH_eYwBF0xtMFCj3YnWn_TVQYIF_YbkIsS4GuPbFZ_n_riKg5JhZHCE8otn9ydQfUvVROPCGQGPte2RMfqHRFzj0bjf-wiM7inF0ndgepSo_TUM7sek4Fkeya6murXT2VXhvZQ_9Z4RbSGgZAzfQsOdQL7FELEEB_dvtweOu_5Lw7-Q8iOCpC8gd1trla65IO0f9-cjtTF2yesoTqAZYzNLbMLGbWOW82PDK-hZUnRMXG42YLaCPKesFnVPYBGxgSE_h4j4SU67QDCuVu6Bew6ghtLjsZen3WrPNqzrN_4itYaoK0FIej5k5I7LQVO8ZzrEgl5MqZg0ag8JIprneHq-hqCSGb76jH0AvdBj8KRznXu7bCGPXxr3jUyXyzG1vBuuIDnt9Zj8ac0Jdtdye-fYpTTPPeCKo_RYvIvFXK58t_ELdVw3R09Doc7vw3haQyP8xhoyw9NOkEYXOMlyT8qVE7k0UA2o195I8thiL79Z-opxh9Uzv8cp9zfB9Ro1R3FASNZcsyhrnAWiC3cTUsrVt1PgyQ5_CdHRZjGvOIXNtG9QwtHil8F30fIkRsCiDOYfxSK6janzKC3sy0T4yvd8KMpts5fbBr384J8dSd9H4k-b9Q51wBJDIQcdDCngm8cbQgvu8V8dlU7BDadHq38FxbvEzs2zpRi-aFEAZJk3IzHgY2MMdZguorS1o1lGlhlwI80noilq2ZFbCzFZSmL5f6BlOjw7Wm_Fr9nsuzJD5fcWBfQYnq0onll4dgVPO-p5jRPBL1Mw==&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerBuypass AS-983163327
Subject
Fingerprint70:51:DF:98:CE:0D:50:0F:B3:1F:AB:6A:98:92:B4:3C:98:3A:AC:A0
ValidityThu, 16 Nov 2023 01:40:00 GMT - Mon, 13 May 2024 21:59:00 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
GET /chicken.gif?z=1989865&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=KLhzr1LnQQ5agnmF-6Y4q-3ubDXfgaU0GH_uccIAGi9eUEannwVw2qepmBmD5Mf7VtRz5rzde1PoG5RL8K3hdxZ7wt64uyL13r-XRGScl7F_VIR8Itde730PkutcQmG7YQV1jeASdPE5Cd-LIk3Qkghkeve5dYpCtHSIKL-9QnTMlsMXDemaOIiiUU_NBdu7WSejAvrTDmH0q-lGTvP9G6P0vYaLyXEK4Bdy3_7CmOETgB3FdsaLf-mcEihKHvTEzkDMjMeX5ns1y1E7EL7okRz2TR8AMpOl2T1QXSQ7ZwgVU1I2OeXfkOLdSVGIwbFLjJR_w4kl3qXZFlk2_90URGCsSaE57Yq3UTeEQnMtQGhPXXMugrZ7zDCUU98TQra-lvfGZYO449BILpHROF0MCoeH9jOYKQ1vbUQSiOKl_jkeESlIkS_-Q5zsbm7KgJPX183HTP6-UegrjOTPMzhRPQacYGXWqOGWRKM6cOi7KaRn9azGT-_QIpx704_2LdlDW59MTVKDSVxXjFaH7EzHHAR37CW_1WPk-KVl5qfQAAP6Yi-MvHJc2tDPAuYH_-GuENvfEb-bw0PcUMXT3bZarNJsEt_Jy5ZH7bqxhTQwAikarqxTlU68IpXB05aOjv1OVzVc4V2aUv7Jr6-ELqxsJPLzC3vhI3Y7peb6MQLlLkNwTPvRz2bSqJef1hFKS93miOVXF9bb3MPsQoILOwddYbYVzR9X6yGmjO3ZGRRndG0SsFLT_5_tQuQdAzbM6GQNuw8rnEsBMZFdxYSsGMQi1mbFWlrWIfLzW_ZeIpMhySmrc1eA8Cuh_KPJoX9etU5EKpYUpT434mZldP_rx-xmpE7r9SV1R-ChkMy1KILjW_7viAIBkb8vxNVgICLOtzJ0aiPbl7CJRuQt0LutnHlp3byMsSXLOTaAvQCE3Y159o3PP9E5rFr1KpbAnbTWSe4YzcbBc7MS5trZsN8i8fUwiku44VneargVi6gusRigkAO7tBJgxZOWWGR_T912RUD4vTpxP-3weUUwe2m8yYgo7OiBYWKpX8VcX-PyrsFkn0Mi3EJrRLmpRRGc7aeW2dkhR0co3DJe4FNe-LtgwBnokS5bYa_XgcZs45n2GY4laV3Jq62LmczXriF8R0qC4Da0dksUSiYzRgaoiwDRhWlULjCF7go9dXfZArlVpFd9nISLjD4w0CJ34nFGqlueWme_hv1hrPxIP1fAbV1myKOAtwFu1a5OfHcJXJ4MYaJ4OoM0sDgjdR9dcXhx1drmdH4xjIfiuUW1D4ibMzOpwM1uC9lGUVkYgzz9a3varRMHh7cMDc98dV75aFiRx-XdHqdSptuKL_3iryc3uHux6VlB-nD97yIJlyLodUqXBnCOkLoUB5I7ifOj2ISZ_VR98qLruutz-IugSndiUmtOI0DRX-Ukz0_M4pBQenmjChezMeaG2S3BjFktpZb3-4H1wB1nwxwEihAmfIjdKjuCTAftzn4HzTO0Klut7VQ-PSkHj4KIBsEWivjvV3XVDUgdOZScrAYGZSgIW7k_fQ4X85yDjpdwmbXGu1gP8nv-blRgM9x1iUhCYanvrty1gmYR8cFVPAjoN5T9YKqdHaLb8-L79lJ8X1cFooBwTEmXCXDRoXXOLWUHsNfzPme7YUGSEIpE79m5vfTTRCgRFh1mrT05bP6OwIeNLfCTirjx65x2P7-2jJGM3ZkmwaLULUV6u8xhcRzxKo3GErJaqS0PPE8LTfKWqvi9JotZowIHxkgVfryGgjeZLZQhoUmafRVRsuZWFfEiM7KkiT53EstqnKPMPD3TFFzL9cASZyYisVWqKqTCc4rYd4t7PGWkKmx-9BBRx7Ga0m6r8RKAwqjeQWq7c0J7ThiTDl61UrnMPfLM_7tpHaHWX5NIbx7nV0g6zYTatf6Pp1V9sFTsYX8K5meKa_EwFKhtnlSZChpYWYPpJMiykPuFwGG3Fbm7bmw6D7sbrmMO0yDQ9vO9QdcVdQsYPaIfeZN1JmsLuerU9JsbEwpaLs1PQ0hG0Ifa1ul7sqDe7rQr1jbeGF2bO85P0ze_J8ZsXcLHn9CigVOUE2K_IE1WEjdbc1eAlutMXv4cqRQ-kTaGz8OxmBFnLtN7OVAFxdektydkhwn8bn3euZRR1kLYp0u6SCtBhi_4jzzYaII2nANpWLxqDQy1NvSZmzrr5m0fc4RGisvC2QrmbrURjn8rthVn0OKYVTXd6nlofk4x0JvLx2YxHyG8W7C__f0BQmnoH2WUU-TPnm0I0qEKMkP2K42LRPDs-7mZxDywXIz44pLkLoK5OMiGMFvfkIYL6uLhPEIVzaZd_XQpHPIgNsUKnV-p7-TJGDHpBsXBGBsg0LT4RmWfZ9BojaSTa5DEE_QQbiMAPXh_Yvie2F430LP8HVS2sDdcubFO9Pr10g-9eWXAEc7LqA51j24GCZhHx0A8C6ez9vp4GlEI_LKcrGYY43ro2j1GeB9Y7TzZaYWuAApvZAvIzMPj1JsypV6Whiltf8zdIvVzATthGWQRvAZBexTceMd6HJSYL5jvtGA7UfNlgJHeYWudBHwJNi7P8V2bbfvhs1xJXC0htVUrHLhrUQzDsxoDV_RSMXKuJJzsbYWhCVOgNl1wFyJJqLInCivi5IvkYXJtD_igvhOCTe7g6ogCBlqy7RXmhu42_fFX1sSVj6-oI4HtMxSkWFFpp_lvAU2RR8mzmvV3NjKwqVPya4p_uKop8hgIBy8e5vVJX81SQczsRZZzux7LnublpaLOmq5IzXhvY6JBEOKBs5oWVWLaieqCj3c5U8huSiuMnCB_o6Ja3D70mR5DllZh4vTkMQQF9VjERQzaPH6FfaH-iF2kEjbYbPKv9rLvXMrKoHbZ8cKMhJ85t7HnZRembVhoj-pfqNyYWv163LF0zcv7eVx267r0XqOfnfOP1kfOhnFbUNtFrSHVTVNUPHlpMX7Uoar9RBJDFRk819jWNwOONxEg9EqDBi97ohBsjKkevP8t--WGEZaWkxa8Q1NbAUkLWT_Pi1zYSuMv-R9NuIetSu9Xb-V7SrEJ9RDaHU4Dl8MuIVUdF0vXeu7Q3n530aSDo-3bDgpPGJN5iPm7CAF6KiWiLruKFZ6liLyMlJkgVPNFw0ftS1WH9ZOwkFHnh-y3suP8wQWcAlJoEtSLnyShIPcHDUVVTPWj0XasLgSQGa6sq-l_JGYcCwO1vuzPzT6JZEjJOjGTSU4avpZ_7sRbKi42fkVWiLMdio_Wg1f3jCD1SlG4qf5K7rpN9qzz_EKxBcvNyTQMGJL3fJQClW38_IVeU9ZL4KocnBcVVUyyH8Ro-irL28RCMn1-C_ekNQW2iEZf5rNkagP9a2jklXIJkkTpx0DH_jpfH_eYwBF0xtMFCj3YnWn_TVQYIF_YbkIsS4GuPbFZ_n_riKg5JhZHCE8otn9ydQfUvVROPCGQGPte2RMfqHRFzj0bjf-wiM7inF0ndgepSo_TUM7sek4Fkeya6murXT2VXhvZQ_9Z4RbSGgZAzfQsOdQL7FELEEB_dvtweOu_5Lw7-Q8iOCpC8gd1trla65IO0f9-cjtTF2yesoTqAZYzNLbMLGbWOW82PDK-hZUnRMXG42YLaCPKesFnVPYBGxgSE_h4j4SU67QDCuVu6Bew6ghtLjsZen3WrPNqzrN_4itYaoK0FIej5k5I7LQVO8ZzrEgl5MqZg0ag8JIprneHq-hqCSGb76jH0AvdBj8KRznXu7bCGPXxr3jUyXyzG1vBuuIDnt9Zj8ac0Jdtdye-fYpTTPPeCKo_RYvIvFXK58t_ELdVw3R09Doc7vw3haQyP8xhoyw9NOkEYXOMlyT8qVE7k0UA2o195I8thiL79Z-opxh9Uzv8cp9zfB9Ro1R3FASNZcsyhrnAWiC3cTUsrVt1PgyQ5_CdHRZjGvOIXNtG9QwtHil8F30fIkRsCiDOYfxSK6janzKC3sy0T4yvd8KMpts5fbBr384J8dSd9H4k-b9Q51wBJDIQcdDCngm8cbQgvu8V8dlU7BDadHq38FxbvEzs2zpRi-aFEAZJk3IzHgY2MMdZguorS1o1lGlhlwI80noilq2ZFbCzFZSmL5f6BlOjw7Wm_Fr9nsuzJD5fcWBfQYnq0onll4dgVPO-p5jRPBL1Mw==&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1 HTTP/1.1
Host: 12ezo5v60.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: CHCK=1; UID=231127162931b77092262f4cc2b606ff51a8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
set-cookie: OACICAP=ACl2VwAAAAAAAAAB; Path=/; Expires=Wed, 27 Dec 2023 21:29:17 GMT; Secure; SameSite=None
OACIBLOCK=ACl2VwAAAABlZCJQ; Path=/; Expires=Wed, 27 Dec 2023 21:29:17 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
adsmediabox.com/tr.php?utm_source=cb&utm_campaign=jrt&utm_medium=frm
369 B URL adsmediabox.com/tr.php?utm_source=cb&utm_campaign=jrt&utm_medium=frm
IP
ASN #43350 NForce Entertainment B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 6a92e92c3bd569e0f9e621917b0940a8
4c620f8687d4587c704741c7f565125f24c4d2b1
92c33eea80c75b8e6881e2ffcc14358919b8f42927b5c03c26309b8705fff038
GET /tr.php?utm_source=cb&utm_campaign=jrt&utm_medium=frm HTTP/1.1
Host: adsmediabox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/jrt-cb.php?r=136058&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Mon, 27 Nov 2023 21:29:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
pxl.tsyndicate.com/api/v1/p/p.js?p=APeIQFMmDJkycuaI0BGjBgsRYcbQWRjjIZ0zC0XQwFEGxwwZNMa0mLFRJA0xNGa04FhDRosbNmTIGDOmYw0xMcKIeDhHTBoyCnVsEREDh40ZMGTYaAESxo0cG0e6RNoCRos7adyQeXNnztWsW7uuiGHVzRsRXR6GqTMmo5kaY3LeIGPmZRkaYVrQkEGGxsobNayOsWHmxg0zR8U8nbETIhk7FHHQyIHjIZw6YhbO8FgZIhw4mmVUFDEHzkQdm2HMmBFDxsMxbUDrkHEjxuoZaulSfCjGjRuKUG0Idy2ijRuMDD_KgGHZOPIYOVTbeFgnRkY0dOjAmaPjxYszb1zgYZPGjhwyclyMedPmxZw2YeRofwPnRWscSXPcMGpGTBkyORDWEX6rwSCGGDB4VAZNd8VQRmsyiBFGgmXQFgN0CYoxBlQ5zFCGGTPY4BENNPxQxxwIJUFGD__RUAZJky0nQxgkhmFGGDjY1pBTYeRARmthxLBhTB8VZQMMd4lhBk0zBinGakHigIN-YhxZBhd1wJCUDXO8UYccNanYg4W3YamlUm2U0YZ_cogpRgtK5CBDGXTM8EUdT1zB3hUbNmFEFS0QEYUQaDTxxRNQPDGEDUXkoUYedEAhBhRqZKFHGmmsIUYRaOCxBKZrGEHHFGi0gYMbRcBRxBV0UJGFFle0QIcUTyhxFxk4oLFGDFFkIYYVeRhBxhFjLPlFGHBYYQQeacSRwxsyYKGGFEvMMEYVX5xRRRJESFFFGmZuCUcMPaS2WmvhKiVGHdm94cYQb7Dxhhw9lCDDDB3CcKQN6dpAnh1lCGHQGWXAKy-99s5ghhlOOdXYVm1kpAcaLhDkBh1hpNFCGm2coR57jY0RxmlbsJaWCEouBIMLWjokghx2yKYUdXWkkdFHU4rRUgwt5AQDzzTsVxcOSuVlxpQ3aJhhRDg0loZsIuQQgwvRubCXCw3R0JgcXzydkdRUr3x11o3VoZMOIjTxxqVssBHGCzWwDAIKV4DF1RwgOEEFCGSxvAMIdbthAw1_4zH43zAzBEPcMKQAwhELrvHGC8uR9fPPIBiRhhwfvoGHfYuzHHJbaDvxRGPzfkFTRqY3xgbpIhThxMNl2PEF52xQVINhHomo5UNynPHbbDXgcMNDB9kuhhwLSYl87V-08QYZC8lg1GjonYXaQ28ERYNlcniex0Iuc27Gddlt190LE1dcxsUZb9zxx-01dkdG98HQGBr4J6U1TzDLSPgwRod5taAObkgDHaqSAxeQIS4yQN0cAjgbDsGABkexHvJgd5AvPLA1jaFDxBhyg5-1ZnE1-J4IRBhBEppwOTVI4eKIY5DblaE0xzpNDEp4IRim8CHQCwMbEEKHoJSMBicLgxhOI4KD3KgObJiIZV6nstcgBwZ9UEBAAA%3D%3D&s=0eed627e5dd44209dc0c588a9d0437f276eb9f99fec4ec56e5d7600ecaeb7ec61701120554&w=t&r=1&d=2263&priv=true
200 OK 24 B URL GET HTTP/2 pxl.tsyndicate.com/api/v1/p/p.js?p=APeIQFMmDJkycuaI0BGjBgsRYcbQWRjjIZ0zC0XQwFEGxwwZNMa0mLFRJA0xNGa04FhDRosbNmTIGDOmYw0xMcKIeDhHTBoyCnVsEREDh40ZMGTYaAESxo0cG0e6RNoCRos7adyQeXNnztWsW7uuiGHVzRsRXR6GqTMmo5kaY3LeIGPmZRkaYVrQkEGGxsobNayOsWHmxg0zR8U8nbETIhk7FHHQyIHjIZw6YhbO8FgZIhw4mmVUFDEHzkQdm2HMmBFDxsMxbUDrkHEjxuoZaulSfCjGjRuKUG0Idy2ijRuMDD_KgGHZOPIYOVTbeFgnRkY0dOjAmaPjxYszb1zgYZPGjhwyclyMedPmxZw2YeRofwPnRWscSXPcMGpGTBkyORDWEX6rwSCGGDB4VAZNd8VQRmsyiBFGgmXQFgN0CYoxBlQ5zFCGGTPY4BENNPxQxxwIJUFGD__RUAZJky0nQxgkhmFGGDjY1pBTYeRARmthxLBhTB8VZQMMd4lhBk0zBinGakHigIN-YhxZBhd1wJCUDXO8UYccNanYg4W3YamlUm2U0YZ_cogpRgtK5CBDGXTM8EUdT1zB3hUbNmFEFS0QEYUQaDTxxRNQPDGEDUXkoUYedEAhBhRqZKFHGmmsIUYRaOCxBKZrGEHHFGi0gYMbRcBRxBV0UJGFFle0QIcUTyhxFxk4oLFGDFFkIYYVeRhBxhFjLPlFGHBYYQQeacSRwxsyYKGGFEvMMEYVX5xRRRJESFFFGmZuCUcMPaS2WmvhKiVGHdm94cYQb7Dxhhw9lCDDDB3CcKQN6dpAnh1lCGHQGWXAKy-99s5ghhlOOdXYVm1kpAcaLhDkBh1hpNFCGm2coR57jY0RxmlbsJaWCEouBIMLWjokghx2yKYUdXWkkdFHU4rRUgwt5AQDzzTsVxcOSuVlxpQ3aJhhRDg0loZsIuQQgwvRubCXCw3R0JgcXzydkdRUr3x11o3VoZMOIjTxxqVssBHGCzWwDAIKV4DF1RwgOEEFCGSxvAMIdbthAw1_4zH43zAzBEPcMKQAwhELrvHGC8uR9fPPIBiRhhwfvoGHfYuzHHJbaDvxRGPzfkFTRqY3xgbpIhThxMNl2PEF52xQVINhHomo5UNynPHbbDXgcMNDB9kuhhwLSYl87V-08QYZC8lg1GjonYXaQ28ERYNlcniex0Iuc27Gddlt190LE1dcxsUZb9zxx-01dkdG98HQGBr4J6U1TzDLSPgwRod5taAObkgDHaqSAxeQIS4yQN0cAjgbDsGABkexHvJgd5AvPLA1jaFDxBhyg5-1ZnE1-J4IRBhBEppwOTVI4eKIY5DblaE0xzpNDEp4IRim8CHQCwMbEEKHoJSMBicLgxhOI4KD3KgObJiIZV6nstcgBwZ9UEBAAA%3D%3D&s=0eed627e5dd44209dc0c588a9d0437f276eb9f99fec4ec56e5d7600ecaeb7ec61701120554&w=t&r=1&d=2263&priv=true
IP
ASN #24940 Hetzner Online GmbH
Requested by https://tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
Fingerprint20:10:1C:0B:2E:9E:D5:EC:27:D0:14:82:27:FD:B5:EA:CA:D2:11:6E
ValidityThu, 12 Oct 2023 09:07:20 GMT - Wed, 10 Jan 2024 09:07:19 GMT
File type ASCII text, with no line terminators
Hash 0959ba36d476b6dc1994ba3c678b07c4
d30b94da72daa02766965206a85b7e0356375f5e
897410b87e27e3dfba3a7d6caab315a5e69cc941bb96d91fc74878a9b051843a
GET /api/v1/p/p.js?p=APeIQFMmDJkycuaI0BGjBgsRYcbQWRjjIZ0zC0XQwFEGxwwZNMa0mLFRJA0xNGa04FhDRosbNmTIGDOmYw0xMcKIeDhHTBoyCnVsEREDh40ZMGTYaAESxo0cG0e6RNoCRos7adyQeXNnztWsW7uuiGHVzRsRXR6GqTMmo5kaY3LeIGPmZRkaYVrQkEGGxsobNayOsWHmxg0zR8U8nbETIhk7FHHQyIHjIZw6YhbO8FgZIhw4mmVUFDEHzkQdm2HMmBFDxsMxbUDrkHEjxuoZaulSfCjGjRuKUG0Idy2ijRuMDD_KgGHZOPIYOVTbeFgnRkY0dOjAmaPjxYszb1zgYZPGjhwyclyMedPmxZw2YeRofwPnRWscSXPcMGpGTBkyORDWEX6rwSCGGDB4VAZNd8VQRmsyiBFGgmXQFgN0CYoxBlQ5zFCGGTPY4BENNPxQxxwIJUFGD__RUAZJky0nQxgkhmFGGDjY1pBTYeRARmthxLBhTB8VZQMMd4lhBk0zBinGakHigIN-YhxZBhd1wJCUDXO8UYccNanYg4W3YamlUm2U0YZ_cogpRgtK5CBDGXTM8EUdT1zB3hUbNmFEFS0QEYUQaDTxxRNQPDGEDUXkoUYedEAhBhRqZKFHGmmsIUYRaOCxBKZrGEHHFGi0gYMbRcBRxBV0UJGFFle0QIcUTyhxFxk4oLFGDFFkIYYVeRhBxhFjLPlFGHBYYQQeacSRwxsyYKGGFEvMMEYVX5xRRRJESFFFGmZuCUcMPaS2WmvhKiVGHdm94cYQb7Dxhhw9lCDDDB3CcKQN6dpAnh1lCGHQGWXAKy-99s5ghhlOOdXYVm1kpAcaLhDkBh1hpNFCGm2coR57jY0RxmlbsJaWCEouBIMLWjokghx2yKYUdXWkkdFHU4rRUgwt5AQDzzTsVxcOSuVlxpQ3aJhhRDg0loZsIuQQgwvRubCXCw3R0JgcXzydkdRUr3x11o3VoZMOIjTxxqVssBHGCzWwDAIKV4DF1RwgOEEFCGSxvAMIdbthAw1_4zH43zAzBEPcMKQAwhELrvHGC8uR9fPPIBiRhhwfvoGHfYuzHHJbaDvxRGPzfkFTRqY3xgbpIhThxMNl2PEF52xQVINhHomo5UNynPHbbDXgcMNDB9kuhhwLSYl87V-08QYZC8lg1GjonYXaQ28ERYNlcniex0Iuc27Gddlt190LE1dcxsUZb9zxx-01dkdG98HQGBr4J6U1TzDLSPgwRod5taAObkgDHaqSAxeQIS4yQN0cAjgbDsGABkexHvJgd5AvPLA1jaFDxBhyg5-1ZnE1-J4IRBhBEppwOTVI4eKIY5DblaE0xzpNDEp4IRim8CHQCwMbEEKHoJSMBicLgxhOI4KD3KgObJiIZV6nstcgBwZ9UEBAAA%3D%3D&s=0eed627e5dd44209dc0c588a9d0437f276eb9f99fec4ec56e5d7600ecaeb7ec61701120554&w=t&r=1&d=2263&priv=true HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: text/plain; charset=utf-8
content-length: 24
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-1PLLYQLZ1L&cid=352905256.1701120557>m=45je3b81v874625503z8831581666&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=9244708
42 B URL www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-1PLLYQLZ1L&cid=352905256.1701120557>m=45je3b81v874625503z8831581666&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=9244708
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-1PLLYQLZ1L&cid=352905256.1701120557>m=45je3b81v874625503z8831581666&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=9244708 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 21:29:17 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/img/close.png
200 OK 6.0 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/img/close.png
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 522 x 391, 8-bit/color RGBA, non-interlaced\012- data
Hash c489ce2c491a22ee37a55e26a92dfd73
2fa588ab09e94dd902e5bd24b48f98ad1949c9d6
1eed147c7d5de6291c25fbc5274830c12d5549262fb144271576d4e15966e5bd
GET /sb/ssp/notifications/text_bubble/2/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: image/png
content-length: 5982
last-modified: Tue, 12 Jul 2022 10:56:24 GMT
etag: "62cd5358-175e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1277119
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WbevXGjmlSMjr7huLhbQsEidQw8WZJxzpyhfAVXIKsy7ZpkDGcGxwYre0Y5hcgQ5R1zukQsFYZmp%2F2XrvLlM%2FIEghm5ff70dLpPlnq9bwvnVo%2BxyuRVfgahwas6onOZXPk3RYY9dOD%2Bt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773c2e9db951-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/4e/b1/f1/4eb1f1de42ba3375f4b2997b1a0c5a67/1693985457.png
90 kB URL cdn.cloudimagesb.com/si/4e/b1/f1/4eb1f1de42ba3375f4b2997b1a0c5a67/1693985457.png
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash 244738db49895149a5f33cac7c149c14
1522953f8cdeff71c2db69c961c1eea7d81a5b71
0ad9265695a93c9e08be0b194486020d0fcaeb38bcefb27acd5a84c66af95356
GET /si/4e/b1/f1/4eb1f1de42ba3375f4b2997b1a0c5a67/1693985457.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: image/png
content-length: 90219
server: nginx/1.21.6
last-modified: Wed, 06 Sep 2023 07:31:07 GMT
etag: "64f82abb-1606b"
expires: Wed, 29 Nov 2023 21:29:17 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/img/arrow.png
200 OK 2.3 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/img/arrow.png
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 52 x 81, 8-bit/color RGBA, non-interlaced\012- data
Hash 41109abf05740798aa2e66a3e938c8de
706e93332bf4819e9f4059765340cf97981bd1fe
2fbf669490df5b04badb9886ca664dbd9a0d66e0ecdc951b822feb6089fac0ea
GET /sb/ssp/notifications/text_bubble/2/img/arrow.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: image/png
content-length: 2332
last-modified: Tue, 12 Jul 2022 10:56:23 GMT
etag: "62cd5357-91c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1262400
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WBUDXmsYetLuRor2WXDkr%2FRxyI4i5pSpTU%2B6e45fxAqUWEwKF%2FGJjkbkZ1nx6zwlbYNPEb%2B42p9BhN%2BMPyRAlyr0sEJPspWacOWL3OV9Fiz9zCu6%2Fc2na7lGaPNqUhBy1F5FQS%2FCak2o"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773c2ea1b951-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/img/number.png
200 OK 1.1 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/img/number.png
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 43 x 43, 8-bit/color RGBA, non-interlaced\012- data
Hash 9e4414e85c588bf7db195e49c02ab2bb
09254e79b255f1b2dfe45adbbe44583a4b433782
0b977ec6e7cf5d35df03cd3a8041f5f523f5d4059ac67c152c0a7b613e20b762
GET /sb/ssp/notifications/text_bubble/2/img/number.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: image/png
content-length: 1138
last-modified: Tue, 12 Jul 2022 10:56:23 GMT
etag: "62cd5357-472"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1715274
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JBTVBf3cle9LzhHFX9eu9%2BgM8drPVHssZ0j9YE%2Ffy58%2F%2FEvzNB72GI%2BQwpe%2FtXaWIsoZEf%2FPirP6s30A97fcHcBHa9CIyx7N14sSWoQpUrnJtCvPKf3DkkZqWblWnjG6CDdAq1Es6ARw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773c3eadb951-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=c&output=js
0 B URL go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=c&output=js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=c&output=js HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
x-backend-server: nl2-web-200
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=UA-127632159-2
69 kB URL www.googletagmanager.com/gtag/js?id=UA-127632159-2
IP
File type ASCII text, with very long lines (4179)
Hash b549b258145f7984721a0b5ab2b065ad
bd5ca6137a5e6154858974b7a3bd1401240b7b10
0d8fc9bd8a9b9f04a09ca2966ed169c969a9527d7901afe4912244f19f0bcc76
GET /gtag/js?id=UA-127632159-2 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:17 GMT
expires: Mon, 27 Nov 2023 21:29:17 GMT
cache-control: private, max-age=900
last-modified: Mon, 27 Nov 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 68666
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
zh.hentai-img.com/favicon.ico
200 OK 43 B URL GET HTTP/3 zh.hentai-img.com/favicon.ico
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /favicon.ico HTTP/1.1
Host: zh.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Cookie: adsense=pc-ca-ipp%3D1701120546; pvcla=1; bnState_1863026={"impressions":3,"delayStarted":0}; _ga_1PLLYQLZ1L=GS1.1.1701120557.1.0.1701120557.60.0.0; _ga=GA1.1.352905256.1701120557; dom3ic8zudi28v8lr6fgphwffqoz0j6c=09812937-74fd-4394-94f8-e11058c24376%3A3%3A1; pnState_1989865={"impressions":1,"delayStarted":1701120558594,"page":"/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/"}; m5a4xojbcp2nx3gptmm633qal3gzmadn=revisionplatoonhusband.com; pp_main_055652d312c99a6037d12337a6a1a7a4=1; sb_main_a7bf874835d806f885e035b6acb3f0eb=1; sb_count_a7bf874835d806f885e035b6acb3f0eb=1; pp_main_65aa283021630dfd9030555c4c61a78c=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=chartersettlingtense.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: image/gif
content-length: 43
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 392
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2FlrQZI4%2Btedp6N5LSR5f2U9%2FdqfpEhbNhHbSoCsRwCqLyWVIqA3fTGKzuzc0WEk5BTchyrh88hL%2FUfqVvBYHfGef%2BqyY3TuzWlcSXQYNdidiwvAgHWPdCWR%2BjmoorYzGjsGrg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773f5f8b63cf-LHR
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=UA-180549006-1
69 kB URL www.googletagmanager.com/gtag/js?id=UA-180549006-1
IP
File type ASCII text, with very long lines (4179)
Hash aeaa9bcff1489388eb22d5004d937b08
fcc4bb8b8aac9367c777599ec512f12d835f8e89
ce5023b69dfa75f85b2233ea17267093e78bb9c55b0cde196f7b500633f55eb9
GET /gtag/js?id=UA-180549006-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:17 GMT
expires: Mon, 27 Nov 2023 21:29:17 GMT
cache-control: private, max-age=900
last-modified: Mon, 27 Nov 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 68715
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: dEdxUPNeQd2x7nXk7wQjTm049kiBblue+idUQQ4zUyE0gMefrCpEYWmiGH2nvC08TFO/yDXCoHe2ueOkGHSa9w==
x-amz-request-id: BQ8FC22TSNZKMNPP
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.fxmnba.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5135
expires: Tue, 28 Nov 2023 01:29:18 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773fbf1f1c02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
pxl.tsyndicate.com/api/v1/p/p.js?p=APeIQFMmDJkycuaI0DEjBgsRYcbQWehQBJ0zC0XEiEFmzJgcOWa0KPPxRgsaZmKYDJkDxkgzYTjO8EjmBkoRD-eISUNGoY4tGnHYmAFDho0WMmjAuJGDBo4WM2RAdenyTho3ZN7cmdPCKlatc1bEcOnmjYguD8PUGZPxhpmoHseYaVFTjFSUYVyKqWEjR4saMMLQUGomqUEzOCGSsUMRB40cOB7CqSNm4Qwcl9PCgWNZRsU5cCYyxAFjRkMZD8e04axDxo0YpmekJYNYR0UxbtxQbGqjN2oRbdxgtB1VBgzJwYfHaDnDxsM6MTKioUMHzhwdL16ceeMCD5s0duSQkeNizJs2L-a0CSOn-hs4L2LIIC0jxw2hZsSUIZPDhpkyOJBmGgxiiAEDZiSNUQYNMZQhnwxi5IVDGa5t1BIOYnz02AxlvGUDZoP9UMccCCVBRg_70VDGDIPlYJwMgtEQBkw4wBYDYDeEkQMZ8sX0kQ0yRBWDUDAsKIYZHsEYkximxRSgfWLYUCQXdcBQlA1zvFGHHAqa2EOFsVFppVFtlNGGfnJ4KUYMVSDBxBVRzOEEHjnEEUV_Najh1xxWPMFGFHrUUIQaazxhBRWb2eHGinSgkYMca1IBBQxpvGEDHmq9IYMbdZRhxQ10sDEEFjSgoYcQQ6BRBR5SuKgFFE3IUQMTLeQRwxlkZJEFHknMcUYTSVyBhxVXBJFHGETAsMYdUwwBxRVWVPHFGVUkQYQUVaQh5pVwxNDDZaWdtq1RYtRB3RtuDPEGG2_I0UMJQYYEg5Q2jGvDd3aUIYRBZ5ShLrvuwjuDGWYstVRiWbWRkR5ouECQG3SEkUYLabRxRnnnJTZGGKJt0RBaIhy5EAwuWFnDQ3LYwZpRz9WRRkZR4ZDDXp61EENeMZx031w4GBVGC2bIfEOGB0Y4Bg6JpcGaCDnE4EJLLtAggws30pCYHF8onVHTT5MsNdU1WP1cGBk18YYeabDBRhgv1FAyCChccVVWW4HgBBUgjFXyDiDI7YYNNPCNB-B8p2wbDG7DkAIIR5C0xhsvGDcWDGPFAIIRacjR4Rt4xId4yRqzpYMITjyRWLtfeJRR6YmxIboIRTiBcBl2fKE5GxTVcMN9zZF2nAhynKFbazXgcMNDB9UuhhwLBYg87V-08QYZC81nQ0XjmcXQQ2_4RINkcnCex0InA9-hdNRZh90LDDtcBsQSU2wxxugldkdG8pGWGBr4FyW2CHNIWUbCFzE6tKsFdXBDGugAlRy4oCPyOV0AGdMaG9TgMvdpSg6Q97qDfAGCMkgMHRRmmxtQTj6IC9tDRhjCEp7QODUIG0g2qBjblQE0X-AYRUy4ERiqUATQCwMbEEIHn3iMBiALgxhEI4KDwKQObJiIZFw3stQMBwZ9UEBAAA%3D%3D&s=99ef84e942787a8ec43bdc425965d661b5d7964cc5c8e6348a75c8bba7b9b77d1701120554&w=t&r=1&d=1336&priv=true
24 B URL pxl.tsyndicate.com/api/v1/p/p.js?p=APeIQFMmDJkycuaI0DEjBgsRYcbQWehQBJ0zC0XEiEFmzJgcOWa0KPPxRgsaZmKYDJkDxkgzYTjO8EjmBkoRD-eISUNGoY4tGnHYmAFDho0WMmjAuJGDBo4WM2RAdenyTho3ZN7cmdPCKlatc1bEcOnmjYguD8PUGZPxhpmoHseYaVFTjFSUYVyKqWEjR4saMMLQUGomqUEzOCGSsUMRB40cOB7CqSNm4Qwcl9PCgWNZRsU5cCYyxAFjRkMZD8e04axDxo0YpmekJYNYR0UxbtxQbGqjN2oRbdxgtB1VBgzJwYfHaDnDxsM6MTKioUMHzhwdL16ceeMCD5s0duSQkeNizJs2L-a0CSOn-hs4L2LIIC0jxw2hZsSUIZPDhpkyOJBmGgxiiAEDZiSNUQYNMZQhnwxi5IVDGa5t1BIOYnz02AxlvGUDZoP9UMccCCVBRg_70VDGDIPlYJwMgtEQBkw4wBYDYDeEkQMZ8sX0kQ0yRBWDUDAsKIYZHsEYkximxRSgfWLYUCQXdcBQlA1zvFGHHAqa2EOFsVFppVFtlNGGfnJ4KUYMVSDBxBVRzOEEHjnEEUV_Najh1xxWPMFGFHrUUIQaazxhBRWb2eHGinSgkYMca1IBBQxpvGEDHmq9IYMbdZRhxQ10sDEEFjSgoYcQQ6BRBR5SuKgFFE3IUQMTLeQRwxlkZJEFHknMcUYTSVyBhxVXBJFHGETAsMYdUwwBxRVWVPHFGVUkQYQUVaQh5pVwxNDDZaWdtq1RYtRB3RtuDPEGG2_I0UMJQYYEg5Q2jGvDd3aUIYRBZ5ShLrvuwjuDGWYstVRiWbWRkR5ouECQG3SEkUYLabRxRnnnJTZGGKJt0RBaIhy5EAwuWFnDQ3LYwZpRz9WRRkZR4ZDDXp61EENeMZx031w4GBVGC2bIfEOGB0Y4Bg6JpcGaCDnE4EJLLtAggws30pCYHF8onVHTT5MsNdU1WP1cGBk18YYeabDBRhgv1FAyCChccVVWW4HgBBUgjFXyDiDI7YYNNPCNB-B8p2wbDG7DkAIIR5C0xhsvGDcWDGPFAIIRacjR4Rt4xId4yRqzpYMITjyRWLtfeJRR6YmxIboIRTiBcBl2fKE5GxTVcMN9zZF2nAhynKFbazXgcMNDB9UuhhwLBYg87V-08QYZC81nQ0XjmcXQQ2_4RINkcnCex0InA9-hdNRZh90LDDtcBsQSU2wxxugldkdG8pGWGBr4FyW2CHNIWUbCFzE6tKsFdXBDGugAlRy4oCPyOV0AGdMaG9TgMvdpSg6Q97qDfAGCMkgMHRRmmxtQTj6IC9tDRhjCEp7QODUIG0g2qBjblQE0X-AYRUy4ERiqUATQCwMbEEIHn3iMBiALgxhEI4KDwKQObJiIZFw3stQMBwZ9UEBAAA%3D%3D&s=99ef84e942787a8ec43bdc425965d661b5d7964cc5c8e6348a75c8bba7b9b77d1701120554&w=t&r=1&d=1336&priv=true
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
Fingerprint20:10:1C:0B:2E:9E:D5:EC:27:D0:14:82:27:FD:B5:EA:CA:D2:11:6E
ValidityThu, 12 Oct 2023 09:07:20 GMT - Wed, 10 Jan 2024 09:07:19 GMT
File type ASCII text, with no line terminators
Hash 0959ba36d476b6dc1994ba3c678b07c4
d30b94da72daa02766965206a85b7e0356375f5e
897410b87e27e3dfba3a7d6caab315a5e69cc941bb96d91fc74878a9b051843a
GET /api/v1/p/p.js?p=APeIQFMmDJkycuaI0DEjBgsRYcbQWehQBJ0zC0XEiEFmzJgcOWa0KPPxRgsaZmKYDJkDxkgzYTjO8EjmBkoRD-eISUNGoY4tGnHYmAFDho0WMmjAuJGDBo4WM2RAdenyTho3ZN7cmdPCKlatc1bEcOnmjYguD8PUGZPxhpmoHseYaVFTjFSUYVyKqWEjR4saMMLQUGomqUEzOCGSsUMRB40cOB7CqSNm4Qwcl9PCgWNZRsU5cCYyxAFjRkMZD8e04axDxo0YpmekJYNYR0UxbtxQbGqjN2oRbdxgtB1VBgzJwYfHaDnDxsM6MTKioUMHzhwdL16ceeMCD5s0duSQkeNizJs2L-a0CSOn-hs4L2LIIC0jxw2hZsSUIZPDhpkyOJBmGgxiiAEDZiSNUQYNMZQhnwxi5IVDGa5t1BIOYnz02AxlvGUDZoP9UMccCCVBRg_70VDGDIPlYJwMgtEQBkw4wBYDYDeEkQMZ8sX0kQ0yRBWDUDAsKIYZHsEYkximxRSgfWLYUCQXdcBQlA1zvFGHHAqa2EOFsVFppVFtlNGGfnJ4KUYMVSDBxBVRzOEEHjnEEUV_Najh1xxWPMFGFHrUUIQaazxhBRWb2eHGinSgkYMca1IBBQxpvGEDHmq9IYMbdZRhxQ10sDEEFjSgoYcQQ6BRBR5SuKgFFE3IUQMTLeQRwxlkZJEFHknMcUYTSVyBhxVXBJFHGETAsMYdUwwBxRVWVPHFGVUkQYQUVaQh5pVwxNDDZaWdtq1RYtRB3RtuDPEGG2_I0UMJQYYEg5Q2jGvDd3aUIYRBZ5ShLrvuwjuDGWYstVRiWbWRkR5ouECQG3SEkUYLabRxRnnnJTZGGKJt0RBaIhy5EAwuWFnDQ3LYwZpRz9WRRkZR4ZDDXp61EENeMZx031w4GBVGC2bIfEOGB0Y4Bg6JpcGaCDnE4EJLLtAggws30pCYHF8onVHTT5MsNdU1WP1cGBk18YYeabDBRhgv1FAyCChccVVWW4HgBBUgjFXyDiDI7YYNNPCNB-B8p2wbDG7DkAIIR5C0xhsvGDcWDGPFAIIRacjR4Rt4xId4yRqzpYMITjyRWLtfeJRR6YmxIboIRTiBcBl2fKE5GxTVcMN9zZF2nAhynKFbazXgcMNDB9UuhhwLBYg87V-08QYZC81nQ0XjmcXQQ2_4RINkcnCex0InA9-hdNRZh90LDDtcBsQSU2wxxugldkdG8pGWGBr4FyW2CHNIWUbCFzE6tKsFdXBDGugAlRy4oCPyOV0AGdMaG9TgMvdpSg6Q97qDfAGCMkgMHRRmmxtQTj6IC9tDRhjCEp7QODUIG0g2qBjblQE0X-AYRUy4ERiqUATQCwMbEEIHn3iMBiALgxhEI4KDwKQObJiIZFw3stQMBwZ9UEBAAA%3D%3D&s=99ef84e942787a8ec43bdc425965d661b5d7964cc5c8e6348a75c8bba7b9b77d1701120554&w=t&r=1&d=1336&priv=true HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: text/plain; charset=utf-8
content-length: 24
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
12ezo5v60.com/chicken.gif?z=1989865&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=Cqf_9SkNxdFbHgD7GDRch3NA6z0wLurIXG8I0ZzYVHzawZ2E2W80veEpsOd-dSfNjWkombeveELpPyHAMuPazzvNFqbDHR9EzgyhjNboRwBap8etwTrQL4PJ7arPO-UdJSp4rWJJvI-JjgrZOLeFczMFyUTe7nO-sTLi91k8_768TY5XSYh4MzXiiY81-BhQmGb1B7gX3S03NOP3v-of4sP9yVW52LcvsX1yCDKE8dwVzFeFoUXk6iXgxhACiHuzEf3XRY5JuyhcNqLQ7EptLPJxJkTxFHpB909867a1PQLW40u5yZS8kz_G_Vtwr0Zw0Le_nmklxD9ziU85bjlrm1WSDWLAVdeWrmiRQBTtuL00BZPYaV3NtVye6KsG_FDsUuoQd_ymvO0T6MPxKutxJlYnM4h3Eh3wmAfvu-YAGYcZO8tkZY08oloq5mX001VZP765QAC6jiJzXANqTt5uk0CravOgpq_kGw3mOIlIWALiW6aSOIAeyp1TwoaHc41idLv6Fy-lQDT2mbVSaO64UMrZJ8BPc26A_stO4BFw2wGEFoy4a3BslzqOwE87r6CympBWCad31eg8FUhkMUEN-DmUHr4ux-nnvYOfqBopCXvrMy73cl1RcU7jjMzdN3jnB_tyICGdpn5I4lz-jQQK2OhXvfuYicq9Mv0aPK03bURvTmqBdx0Yb5YnBNazuOxF-ZDKPH5u5nsqZfaGSqhcIzGT2GTTu3Wq22YhA7VQrjqoAbUIvDLvoHcpdf6Sio5u-UDIoXkEe3zDSgflYS71AQtNCHx0v4_HKEjvGCwUY83elCdn8Ex36cW7ZTU_KxqntpZdEjgiLHawW3IEIzm3UkwsKa0YP_ksc0uHBTC1e-w95Hhx3ZK-5RDp9zs1nbJ3zoLWp0YsHvFvZk82EHqmLEZmWIjKWOvs16q3MdZuVJJ-CSyJ8_z3ofwmo3BR8p70FPoWeNl4wUk_cDH6aTnyWrlEX7bT0cK_bLOrKU4eQ5j5eC5O46QmkcHWPn0F5CSyNbmnHU7UYnRv4Z4u9XXiJSJi3daEKIAzQJNCNgTT1rCw9uxvghbdl28mf0WDEbzzMHXcMcfMtG3MNj2FDVMkUfhB3AiT03fhrBa5h_J30H6gMi4CQa9TyNrtJgB_IfPElP4heE3VGD2hnIikG6FUa2rAOZ0Rp2_yaxHNG8MipQrZnVbkg6BIryBGjZS0hLBDUSm2xgnnL-zRadsMBfDdmpRp_QDD1ZN4bUEgx3atKMDogIi5djgamUZAI56iyoMOPqT30nuwYaTxLLwflPfkB949xoKABtZrEYG0OFQA-D2Qiv2xmbndTdBY7sdoUn8Kr3mJzeTzAD7uGtVxHf8zPKQAh7xcwvppxkBVXXNL9ESFkJ15pnE1wBrj9TifJ8f2gQJ-WGDABa8E4r1cBbZPgPzQNl2Gvjr_iHP7hBg7uVgkW0fYahEBRoesPKi1Ly-HUBlN5YAcPli54ZTs3qUE_0iql1IgHPC7ndGzOvguidlzgq1xlqPggPKy9nCOSnv27eeCf_8L4Y7wmAJyYwr16OlcClPmeNm4EqLZjtwra8BwPpAvuBv2ujRZ_YQF81gd_RSVmHfQLWithFHFumEA3WlF_jy5LF62YMR4dXhd6yAdmBz9x3wuJ9NTYji9HH-yhCa38KTadFk45dha8fYdTv5AJ9AmrqVbDXK6NaVuWil6nLPbM2_EXqCjwe5uTs9aSekVUmAbm59Wpg_iuXpKUTqdlo3JgSm6MNzEXjM6oKRFuZC4yH5x2eJoTgvDK4Fx1ie9ATkfQr91KR0x0pqSZVtDzb9MXGx8dpghrtJwjveRlsZvVh1xGDrjPiSVIdMBe7DSFp0UPP75-hegW3K5HmbV8Xd67IMVuQBpdJ2LkNox_kauxlXGJUCAnmywJLT6BPbKA3iZ5xTwQnyJRHT1VoLFNBOX3uUN7ezSQDMqx5rrkDtLqEy_MzgKhpVNmCnw8H9eKydJytPremS_7morfGqgIScZn_Ip1iA1e9LdgePwOuSuhyDaCc6puh_xjogs_R2-wenVV2Dbitl53wA3GAtIDCIG8-rJVM8VQpGR8M1SJziDCLlkLTXk5ZSyB7U9zVyOYPiyvVSIU2QzedRXaeBUt-PsikWZA7yPpY3chRQrUD45M7w6PadmqdKM0RCyXqt7GVxonZVyyoDZbGPKwFUoooSSoOqehGd2txgePtvj_uLo6xzmKvV-&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1
200 OK 43 B URL GET HTTP/2 12ezo5v60.com/chicken.gif?z=1989865&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=Cqf_9SkNxdFbHgD7GDRch3NA6z0wLurIXG8I0ZzYVHzawZ2E2W80veEpsOd-dSfNjWkombeveELpPyHAMuPazzvNFqbDHR9EzgyhjNboRwBap8etwTrQL4PJ7arPO-UdJSp4rWJJvI-JjgrZOLeFczMFyUTe7nO-sTLi91k8_768TY5XSYh4MzXiiY81-BhQmGb1B7gX3S03NOP3v-of4sP9yVW52LcvsX1yCDKE8dwVzFeFoUXk6iXgxhACiHuzEf3XRY5JuyhcNqLQ7EptLPJxJkTxFHpB909867a1PQLW40u5yZS8kz_G_Vtwr0Zw0Le_nmklxD9ziU85bjlrm1WSDWLAVdeWrmiRQBTtuL00BZPYaV3NtVye6KsG_FDsUuoQd_ymvO0T6MPxKutxJlYnM4h3Eh3wmAfvu-YAGYcZO8tkZY08oloq5mX001VZP765QAC6jiJzXANqTt5uk0CravOgpq_kGw3mOIlIWALiW6aSOIAeyp1TwoaHc41idLv6Fy-lQDT2mbVSaO64UMrZJ8BPc26A_stO4BFw2wGEFoy4a3BslzqOwE87r6CympBWCad31eg8FUhkMUEN-DmUHr4ux-nnvYOfqBopCXvrMy73cl1RcU7jjMzdN3jnB_tyICGdpn5I4lz-jQQK2OhXvfuYicq9Mv0aPK03bURvTmqBdx0Yb5YnBNazuOxF-ZDKPH5u5nsqZfaGSqhcIzGT2GTTu3Wq22YhA7VQrjqoAbUIvDLvoHcpdf6Sio5u-UDIoXkEe3zDSgflYS71AQtNCHx0v4_HKEjvGCwUY83elCdn8Ex36cW7ZTU_KxqntpZdEjgiLHawW3IEIzm3UkwsKa0YP_ksc0uHBTC1e-w95Hhx3ZK-5RDp9zs1nbJ3zoLWp0YsHvFvZk82EHqmLEZmWIjKWOvs16q3MdZuVJJ-CSyJ8_z3ofwmo3BR8p70FPoWeNl4wUk_cDH6aTnyWrlEX7bT0cK_bLOrKU4eQ5j5eC5O46QmkcHWPn0F5CSyNbmnHU7UYnRv4Z4u9XXiJSJi3daEKIAzQJNCNgTT1rCw9uxvghbdl28mf0WDEbzzMHXcMcfMtG3MNj2FDVMkUfhB3AiT03fhrBa5h_J30H6gMi4CQa9TyNrtJgB_IfPElP4heE3VGD2hnIikG6FUa2rAOZ0Rp2_yaxHNG8MipQrZnVbkg6BIryBGjZS0hLBDUSm2xgnnL-zRadsMBfDdmpRp_QDD1ZN4bUEgx3atKMDogIi5djgamUZAI56iyoMOPqT30nuwYaTxLLwflPfkB949xoKABtZrEYG0OFQA-D2Qiv2xmbndTdBY7sdoUn8Kr3mJzeTzAD7uGtVxHf8zPKQAh7xcwvppxkBVXXNL9ESFkJ15pnE1wBrj9TifJ8f2gQJ-WGDABa8E4r1cBbZPgPzQNl2Gvjr_iHP7hBg7uVgkW0fYahEBRoesPKi1Ly-HUBlN5YAcPli54ZTs3qUE_0iql1IgHPC7ndGzOvguidlzgq1xlqPggPKy9nCOSnv27eeCf_8L4Y7wmAJyYwr16OlcClPmeNm4EqLZjtwra8BwPpAvuBv2ujRZ_YQF81gd_RSVmHfQLWithFHFumEA3WlF_jy5LF62YMR4dXhd6yAdmBz9x3wuJ9NTYji9HH-yhCa38KTadFk45dha8fYdTv5AJ9AmrqVbDXK6NaVuWil6nLPbM2_EXqCjwe5uTs9aSekVUmAbm59Wpg_iuXpKUTqdlo3JgSm6MNzEXjM6oKRFuZC4yH5x2eJoTgvDK4Fx1ie9ATkfQr91KR0x0pqSZVtDzb9MXGx8dpghrtJwjveRlsZvVh1xGDrjPiSVIdMBe7DSFp0UPP75-hegW3K5HmbV8Xd67IMVuQBpdJ2LkNox_kauxlXGJUCAnmywJLT6BPbKA3iZ5xTwQnyJRHT1VoLFNBOX3uUN7ezSQDMqx5rrkDtLqEy_MzgKhpVNmCnw8H9eKydJytPremS_7morfGqgIScZn_Ip1iA1e9LdgePwOuSuhyDaCc6puh_xjogs_R2-wenVV2Dbitl53wA3GAtIDCIG8-rJVM8VQpGR8M1SJziDCLlkLTXk5ZSyB7U9zVyOYPiyvVSIU2QzedRXaeBUt-PsikWZA7yPpY3chRQrUD45M7w6PadmqdKM0RCyXqt7GVxonZVyyoDZbGPKwFUoooSSoOqehGd2txgePtvj_uLo6xzmKvV-&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerBuypass AS-983163327
Subject
Fingerprint70:51:DF:98:CE:0D:50:0F:B3:1F:AB:6A:98:92:B4:3C:98:3A:AC:A0
ValidityThu, 16 Nov 2023 01:40:00 GMT - Mon, 13 May 2024 21:59:00 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
GET /chicken.gif?z=1989865&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=Cqf_9SkNxdFbHgD7GDRch3NA6z0wLurIXG8I0ZzYVHzawZ2E2W80veEpsOd-dSfNjWkombeveELpPyHAMuPazzvNFqbDHR9EzgyhjNboRwBap8etwTrQL4PJ7arPO-UdJSp4rWJJvI-JjgrZOLeFczMFyUTe7nO-sTLi91k8_768TY5XSYh4MzXiiY81-BhQmGb1B7gX3S03NOP3v-of4sP9yVW52LcvsX1yCDKE8dwVzFeFoUXk6iXgxhACiHuzEf3XRY5JuyhcNqLQ7EptLPJxJkTxFHpB909867a1PQLW40u5yZS8kz_G_Vtwr0Zw0Le_nmklxD9ziU85bjlrm1WSDWLAVdeWrmiRQBTtuL00BZPYaV3NtVye6KsG_FDsUuoQd_ymvO0T6MPxKutxJlYnM4h3Eh3wmAfvu-YAGYcZO8tkZY08oloq5mX001VZP765QAC6jiJzXANqTt5uk0CravOgpq_kGw3mOIlIWALiW6aSOIAeyp1TwoaHc41idLv6Fy-lQDT2mbVSaO64UMrZJ8BPc26A_stO4BFw2wGEFoy4a3BslzqOwE87r6CympBWCad31eg8FUhkMUEN-DmUHr4ux-nnvYOfqBopCXvrMy73cl1RcU7jjMzdN3jnB_tyICGdpn5I4lz-jQQK2OhXvfuYicq9Mv0aPK03bURvTmqBdx0Yb5YnBNazuOxF-ZDKPH5u5nsqZfaGSqhcIzGT2GTTu3Wq22YhA7VQrjqoAbUIvDLvoHcpdf6Sio5u-UDIoXkEe3zDSgflYS71AQtNCHx0v4_HKEjvGCwUY83elCdn8Ex36cW7ZTU_KxqntpZdEjgiLHawW3IEIzm3UkwsKa0YP_ksc0uHBTC1e-w95Hhx3ZK-5RDp9zs1nbJ3zoLWp0YsHvFvZk82EHqmLEZmWIjKWOvs16q3MdZuVJJ-CSyJ8_z3ofwmo3BR8p70FPoWeNl4wUk_cDH6aTnyWrlEX7bT0cK_bLOrKU4eQ5j5eC5O46QmkcHWPn0F5CSyNbmnHU7UYnRv4Z4u9XXiJSJi3daEKIAzQJNCNgTT1rCw9uxvghbdl28mf0WDEbzzMHXcMcfMtG3MNj2FDVMkUfhB3AiT03fhrBa5h_J30H6gMi4CQa9TyNrtJgB_IfPElP4heE3VGD2hnIikG6FUa2rAOZ0Rp2_yaxHNG8MipQrZnVbkg6BIryBGjZS0hLBDUSm2xgnnL-zRadsMBfDdmpRp_QDD1ZN4bUEgx3atKMDogIi5djgamUZAI56iyoMOPqT30nuwYaTxLLwflPfkB949xoKABtZrEYG0OFQA-D2Qiv2xmbndTdBY7sdoUn8Kr3mJzeTzAD7uGtVxHf8zPKQAh7xcwvppxkBVXXNL9ESFkJ15pnE1wBrj9TifJ8f2gQJ-WGDABa8E4r1cBbZPgPzQNl2Gvjr_iHP7hBg7uVgkW0fYahEBRoesPKi1Ly-HUBlN5YAcPli54ZTs3qUE_0iql1IgHPC7ndGzOvguidlzgq1xlqPggPKy9nCOSnv27eeCf_8L4Y7wmAJyYwr16OlcClPmeNm4EqLZjtwra8BwPpAvuBv2ujRZ_YQF81gd_RSVmHfQLWithFHFumEA3WlF_jy5LF62YMR4dXhd6yAdmBz9x3wuJ9NTYji9HH-yhCa38KTadFk45dha8fYdTv5AJ9AmrqVbDXK6NaVuWil6nLPbM2_EXqCjwe5uTs9aSekVUmAbm59Wpg_iuXpKUTqdlo3JgSm6MNzEXjM6oKRFuZC4yH5x2eJoTgvDK4Fx1ie9ATkfQr91KR0x0pqSZVtDzb9MXGx8dpghrtJwjveRlsZvVh1xGDrjPiSVIdMBe7DSFp0UPP75-hegW3K5HmbV8Xd67IMVuQBpdJ2LkNox_kauxlXGJUCAnmywJLT6BPbKA3iZ5xTwQnyJRHT1VoLFNBOX3uUN7ezSQDMqx5rrkDtLqEy_MzgKhpVNmCnw8H9eKydJytPremS_7morfGqgIScZn_Ip1iA1e9LdgePwOuSuhyDaCc6puh_xjogs_R2-wenVV2Dbitl53wA3GAtIDCIG8-rJVM8VQpGR8M1SJziDCLlkLTXk5ZSyB7U9zVyOYPiyvVSIU2QzedRXaeBUt-PsikWZA7yPpY3chRQrUD45M7w6PadmqdKM0RCyXqt7GVxonZVyyoDZbGPKwFUoooSSoOqehGd2txgePtvj_uLo6xzmKvV-&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1 HTTP/1.1
Host: 12ezo5v60.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: CHCK=1; UID=231127162931b77092262f4cc2b606ff51a8; OACICAP=ACl2VwAAAAAAAAAB; OACIBLOCK=ACl2VwAAAABlZCJQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
200 OK 9.2 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type gzip compressed data, max compression\012- data
Hash 898d21141649dacbdb415f9b6a921535
5e4f22ed2bfa17158263e79e6de16766b455c843
35214adcd588f9bcd836c3dc9a21f7af7910d431bc67f6e3ffdd381e58d90072
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 27 Nov 2023 21:29:18 GMT
date: Mon, 27 Nov 2023 21:29:18 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
poweredby.jads.co/adshow.php?adzone=818858
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=818858
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (400), with CRLF, LF line terminators
Hash 813aa556d3f8812c76a5fcf739aa2088
b38754047b4fce24fc6bfd32cef96f6bfaeee3bb
d68f4ce06daa4ece7dcb165cbdca5a00e72c31b3407b2deb9e13b7b1cdedf8cb
GET /adshow.php?adzone=818858 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=c0671944de4c52fd023f09c4384a443a; expires=Tue, 26-Nov-2024 21:29:13 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YTowOnt9; expires=Thu, 30-Nov-2023 21:29:13 GMT; Max-Age=259195; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:13 GMT; Max-Age=259195; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
go.fxmnba.com/abc.gif?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&language=en&thumbFit=cover&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Ftsyndicate.com%2F&i=0&ib=0&filtersMatch=0&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A2147%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1825%2C%22duration%22%3A151%2C%22transferSize%22%3A4625%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1826%2C%22duration%22%3A164%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22first-contentful-paint%22%2C%22startTime%22%3A2586%2C%22duration%22%3A0%7D%5D&mh=-488798653
103 B URL go.fxmnba.com/abc.gif?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&language=en&thumbFit=cover&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Ftsyndicate.com%2F&i=0&ib=0&filtersMatch=0&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A2147%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1825%2C%22duration%22%3A151%2C%22transferSize%22%3A4625%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1826%2C%22duration%22%3A164%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22first-contentful-paint%22%2C%22startTime%22%3A2586%2C%22duration%22%3A0%7D%5D&mh=-488798653
IP
Hash 8c99886486b9a004383cb4df29011c43
d79ca4754481fc59598bc08fcdf354900918bffe
bda00b0f6892b1c6991e793b42654ad1807694e2ffabcbc4eb1399379737ef6c
GET /abc.gif?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&language=en&thumbFit=cover&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Ftsyndicate.com%2F&i=0&ib=0&filtersMatch=0&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A2147%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1825%2C%22duration%22%3A151%2C%22transferSize%22%3A4625%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1826%2C%22duration%22%3A164%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22first-contentful-paint%22%2C%22startTime%22%3A2586%2C%22duration%22%3A0%7D%5D&mh=-488798653 HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.fxmnba.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/gif
content-length: 103
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtr4jPouUtFUmSRgcNyzPQWW6gjuE; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:18 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7740dd15b500-OSL
alt-svc: h3=":443"; ma=86400
pxl.tsyndicate.com/api/v1/elapsedtime?f=banner%20300x250&sc=449e4fe3501746fda88f88df1f88ddf7&hn=zh.hentai-img.com&et=237
0 B URL pxl.tsyndicate.com/api/v1/elapsedtime?f=banner%20300x250&sc=449e4fe3501746fda88f88df1f88ddf7&hn=zh.hentai-img.com&et=237
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
Fingerprint20:10:1C:0B:2E:9E:D5:EC:27:D0:14:82:27:FD:B5:EA:CA:D2:11:6E
ValidityThu, 12 Oct 2023 09:07:20 GMT - Wed, 10 Jan 2024 09:07:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/v1/elapsedtime?f=banner%20300x250&sc=449e4fe3501746fda88f88df1f88ddf7&hn=zh.hentai-img.com&et=237 HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-length: 0
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
static.eabids.com/data/bannerpools/112022/33917.jpg
200 OK 73 kB URL GET HTTP/2 static.eabids.com/data/bannerpools/112022/33917.jpg
IP
Requested by https://ads.eabids.com/banner.go?spaceid=3918383
Certificate IssuerLet's Encrypt
Subjectstatic.eabids.com
FingerprintE9:DD:1B:37:D8:1B:5D:D5:D9:23:EC:67:54:40:A0:7E:A7:02:D3:7F
ValidityThu, 05 Oct 2023 21:00:19 GMT - Wed, 03 Jan 2024 21:00:18 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 300x250, components 3\012- data
Hash 7878e459e3a341049fb57b8637109839
7daa564cfe7d1b477ab10b7f000c9f895c39c93e
bcb79d540ab4c28441231cb3361d5abe00192dc661eba30ad9d9cd482ac08fc8
GET /data/bannerpools/112022/33917.jpg HTTP/1.1
Host: static.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ads.eabids.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/jpeg
content-length: 72951
last-modified: Thu, 28 Apr 2022 13:46:07 GMT
etag: "626a9a9f-11cf7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-backend-server: nl2-static-224
accept-ranges: bytes
X-Firefox-Spdy: h2
creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
308 B URL creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 7dc4b59430c5e6bd357fc95b52fa36d5
6b6d88a5bd83c1fea6103706ec9d5db26f3e0747
e23b82a266f7b480a9b04198808f7ecbb63f9d0109930b683fcf26aed908b493
GET /widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid} HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r.trackwilltrk.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: text/html
last-modified: Thu, 23 Nov 2023 14:37:17 GMT
expires: Mon, 27 Nov 2023 21:29:21 GMT
cache-control: max-age=10
strict-transport-security: max-age=15768000
pragma: public
report-to: { "endpoints":[{ "url": "https://go.stripchat.com/report" }], "group": "default", "max_age": 1048576 }
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: HIT
age: 5
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773c38b05696-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-E88HENYLBC&l=dataLayer&cx=c
200 OK 81 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-E88HENYLBC&l=dataLayer&cx=c
IP
Requested by https://adsmediabox.com/cobp.php?utm_source=ja&utm_medium=imp&utm_campaign=555555&t=170112056&sid=555555&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash c0d51c851de5d03ee0b1231518e4767b
49a356aaf9c6f2284b2e45cdd130d4364c3789e9
ca9704baaa69749e76d76afd3f77cc794d036b72abe4182a86ba93ed788f1c24
GET /gtag/js?id=G-E88HENYLBC&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:18 GMT
expires: Mon, 27 Nov 2023 21:29:18 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 80953
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
superchat.live/checkUrl
200 OK 15 B IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsuperchat.live
Fingerprint71:53:3C:18:FA:AE:A0:62:7C:C3:FB:CC:31:67:5B:C1:13:D8:60:87
ValidityWed, 23 Aug 2023 00:00:00 GMT - Thu, 22 Aug 2024 23:59:59 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 7fb97eb7c8636552ad068f6d56b5ea34
b69679936779fb02503bc0fe1374a737cc762ecb
e78008828abaa93c4462e326ef384dcda1443352a0f24bdeedada6a6fdbfd1d5
GET /checkUrl HTTP/1.1
Host: superchat.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/json
content-length: 15
access-control-allow-origin: https://creative.fxmnba.com
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuGyDLPvii6XBe55W4fmxo2EJByXpbgdwLE3AsXcp4; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:18 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd77417ff5b527-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: dEdxUPNeQd2x7nXk7wQjTm049kiBblue+idUQQ4zUyE0gMefrCpEYWmiGH2nvC08TFO/yDXCoHe2ueOkGHSa9w==
x-amz-request-id: BQ8FC22TSNZKMNPP
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.fxmnba.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5135
expires: Tue, 28 Nov 2023 01:29:18 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7741cceb56a4-OSL
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=G-E10XQK88K4&l=dataLayer&cx=c
200 OK 81 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-E10XQK88K4&l=dataLayer&cx=c
IP
Requested by https://adsmediabox.com/tr.php?utm_source=cb&utm_campaign=jrt&utm_medium=frm
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash 10ee4d52018db7622ed48091cac2836f
49073405b60e91b276af418ba1132b477faa77c8
f6bc9eb2a8164edfe216d086d475a1d087f584fce94d7f72c9bdca18a87cf6ca
GET /gtag/js?id=G-E10XQK88K4&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:18 GMT
expires: Mon, 27 Nov 2023 21:29:18 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 80973
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ocsp.usertrust.com/
471 B IP
Hash dbb5e82973e92d0a808f41d178e71b3f
45e57cc7a1c517159a604fc1d2a0a23ebc1cbf68
e1c4c5c904e2e05ed659a02150e070e414590d418fca7e583bc4ae1672a72a80
POST / HTTP/1.1
Host: ocsp.usertrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:18 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 25 Nov 2023 02:55:07 GMT
Expires: Sat, 02 Dec 2023 02:55:06 GMT
Etag: "45e57cc7a1c517159a604fc1d2a0a23ebc1cbf68"
Cache-Control: max-age=602003,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 166
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82cd774238587128-OSL
ocsp.usertrust.com/
471 B IP
Hash 592ee8bef90b443e6c5e0550bf6c8fb4
bee2e6975b4b5481f7333256852d9accc798d10f
f679fbdf6019848b6752ae56a296b82a5c529f3544a2a10aa9d6de74608981ed
POST / HTTP/1.1
Host: ocsp.usertrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 21:29:18 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 27 Nov 2023 11:57:08 GMT
Expires: Mon, 04 Dec 2023 11:57:07 GMT
Etag: "bee2e6975b4b5481f7333256852d9accc798d10f"
Cache-Control: max-age=603754,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 56
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82cd77423fc6b4f7-OSL
pxl.tsyndicate.com/api/v1/p/p.js?p=APeIQFMmDJkycuaI0DEjBgsRYcbQWehQBJ0zC0WQyTHDRhkbMMK0EAOjjJgWNHKIKdMCRw0zZlqMqUFmzI0bMGmQoRFDxMM5YtKQUahji4gYOGzMgCHDRgsZNGDcyEEDR4sZMq7CaLH1Tho3ZN7cmdPCK1ixc1bE2OrmjYguD8PUGZPRRhgcY8zYuLFVxkenOkO2yFGG52AZNWzUbNo0zA2fEMnYoYgjJY6HcOqIWTgDR-e4cOBwllFxDpyJDHHAmNFQxsMxbUTrkHEjBusZccmYofhQjBs3FKnaGO5aRBs3GHXYliEDBubjyWPkWG3jYZ2eOgbSoQNnjo4XL868cYGHTRo7csjIcTHmTZsXc9qEkcP9DZwXMWSolpHjRlIzK21kgxll4KAaazCIQZJnZYwxRmExlJGfDGKEAQMOZdAWg3QXijEGVRyVYUZHntFAww91zIFQEmT0UMZOZcxgYg7NyRCGiWGYcZdtMdQgVRg5kJFfGDF8aIMMWCEFUmFimOGgjUSKwRqRBvYnxpJc1AEDUzbM8UYdcjzIYg8a3pbllk21UUYbK8kxZhJE6KEFFGQUQcUZaIwxhBFfSPHEHHWoEQMceFwR5hB5kGbEEE08kaIWU1AxBR51JOFGDXlAsYQUBDmBEhZC3CBFC2mswcQXVjTRxBtonLEGFTZ8oYR5TWQxXBZo0KEGE3fkcEYMSNTwRBY4qJGHFEnoIQQRckDBhhBDmIEEFHUUscYXZ1QBpxRVpHEml3DE0ENnq7X2bVNi1LHdG24M8QYbb8jRQwlIcgQDSDaca4N5dpQhhEFnlOEuvPLSOwNMUkkFWVhtZKQHGi4Q5AYdYaRBahtnsOceZGOEgdoWDcElQpMLweDCljU8JIcdsjVlXR1pZIQVDirVQFoLMVgYA0r-xYRDYy2YQfMNHnYYEQ6QpSGbCDnE4MJ0LtAggws90gCZHF8onVHTT5ssNdU1WG1dGBmtqkcabLARxgs1nAwCCld8FdZYIDhBBQhrnbwDCHG7YQMNe-Px994rKwdD2zCkAMIRDa7xxgvNrQXDWjGAYEQacoj4Bh74HX4yx3Rl58QTkMX7hYMZjQ4ZG6GLUIQTC5dhxxeZs0FRDTd5ZoNqzokgxxnAzVYDDjc8dNDsYsixkIHGy_5FG2-QsZB-NlSknlsMPfQGUTRgJsfmeSyUsu8iZpQrd96B93DEZUxc8cUZt_ceZHdklJ9qkKFhP1NiizDHyhn5HsXoEK8W1MENaaADV3Lggprkp3T_m8xsQAQDGihFP8Zr3UG-4EAZQIYODVMOXzbUnBqY8CEg9KAIJ5efw5mwacUxCO3KYJoveIwiI2yhCcfnvDCwASF0IArIaCCyMIgBNRoRkVzYMBHMsK5kr0kODPqggIAA&s=60624e10e052d659abf012196ca16c61f94a424acd32e05e39c378f5fc62de881701120555&w=t&r=1&d=1704&priv=true
200 OK 24 B URL GET HTTP/2 pxl.tsyndicate.com/api/v1/p/p.js?p=APeIQFMmDJkycuaI0DEjBgsRYcbQWehQBJ0zC0WQyTHDRhkbMMK0EAOjjJgWNHKIKdMCRw0zZlqMqUFmzI0bMGmQoRFDxMM5YtKQUahji4gYOGzMgCHDRgsZNGDcyEEDR4sZMq7CaLH1Tho3ZN7cmdPCK1ixc1bE2OrmjYguD8PUGZPRRhgcY8zYuLFVxkenOkO2yFGG52AZNWzUbNo0zA2fEMnYoYgjJY6HcOqIWTgDR-e4cOBwllFxDpyJDHHAmNFQxsMxbUTrkHEjBusZccmYofhQjBs3FKnaGO5aRBs3GHXYliEDBubjyWPkWG3jYZ2eOgbSoQNnjo4XL868cYGHTRo7csjIcTHmTZsXc9qEkcP9DZwXMWSolpHjRlIzK21kgxll4KAaazCIQZJnZYwxRmExlJGfDGKEAQMOZdAWg3QXijEGVRyVYUZHntFAww91zIFQEmT0UMZOZcxgYg7NyRCGiWGYcZdtMdQgVRg5kJFfGDF8aIMMWCEFUmFimOGgjUSKwRqRBvYnxpJc1AEDUzbM8UYdcjzIYg8a3pbllk21UUYbK8kxZhJE6KEFFGQUQcUZaIwxhBFfSPHEHHWoEQMceFwR5hB5kGbEEE08kaIWU1AxBR51JOFGDXlAsYQUBDmBEhZC3CBFC2mswcQXVjTRxBtonLEGFTZ8oYR5TWQxXBZo0KEGE3fkcEYMSNTwRBY4qJGHFEnoIQQRckDBhhBDmIEEFHUUscYXZ1QBpxRVpHEml3DE0ENnq7X2bVNi1LHdG24M8QYbb8jRQwlIcgQDSDaca4N5dpQhhEFnlOEuvPLSOwNMUkkFWVhtZKQHGi4Q5AYdYaRBahtnsOceZGOEgdoWDcElQpMLweDCljU8JIcdsjVlXR1pZIQVDirVQFoLMVgYA0r-xYRDYy2YQfMNHnYYEQ6QpSGbCDnE4MJ0LtAggws90gCZHF8onVHTT5ssNdU1WG1dGBmtqkcabLARxgs1nAwCCld8FdZYIDhBBQhrnbwDCHG7YQMNe-Px994rKwdD2zCkAMIRDa7xxgvNrQXDWjGAYEQacoj4Bh74HX4yx3Rl58QTkMX7hYMZjQ4ZG6GLUIQTC5dhxxeZs0FRDTd5ZoNqzokgxxnAzVYDDjc8dNDsYsixkIHGy_5FG2-QsZB-NlSknlsMPfQGUTRgJsfmeSyUsu8iZpQrd96B93DEZUxc8cUZt_ceZHdklJ9qkKFhP1NiizDHyhn5HsXoEK8W1MENaaADV3Lggprkp3T_m8xsQAQDGihFP8Zr3UG-4EAZQIYODVMOXzbUnBqY8CEg9KAIJ5efw5mwacUxCO3KYJoveIwiI2yhCcfnvDCwASF0IArIaCCyMIgBNRoRkVzYMBHMsK5kr0kODPqggIAA&s=60624e10e052d659abf012196ca16c61f94a424acd32e05e39c378f5fc62de881701120555&w=t&r=1&d=1704&priv=true
IP
ASN #24940 Hetzner Online GmbH
Requested by https://tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
Fingerprint20:10:1C:0B:2E:9E:D5:EC:27:D0:14:82:27:FD:B5:EA:CA:D2:11:6E
ValidityThu, 12 Oct 2023 09:07:20 GMT - Wed, 10 Jan 2024 09:07:19 GMT
File type ASCII text, with no line terminators
Hash 0959ba36d476b6dc1994ba3c678b07c4
d30b94da72daa02766965206a85b7e0356375f5e
897410b87e27e3dfba3a7d6caab315a5e69cc941bb96d91fc74878a9b051843a
GET /api/v1/p/p.js?p=APeIQFMmDJkycuaI0DEjBgsRYcbQWehQBJ0zC0WQyTHDRhkbMMK0EAOjjJgWNHKIKdMCRw0zZlqMqUFmzI0bMGmQoRFDxMM5YtKQUahji4gYOGzMgCHDRgsZNGDcyEEDR4sZMq7CaLH1Tho3ZN7cmdPCK1ixc1bE2OrmjYguD8PUGZPRRhgcY8zYuLFVxkenOkO2yFGG52AZNWzUbNo0zA2fEMnYoYgjJY6HcOqIWTgDR-e4cOBwllFxDpyJDHHAmNFQxsMxbUTrkHEjBusZccmYofhQjBs3FKnaGO5aRBs3GHXYliEDBubjyWPkWG3jYZ2eOgbSoQNnjo4XL868cYGHTRo7csjIcTHmTZsXc9qEkcP9DZwXMWSolpHjRlIzK21kgxll4KAaazCIQZJnZYwxRmExlJGfDGKEAQMOZdAWg3QXijEGVRyVYUZHntFAww91zIFQEmT0UMZOZcxgYg7NyRCGiWGYcZdtMdQgVRg5kJFfGDF8aIMMWCEFUmFimOGgjUSKwRqRBvYnxpJc1AEDUzbM8UYdcjzIYg8a3pbllk21UUYbK8kxZhJE6KEFFGQUQcUZaIwxhBFfSPHEHHWoEQMceFwR5hB5kGbEEE08kaIWU1AxBR51JOFGDXlAsYQUBDmBEhZC3CBFC2mswcQXVjTRxBtonLEGFTZ8oYR5TWQxXBZo0KEGE3fkcEYMSNTwRBY4qJGHFEnoIQQRckDBhhBDmIEEFHUUscYXZ1QBpxRVpHEml3DE0ENnq7X2bVNi1LHdG24M8QYbb8jRQwlIcgQDSDaca4N5dpQhhEFnlOEuvPLSOwNMUkkFWVhtZKQHGi4Q5AYdYaRBahtnsOceZGOEgdoWDcElQpMLweDCljU8JIcdsjVlXR1pZIQVDirVQFoLMVgYA0r-xYRDYy2YQfMNHnYYEQ6QpSGbCDnE4MJ0LtAggws90gCZHF8onVHTT5ssNdU1WG1dGBmtqkcabLARxgs1nAwCCld8FdZYIDhBBQhrnbwDCHG7YQMNe-Px994rKwdD2zCkAMIRDa7xxgvNrQXDWjGAYEQacoj4Bh74HX4yx3Rl58QTkMX7hYMZjQ4ZG6GLUIQTC5dhxxeZs0FRDTd5ZoNqzokgxxnAzVYDDjc8dNDsYsixkIHGy_5FG2-QsZB-NlSknlsMPfQGUTRgJsfmeSyUsu8iZpQrd96B93DEZUxc8cUZt_ceZHdklJ9qkKFhP1NiizDHyhn5HsXoEK8W1MENaaADV3Lggprkp3T_m8xsQAQDGihFP8Zr3UG-4EAZQIYODVMOXzbUnBqY8CEg9KAIJ5efw5mwacUxCO3KYJoveIwiI2yhCcfnvDCwASF0IArIaCCyMIgBNRoRkVzYMBHMsK5kr0kODPqggIAA&s=60624e10e052d659abf012196ca16c61f94a424acd32e05e39c378f5fc62de881701120555&w=t&r=1&d=1704&priv=true HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tsyndicate.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: text/plain; charset=utf-8
content-length: 24
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/css/animate.css
200 OK 6.3 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/css/animate.css
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
Hash e1d8acd5ee9d1a90ea09313cbd8f2b02
8a8327b115d1356715e63270d1ce6d46124c7b1a
3028c87fc798ac3741f02079034e6c23462afc0c5e6c8d321188ce3716c8472a
GET /sb/ssp/notifications/text_bubble/2/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: text/css
last-modified: Tue, 12 Jul 2022 10:56:21 GMT
etag: W/"62cd5355-13591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 107280
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zhK2OGZG0XlcQ0tUWXae2JNsH7ciHgVg%2FX0%2BS8Yx0MSGZ9eWuTDeXrp2pyinhQ08mmXmT3Gh8sd62wRF1neh%2F1DXCkytd9vWhDMYjjcI5Ms1JQ2S86PL0rJfQuJYelyvM%2FuzXa8iBlyS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773bde39b951-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
zh.hentai-img.com/
8.7 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (445)
Hash 76646107bd0b8ef95047ad74085ee3f7
1443ee58c778465cd7385078a835e305b0a8b8b8
742d349e8340989f1ec9d4e5f4c2ffe3a682fea156a9ac0d6280b522dfbea3f5
GET / HTTP/1.1
Host: zh.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:16 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, User-Agent, User-Agent
set-cookie: adsense=pc-ca-ipp%3D1701097156; expires=Thu, 30-Nov-2023 02:59:16 GMT; Max-Age=216000; path=/; domain=.hentai-img.com
fastcgi-cache: STALE
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-cache: HIT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d6p3uWn%2BBo3Ze5hK1JUebOgoUeRqd74p323IEsePQ57PVWr43ZXAWCHVgmlVCtydvFrRxJWfzyUWj3pTt6sOkA8X6BY8cZ5JO7%2F94dnjSNzJ31zcTRd1jAQzksHk92uQxGDB9A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cd770f5c5960ed-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
collectionofbestporn.com/
3.3 kB URL collectionofbestporn.com/
IP
ASN #43350 NForce Entertainment B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (8388)
Hash 55c15abef1adecf6f55130837c88530f
95e9364ed548d43ef78a1ce5ade833f3e690146e
b6f417cde1b764e08e9c1e7688eabcce8a8727c9c3a8f4570f2cc49f039d1bd8
GET / HTTP/1.1
Host: collectionofbestporn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:18 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 3343
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
charset: iso-8859-1
Set-Cookie: PHPSESSID=avod1hgq206lvjqnal6mk6neq2; path=/
cu=NO; expires=Mon, 27-Nov-2023 22:29:18 GMT; path=/
Vary: Accept-Encoding
Content-Encoding: gzip
lby2kd27c.com/chicken.gif?z=1863026&pb=45d29bcaa438fc8b0cb7fc83676caab81701127753&psp=ikcdDbDIuIiAbO5N6trkP8QH4aAK7eVLrgsLnMZnnZXCQrAjcCqzbVaNrKQE9Zg0zE8cMpR9zOn3EHntyqaZQKtGYPbCvmjOm82scQ657TpZd52lEs2dCVFVwvuLiWeS6Flz_SrCzci7p2UmHClrSue_oAM9LD_lDMjFCjk1EBtA-QpqsbjPr_PBbMIkDbft0dxKhiX98-kCykxPLhoVYfkWwnbiqNvpQM3Pu7vkpirCApl8Cq0IwcieLaY0T6CSDnCmEM2llcS0F6bzH_K966gLyl6f_CurWPD6-OhG-XT4YqSmtbzLDlUEGYMgj0_XieRIGM2EY9ZRghoxZah-7LhpxRtpwgm5k7GThM5hJ3zwEp5o1XNYuT5u7ba4TI7wNTmeLXcGwUTSZSr1Mwn2X-2J4Gd5_0LRGepKXcr2qTRmrjnlkgEbHr5Qd8v9x0VjxiA6DS-BtpTIr4haeRYfiTs7XR5iIUgPIE6Q3-3wOVTPG7FOkupFDh40wM14SeERhuOq0L8le2zM521ubOSfUzkdLufi1QE_zmWGlamyxDlmP_iWVDxELzO2yZ_KLd-nooIF_LWNZ7s97nhuM4fRswxnrY15XdQSgn7pYqYHsz6PsW0JtYbh6EaF08XKNCOHg7BHlCjJS8EGnLQZTwzfftJIfgjAkHV5J-fWn0UcxCqNMaUUXdytkiHt7q_P0mbrlLIajUPghqRsWhm3_S00aG8jHo6ZX-Qb2245o9k-HXAU3uBxzX37ntzLlw-EMCffk_1xmYAIzuYbbZwpSaYnDHZm6zWymz9Nn2guZKZgn91ENCqoSB6ILstcphtjz2LoVQhmPvRmCZMfFt6zbmHibP4BaTVDN3pEw1Govnu_MQ3hal76AMW8xtJXFakQvruykZxMgTPF2rEzeGAwBY8ofmovp1vwUxuL2LsVpx14Cp2on_ZL4Cnkvi_V-JFsjMwwUoCqz-CB_0CtYS4WfV20k9VOwV_vBRm-oUkLcjwPTbisVeH7b23WCCA66tMgFpBN4i4=&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1237384543608320&eclog=0&sp=1&im=1&pload=4983
43 B URL lby2kd27c.com/chicken.gif?z=1863026&pb=45d29bcaa438fc8b0cb7fc83676caab81701127753&psp=ikcdDbDIuIiAbO5N6trkP8QH4aAK7eVLrgsLnMZnnZXCQrAjcCqzbVaNrKQE9Zg0zE8cMpR9zOn3EHntyqaZQKtGYPbCvmjOm82scQ657TpZd52lEs2dCVFVwvuLiWeS6Flz_SrCzci7p2UmHClrSue_oAM9LD_lDMjFCjk1EBtA-QpqsbjPr_PBbMIkDbft0dxKhiX98-kCykxPLhoVYfkWwnbiqNvpQM3Pu7vkpirCApl8Cq0IwcieLaY0T6CSDnCmEM2llcS0F6bzH_K966gLyl6f_CurWPD6-OhG-XT4YqSmtbzLDlUEGYMgj0_XieRIGM2EY9ZRghoxZah-7LhpxRtpwgm5k7GThM5hJ3zwEp5o1XNYuT5u7ba4TI7wNTmeLXcGwUTSZSr1Mwn2X-2J4Gd5_0LRGepKXcr2qTRmrjnlkgEbHr5Qd8v9x0VjxiA6DS-BtpTIr4haeRYfiTs7XR5iIUgPIE6Q3-3wOVTPG7FOkupFDh40wM14SeERhuOq0L8le2zM521ubOSfUzkdLufi1QE_zmWGlamyxDlmP_iWVDxELzO2yZ_KLd-nooIF_LWNZ7s97nhuM4fRswxnrY15XdQSgn7pYqYHsz6PsW0JtYbh6EaF08XKNCOHg7BHlCjJS8EGnLQZTwzfftJIfgjAkHV5J-fWn0UcxCqNMaUUXdytkiHt7q_P0mbrlLIajUPghqRsWhm3_S00aG8jHo6ZX-Qb2245o9k-HXAU3uBxzX37ntzLlw-EMCffk_1xmYAIzuYbbZwpSaYnDHZm6zWymz9Nn2guZKZgn91ENCqoSB6ILstcphtjz2LoVQhmPvRmCZMfFt6zbmHibP4BaTVDN3pEw1Govnu_MQ3hal76AMW8xtJXFakQvruykZxMgTPF2rEzeGAwBY8ofmovp1vwUxuL2LsVpx14Cp2on_ZL4Cnkvi_V-JFsjMwwUoCqz-CB_0CtYS4WfV20k9VOwV_vBRm-oUkLcjwPTbisVeH7b23WCCA66tMgFpBN4i4=&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1237384543608320&eclog=0&sp=1&im=1&pload=4983
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
GET /chicken.gif?z=1863026&pb=45d29bcaa438fc8b0cb7fc83676caab81701127753&psp=ikcdDbDIuIiAbO5N6trkP8QH4aAK7eVLrgsLnMZnnZXCQrAjcCqzbVaNrKQE9Zg0zE8cMpR9zOn3EHntyqaZQKtGYPbCvmjOm82scQ657TpZd52lEs2dCVFVwvuLiWeS6Flz_SrCzci7p2UmHClrSue_oAM9LD_lDMjFCjk1EBtA-QpqsbjPr_PBbMIkDbft0dxKhiX98-kCykxPLhoVYfkWwnbiqNvpQM3Pu7vkpirCApl8Cq0IwcieLaY0T6CSDnCmEM2llcS0F6bzH_K966gLyl6f_CurWPD6-OhG-XT4YqSmtbzLDlUEGYMgj0_XieRIGM2EY9ZRghoxZah-7LhpxRtpwgm5k7GThM5hJ3zwEp5o1XNYuT5u7ba4TI7wNTmeLXcGwUTSZSr1Mwn2X-2J4Gd5_0LRGepKXcr2qTRmrjnlkgEbHr5Qd8v9x0VjxiA6DS-BtpTIr4haeRYfiTs7XR5iIUgPIE6Q3-3wOVTPG7FOkupFDh40wM14SeERhuOq0L8le2zM521ubOSfUzkdLufi1QE_zmWGlamyxDlmP_iWVDxELzO2yZ_KLd-nooIF_LWNZ7s97nhuM4fRswxnrY15XdQSgn7pYqYHsz6PsW0JtYbh6EaF08XKNCOHg7BHlCjJS8EGnLQZTwzfftJIfgjAkHV5J-fWn0UcxCqNMaUUXdytkiHt7q_P0mbrlLIajUPghqRsWhm3_S00aG8jHo6ZX-Qb2245o9k-HXAU3uBxzX37ntzLlw-EMCffk_1xmYAIzuYbbZwpSaYnDHZm6zWymz9Nn2guZKZgn91ENCqoSB6ILstcphtjz2LoVQhmPvRmCZMfFt6zbmHibP4BaTVDN3pEw1Govnu_MQ3hal76AMW8xtJXFakQvruykZxMgTPF2rEzeGAwBY8ofmovp1vwUxuL2LsVpx14Cp2on_ZL4Cnkvi_V-JFsjMwwUoCqz-CB_0CtYS4WfV20k9VOwV_vBRm-oUkLcjwPTbisVeH7b23WCCA66tMgFpBN4i4=&im=1&freq=0&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1237384543608320&eclog=0&sp=1&im=1&pload=4983 HTTP/1.1
Host: lby2kd27c.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: CHCK=1; UID=23112716292f5d8548e9954808a9ea053dc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go.fxmnba.com/event/ml
200 OK 4.4 kB IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash 6dbf7ea4f31dbe2b1f7e43982cd0b874
39d2234324df03fcee28f02db3f316d1e45a243f
4aaa72e51cceb5bdd08e8b9f5dca256b8704502ee7bb1fd2a429fa02b232d19a
POST /event/ml HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 172
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/json
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrs3cR5HVWEzYfyphTA6HBPWNAG4; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:18 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7741ce1bb500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.js
200 OK 80 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (32011), with LF, NEL line terminators
Hash 149fd3a87101adfb731800f02f11e73b
9a9a0f6f14028d913e63fc012a80378a5c4d5896
420332e58487b55b58db2c2edbe69162c5d23170061d16addce87762ef224f4b
GET /widgets/v4/Universal/main.672e6e87c69b0c60653e.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-44bd4"
expires: Mon, 27 Nov 2023 21:29:16 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 7
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7742ab86b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/app/domain-checker/check-result
204 No Content 0 B URL POST HTTP/3 go.fxmnba.com/app/domain-checker/check-result
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 173
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:18 GMT
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe5YwWiHkr5ApC; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:18 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd77434fd9b500-OSL
alt-svc: h3=":443"; ma=86400
creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.js
200 OK 81 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (32011), with LF, NEL line terminators
Hash 149fd3a87101adfb731800f02f11e73b
9a9a0f6f14028d913e63fc012a80378a5c4d5896
420332e58487b55b58db2c2edbe69162c5d23170061d16addce87762ef224f4b
GET /widgets/v4/Universal/main.672e6e87c69b0c60653e.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-44bd4"
expires: Mon, 27 Nov 2023 21:29:16 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 7
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7742cbadb4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
img.strpst.com/thumbs/1701120510/59028862_webp
8.5 kB URL img.strpst.com/thumbs/1701120510/59028862_webp
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 640x360, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 30544aa5a9c2240e5ceee0a8ccd48851
38ca8d3a9dce746346cb4e87f0d6e944689a79bd
160470c0784fd530be1967c573c9826a6c1948aa859d8a046fe24d96e231b73d
GET /thumbs/1701120510/59028862_webp HTTP/1.1
Host: img.strpst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.fxmnba.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/webp
content-length: 8470
etag: "30544aa5a9c2240e5ceee0a8ccd48851"
last-modified: Mon, 27 Nov 2023 21:27:24 GMT
cache-control: public, max-age=1800, s-maxage=1800
access-control-allow-origin: *
access-control-allow-methods: GET
cf-cache-status: HIT
age: 48
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7745285656c4-OSL
alt-svc: h3=":443"; ma=86400
r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
200 OK 1.1 kB URL GET HTTP/1.1 r.trackwilltrk.com/s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6=
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://poweredby.jads.co/adshow.php?adzone=818858
Certificate IssuerLet's Encrypt
Subjectr.trackwilltrk.com
Fingerprint7C:C7:38:E4:D4:9A:D8:A7:4E:3B:33:43:DA:B9:1E:86:98:DA:B1:71
ValidityTue, 14 Nov 2023 07:21:50 GMT - Mon, 12 Feb 2024 07:21:49 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (386)
Hash 28bf4b89ec85d8e767e9df8875dc7928
5ffc498d104c61caa35cf658efb48579c1215ec8
14cb7576fb0940093b06823c6d7bdb75d505239f60d1943051f2a7880961c549
GET /s1/9b7f1a3f-a560-43f5-96f0-409a96741233?externalId={extPlaceholder}&cost={costPlaceholder}&cv1={dynamicCON}&cv2=NO&cv3=121604&cv4=218716&cv5=818858&cv6= HTTP/1.1
Host: r.trackwilltrk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poweredby.jads.co/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 27 Nov 2023 21:29:18 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Set-Cookie: uid=T__zjE9zp; Path=/; Domain=trackwilltrk.com; Expires=Tue, 28 Nov 2023 21:29:18 GMT; HttpOnly
X-Request-Id: cb17c946-a6f6-4900-b4e0-00412aa38933
Content-Encoding: gzip
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: Uy+BI0f9xi3njNOl7P4PsULkPp0g6ssxBGHnYb4mQe+eet3x2+C470ZEAYzLvRraWhXf8LMEGWU=
x-amz-request-id: WWWZDEMQD0DJ51HX
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.bbrdbr.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5133
expires: Tue, 28 Nov 2023 01:29:18 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77454a4d56a4-OSL
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/abc.gif?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&language=en&thumbFit=cover&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Ftsyndicate.com%2F&i=0&ib=0&filtersMatch=0&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1275%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A765%2C%22duration%22%3A287%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A765%2C%22duration%22%3A283%2C%22transferSize%22%3A4625%7D%5D&mh=1028733043
200 OK 103 B URL GET HTTP/3 go.fxmnba.com/abc.gif?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&language=en&thumbFit=cover&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Ftsyndicate.com%2F&i=0&ib=0&filtersMatch=0&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1275%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A765%2C%22duration%22%3A287%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A765%2C%22duration%22%3A283%2C%22transferSize%22%3A4625%7D%5D&mh=1028733043
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash 8c99886486b9a004383cb4df29011c43
d79ca4754481fc59598bc08fcdf354900918bffe
bda00b0f6892b1c6991e793b42654ad1807694e2ffabcbc4eb1399379737ef6c
GET /abc.gif?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&language=en&thumbFit=cover&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Ftsyndicate.com%2F&i=0&ib=0&filtersMatch=0&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1275%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A765%2C%22duration%22%3A287%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A765%2C%22duration%22%3A283%2C%22transferSize%22%3A4625%7D%5D&mh=1028733043 HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.fxmnba.com/
Cookie: __cflb=02DiuDFRFiBZBvMSLtr4jPouUtFUmSRgcNyzPQWW6gjuE
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/gif
content-length: 103
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd774539e8b500-OSL
alt-svc: h3=":443"; ma=86400
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: Uy+BI0f9xi3njNOl7P4PsULkPp0g6ssxBGHnYb4mQe+eet3x2+C470ZEAYzLvRraWhXf8LMEGWU=
x-amz-request-id: WWWZDEMQD0DJ51HX
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.bbrdbr.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5133
expires: Tue, 28 Nov 2023 01:29:18 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77455a6a56a4-OSL
alt-svc: h3=":443"; ma=86400
chartersettlingtense.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSTYgcRRitTlYQFTGSiwdhDh4iZGe7p3t2egwYjDGyGJOYH3KU6qrq2XKru5qq7unZvbgYiDnJBC8ee9%2FsZjGGYLwHZNaLLCjpiGEPrmfPQi5eZGYHRr9Dfa%2FqfQXvvarbW8UhcVHQgysf6w2pFF1qN93GqZsy5bq0jUvXG57bdM80bsp0OTjTGEwW03%2FHc9tN9%2B3Gh4Kt6aWW67mu53qNC9KIWA%2BWpixk9qDrNbtuM2g1vXaAgfn%2F3hYOLHXA%2B4fkdUhev7D68yNINkaafH9e2LVcZ6c%2FSApFc23Q57s30rVUlymSOYyNgzjdnU1D25qQb45Bp7szB9D97YkDRLImzjMPUbo7k4mov3OkNFIQKSL%2BMsr%2BGEKNIekYTN%2BC5E8IwDguXUaa3LukTUnXj1g6YWuy8PxvyLImC3%2BcRJo8PKfkoHFNqyKXOrUYxBXkYAzZGyMr9pBvOJDlHlj%2BBST%2FhSw9v4g02b5slYbkB2%2B53dBrdf3OYieI%2BWLgd4PFbhCHi8Lz3HbIWoHfWZ5GJOUYMh5DiSGoPY7COiikgyJ2UGQOEn7QoO1u7LqdOIp9PwwYY77PWDtc5m3uB2HsomATD0Pk2RBMDcHMJjKziTV59wm5D1P8CLtawfIF2Lwmziefo88rlIKgtAQlJSglQZkTlP1qhyvbstU9rmwRebPemnW%2FGum8t0V3dN4TKdnKDsmJaX7%2FfPkr1sRBg3aiOOwEod%2Fmobsch2FbuH47WqYs8mNXRLCygrTHQK2DDVmTk%2B%2F%2BiUzW5NjpASK6B6v2wORroMWboOWo03JBV0dB6GIjfbgq0pzKRZn0mkwn4LpCli8gX3e21CF5Y6pkZaEFwfbPPvWnBWYqZKbCZ%2FIngp66M7qqS7J9VZeWPLqc5TKRG3Tyytdymovj9z8S66U2fOW8HX77HpsQE%2FjgurD5RZpymfYs%2Be6c5FyYC9owQR6v2JsiulLY1XOFSYvs4pX3L6wkmRHWSp2OQWVNyFd%2FgcmavPrip9MffOr2DUgzhikqJMU%2BmRWkHoNlm7DZXL%2FVBEbNZ6LMQVlUI9OK5odK1qR54ncosX%2F266evPPvt8Q%2BgUQUr%2FnNxjrfsHfSMA5rfQppU6JsKfVWBqiFscXyUZ2YuIFLOKFLG2Y6UUXePArbyoNH2AhFGYYdxHgnGvU7LD33XbXEedLrC6yK3tRAvnf4XAAD%2F%2FwEAAP%2F%2F9NR5w50EAAA%3D
200 OK 7 B URL GET HTTP/1.1 chartersettlingtense.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSTYgcRRitTlYQFTGSiwdhDh4iZGe7p3t2egwYjDGyGJOYH3KU6qrq2XKru5qq7unZvbgYiDnJBC8ee9%2FsZjGGYLwHZNaLLCjpiGEPrmfPQi5eZGYHRr9Dfa%2FqfQXvvarbW8UhcVHQgysf6w2pFF1qN93GqZsy5bq0jUvXG57bdM80bsp0OTjTGEwW03%2FHc9tN9%2B3Gh4Kt6aWW67mu53qNC9KIWA%2BWpixk9qDrNbtuM2g1vXaAgfn%2F3hYOLHXA%2B4fkdUhev7D68yNINkaafH9e2LVcZ6c%2FSApFc23Q57s30rVUlymSOYyNgzjdnU1D25qQb45Bp7szB9D97YkDRLImzjMPUbo7k4mov3OkNFIQKSL%2BMsr%2BGEKNIekYTN%2BC5E8IwDguXUaa3LukTUnXj1g6YWuy8PxvyLImC3%2BcRJo8PKfkoHFNqyKXOrUYxBXkYAzZGyMr9pBvOJDlHlj%2BBST%2FhSw9v4g02b5slYbkB2%2B53dBrdf3OYieI%2BWLgd4PFbhCHi8Lz3HbIWoHfWZ5GJOUYMh5DiSGoPY7COiikgyJ2UGQOEn7QoO1u7LqdOIp9PwwYY77PWDtc5m3uB2HsomATD0Pk2RBMDcHMJjKziTV59wm5D1P8CLtawfIF2Lwmziefo88rlIKgtAQlJSglQZkTlP1qhyvbstU9rmwRebPemnW%2FGum8t0V3dN4TKdnKDsmJaX7%2FfPkr1sRBg3aiOOwEod%2Fmobsch2FbuH47WqYs8mNXRLCygrTHQK2DDVmTk%2B%2F%2BiUzW5NjpASK6B6v2wORroMWboOWo03JBV0dB6GIjfbgq0pzKRZn0mkwn4LpCli8gX3e21CF5Y6pkZaEFwfbPPvWnBWYqZKbCZ%2FIngp66M7qqS7J9VZeWPLqc5TKRG3Tyytdymovj9z8S66U2fOW8HX77HpsQE%2FjgurD5RZpymfYs%2Be6c5FyYC9owQR6v2JsiulLY1XOFSYvs4pX3L6wkmRHWSp2OQWVNyFd%2FgcmavPrip9MffOr2DUgzhikqJMU%2BmRWkHoNlm7DZXL%2FVBEbNZ6LMQVlUI9OK5odK1qR54ncosX%2F266evPPvt8Q%2BgUQUr%2FnNxjrfsHfSMA5rfQppU6JsKfVWBqiFscXyUZ2YuIFLOKFLG2Y6UUXePArbyoNH2AhFGYYdxHgnGvU7LD33XbXEedLrC6yK3tRAvnf4XAAD%2F%2FwEAAP%2F%2F9NR5w50EAAA%3D
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjectchartersettlingtense.com
FingerprintC8:AA:3E:A8:E5:55:80:AD:BA:7A:90:BE:AD:46:F7:65:87:B7:61:1D
ValidityTue, 07 Nov 2023 07:41:28 GMT - Mon, 05 Feb 2024 07:41:27 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSTYgcRRitTlYQFTGSiwdhDh4iZGe7p3t2egwYjDGyGJOYH3KU6qrq2XKru5qq7unZvbgYiDnJBC8ee9%2FsZjGGYLwHZNaLLCjpiGEPrmfPQi5eZGYHRr9Dfa%2FqfQXvvarbW8UhcVHQgysf6w2pFF1qN93GqZsy5bq0jUvXG57bdM80bsp0OTjTGEwW03%2FHc9tN9%2B3Gh4Kt6aWW67mu53qNC9KIWA%2BWpixk9qDrNbtuM2g1vXaAgfn%2F3hYOLHXA%2B4fkdUhev7D68yNINkaafH9e2LVcZ6c%2FSApFc23Q57s30rVUlymSOYyNgzjdnU1D25qQb45Bp7szB9D97YkDRLImzjMPUbo7k4mov3OkNFIQKSL%2BMsr%2BGEKNIekYTN%2BC5E8IwDguXUaa3LukTUnXj1g6YWuy8PxvyLImC3%2BcRJo8PKfkoHFNqyKXOrUYxBXkYAzZGyMr9pBvOJDlHlj%2BBST%2FhSw9v4g02b5slYbkB2%2B53dBrdf3OYieI%2BWLgd4PFbhCHi8Lz3HbIWoHfWZ5GJOUYMh5DiSGoPY7COiikgyJ2UGQOEn7QoO1u7LqdOIp9PwwYY77PWDtc5m3uB2HsomATD0Pk2RBMDcHMJjKziTV59wm5D1P8CLtawfIF2Lwmziefo88rlIKgtAQlJSglQZkTlP1qhyvbstU9rmwRebPemnW%2FGum8t0V3dN4TKdnKDsmJaX7%2FfPkr1sRBg3aiOOwEod%2Fmobsch2FbuH47WqYs8mNXRLCygrTHQK2DDVmTk%2B%2F%2BiUzW5NjpASK6B6v2wORroMWboOWo03JBV0dB6GIjfbgq0pzKRZn0mkwn4LpCli8gX3e21CF5Y6pkZaEFwfbPPvWnBWYqZKbCZ%2FIngp66M7qqS7J9VZeWPLqc5TKRG3Tyytdymovj9z8S66U2fOW8HX77HpsQE%2FjgurD5RZpymfYs%2Be6c5FyYC9owQR6v2JsiulLY1XOFSYvs4pX3L6wkmRHWSp2OQWVNyFd%2FgcmavPrip9MffOr2DUgzhikqJMU%2BmRWkHoNlm7DZXL%2FVBEbNZ6LMQVlUI9OK5odK1qR54ncosX%2F266evPPvt8Q%2BgUQUr%2FnNxjrfsHfSMA5rfQppU6JsKfVWBqiFscXyUZ2YuIFLOKFLG2Y6UUXePArbyoNH2AhFGYYdxHgnGvU7LD33XbXEedLrC6yK3tRAvnf4XAAD%2F%2FwEAAP%2F%2F9NR5w50EAAA%3D HTTP/1.1
Host: chartersettlingtense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: u_pl=16484303; uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:18 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 18e22013485206c18a9b40cd15767394
Strict-Transport-Security: max-age=0; includeSubdomains
lby2kd27c.com/chicken.gif?z=1863026&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=33iR7giQ4RD6wSUkmfLobB_fXqbD2lgPoJfh41trC5MFtTk0MW84kQ0EG9Ja_W9kzkyrpmTsOrXtsMFO6kFUqCbEm2Iv6JqW_IwhJWv8XtTldi8ndXuQDnwQPKHhX-4N2Z1ljLnOerUB4WzJosz1K_hFR6TVLCW_cHSdAYBKRuy6J_gSguk11UhY4XTvVt3LOGvkZermvRS_XTMwF0Q2NNgh5KXm4y7EcRqmYrzpaBnIYEq_H46gn6LCAzFy0rE66eJGmRRp4XOCD4_Mby3Ykk5gy4UJAJuCYRo_Lxh3eXbEIMF_nytLjZMciLWrjUNkJVm4t_VQ-Tzj_OFMEcBmls1kru2AD1Ear2uHPg8IU3iVrX_5vV6kuI1UbkOQOm1POl1O_fEsdJS32A3-4wX7dmqvT-hzhklAqR8UG6j0gWGbuuC04V1h1tF5ima2YFOPf35uvZpGoUkPfahlgZgdmSnEmbrhSF_BP6KhuucStlG-sDsEXQa_ykXHRGDXk4Msfyr-XHDCZ0EBAF647-AdEgWbciP5IuZTf6P-XGI31Bei34S32UqL9mgFFptuJDg2zos616JrEhFE32sqHXZjOruqrYwuaKx81B88sdSM5eN1SwqbWWpreJbTmp_NyqyGZWeWPrHGgy_8pdCFpr--m6sRBXCkNbZxkxqfe4f3Ww_Z6kWkIXAe4wqcOvrQd8dnACftCqt557pcLb4nbhEvko-B3UbOB_1dcpAIJTKKXQQnOZ-eUJ7KYNqPvpnnKnh-U5o5O0dDOyd-UufqOHTIGgWtXbKk_V1HYdaF9eMakKZQUxbuwbp8VUySBn3VE3ProrwEGy4rDP43-SZ0dYPQqhLqMdE8GPllMiLDB3KBc4Dx8CeGRXdJZHnH8z63p2b81gwCf-q0RyYBQ6ieq6pu4-49j2H_4P6WFrzAKL3DDtP9OGJb-KF-RjaeevyMzqZ0SGwN5RAjKzXzUVxLrEGbIlwAhrCKgOd0-hnT8Gj2LuJz0NlFsBT_8D3gIVcR3n0VBYY=&im=1&freq=1&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=392959613604352&eclog=0&sp=1&im=1&pload=4125
43 B URL lby2kd27c.com/chicken.gif?z=1863026&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=33iR7giQ4RD6wSUkmfLobB_fXqbD2lgPoJfh41trC5MFtTk0MW84kQ0EG9Ja_W9kzkyrpmTsOrXtsMFO6kFUqCbEm2Iv6JqW_IwhJWv8XtTldi8ndXuQDnwQPKHhX-4N2Z1ljLnOerUB4WzJosz1K_hFR6TVLCW_cHSdAYBKRuy6J_gSguk11UhY4XTvVt3LOGvkZermvRS_XTMwF0Q2NNgh5KXm4y7EcRqmYrzpaBnIYEq_H46gn6LCAzFy0rE66eJGmRRp4XOCD4_Mby3Ykk5gy4UJAJuCYRo_Lxh3eXbEIMF_nytLjZMciLWrjUNkJVm4t_VQ-Tzj_OFMEcBmls1kru2AD1Ear2uHPg8IU3iVrX_5vV6kuI1UbkOQOm1POl1O_fEsdJS32A3-4wX7dmqvT-hzhklAqR8UG6j0gWGbuuC04V1h1tF5ima2YFOPf35uvZpGoUkPfahlgZgdmSnEmbrhSF_BP6KhuucStlG-sDsEXQa_ykXHRGDXk4Msfyr-XHDCZ0EBAF647-AdEgWbciP5IuZTf6P-XGI31Bei34S32UqL9mgFFptuJDg2zos616JrEhFE32sqHXZjOruqrYwuaKx81B88sdSM5eN1SwqbWWpreJbTmp_NyqyGZWeWPrHGgy_8pdCFpr--m6sRBXCkNbZxkxqfe4f3Ww_Z6kWkIXAe4wqcOvrQd8dnACftCqt557pcLb4nbhEvko-B3UbOB_1dcpAIJTKKXQQnOZ-eUJ7KYNqPvpnnKnh-U5o5O0dDOyd-UufqOHTIGgWtXbKk_V1HYdaF9eMakKZQUxbuwbp8VUySBn3VE3ProrwEGy4rDP43-SZ0dYPQqhLqMdE8GPllMiLDB3KBc4Dx8CeGRXdJZHnH8z63p2b81gwCf-q0RyYBQ6ieq6pu4-49j2H_4P6WFrzAKL3DDtP9OGJb-KF-RjaeevyMzqZ0SGwN5RAjKzXzUVxLrEGbIlwAhrCKgOd0-hnT8Gj2LuJz0NlFsBT_8D3gIVcR3n0VBYY=&im=1&freq=1&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=392959613604352&eclog=0&sp=1&im=1&pload=4125
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
GET /chicken.gif?z=1863026&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=33iR7giQ4RD6wSUkmfLobB_fXqbD2lgPoJfh41trC5MFtTk0MW84kQ0EG9Ja_W9kzkyrpmTsOrXtsMFO6kFUqCbEm2Iv6JqW_IwhJWv8XtTldi8ndXuQDnwQPKHhX-4N2Z1ljLnOerUB4WzJosz1K_hFR6TVLCW_cHSdAYBKRuy6J_gSguk11UhY4XTvVt3LOGvkZermvRS_XTMwF0Q2NNgh5KXm4y7EcRqmYrzpaBnIYEq_H46gn6LCAzFy0rE66eJGmRRp4XOCD4_Mby3Ykk5gy4UJAJuCYRo_Lxh3eXbEIMF_nytLjZMciLWrjUNkJVm4t_VQ-Tzj_OFMEcBmls1kru2AD1Ear2uHPg8IU3iVrX_5vV6kuI1UbkOQOm1POl1O_fEsdJS32A3-4wX7dmqvT-hzhklAqR8UG6j0gWGbuuC04V1h1tF5ima2YFOPf35uvZpGoUkPfahlgZgdmSnEmbrhSF_BP6KhuucStlG-sDsEXQa_ykXHRGDXk4Msfyr-XHDCZ0EBAF647-AdEgWbciP5IuZTf6P-XGI31Bei34S32UqL9mgFFptuJDg2zos616JrEhFE32sqHXZjOruqrYwuaKx81B88sdSM5eN1SwqbWWpreJbTmp_NyqyGZWeWPrHGgy_8pdCFpr--m6sRBXCkNbZxkxqfe4f3Ww_Z6kWkIXAe4wqcOvrQd8dnACftCqt557pcLb4nbhEvko-B3UbOB_1dcpAIJTKKXQQnOZ-eUJ7KYNqPvpnnKnh-U5o5O0dDOyd-UufqOHTIGgWtXbKk_V1HYdaF9eMakKZQUxbuwbp8VUySBn3VE3ProrwEGy4rDP43-SZ0dYPQqhLqMdE8GPllMiLDB3KBc4Dx8CeGRXdJZHnH8z63p2b81gwCf-q0RyYBQ6ieq6pu4-49j2H_4P6WFrzAKL3DDtP9OGJb-KF-RjaeevyMzqZ0SGwN5RAjKzXzUVxLrEGbIlwAhrCKgOd0-hnT8Gj2LuJz0NlFsBT_8D3gIVcR3n0VBYY=&im=1&freq=1&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=392959613604352&eclog=0&sp=1&im=1&pload=4125 HTTP/1.1
Host: lby2kd27c.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: CHCK=1; UID=23112716292f5d8548e9954808a9ea053dc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
324 B URL creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 7dc4b59430c5e6bd357fc95b52fa36d5
6b6d88a5bd83c1fea6103706ec9d5db26f3e0747
e23b82a266f7b480a9b04198808f7ecbb63f9d0109930b683fcf26aed908b493
GET /widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid} HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r.trackwilltrk.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: text/html
last-modified: Thu, 23 Nov 2023 14:37:17 GMT
expires: Mon, 27 Nov 2023 21:29:21 GMT
cache-control: max-age=10
strict-transport-security: max-age=15768000
pragma: public
report-to: { "endpoints":[{ "url": "https://go.stripchat.com/report" }], "group": "default", "max_age": 1048576 }
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: HIT
age: 5
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd773c38b85696-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
img.strpst.com/thumbs/1701120510/59028862_webp
8.5 kB URL img.strpst.com/thumbs/1701120510/59028862_webp
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 640x360, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 30544aa5a9c2240e5ceee0a8ccd48851
38ca8d3a9dce746346cb4e87f0d6e944689a79bd
160470c0784fd530be1967c573c9826a6c1948aa859d8a046fe24d96e231b73d
GET /thumbs/1701120510/59028862_webp HTTP/1.1
Host: img.strpst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.fxmnba.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/webp
content-length: 8470
etag: "30544aa5a9c2240e5ceee0a8ccd48851"
last-modified: Mon, 27 Nov 2023 21:27:24 GMT
cache-control: public, max-age=1800, s-maxage=1800
access-control-allow-origin: *
access-control-allow-methods: GET
cf-cache-status: HIT
age: 49
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7745e91756c4-OSL
alt-svc: h3=":443"; ma=86400
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 23 Nov 2023 04:57:34 GMT
expires: Fri, 22 Nov 2024 04:57:34 GMT
cache-control: public, max-age=31536000
age: 405105
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.js
200 OK 80 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (32011), with LF, NEL line terminators
Hash 149fd3a87101adfb731800f02f11e73b
9a9a0f6f14028d913e63fc012a80378a5c4d5896
420332e58487b55b58db2c2edbe69162c5d23170061d16addce87762ef224f4b
GET /widgets/v4/Universal/main.672e6e87c69b0c60653e.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-44bd4"
expires: Mon, 27 Nov 2023 21:29:16 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 7
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7742bb94b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
creative.bbrdbr.com/widgets/v4/Universal/lang/en.json
200 OK 197 B URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/lang/en.json
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash 69a54638b649d7ce4748bd42c4b6dade
a2dfe9f8791952fbc5cc44d4757b031a6cee1731
0c25fbbff92c994866041b57d519aa22aa84d55b6b31bcf681dd5b74668cb750
GET /widgets/v4/Universal/lang/en.json HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/json
last-modified: Thu, 23 Nov 2023 14:37:17 GMT
etag: W/"655f639d-ac"
expires: Mon, 27 Nov 2023 21:29:17 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 4
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77455e66b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
pxl.tsyndicate.com/api/v1/elapsedtime?f=banner%20300x250&sc=449e4fe3501746fda88f88df1f88ddf7&hn=zh.hentai-img.com&et=587
0 B URL pxl.tsyndicate.com/api/v1/elapsedtime?f=banner%20300x250&sc=449e4fe3501746fda88f88df1f88ddf7&hn=zh.hentai-img.com&et=587
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
Fingerprint20:10:1C:0B:2E:9E:D5:EC:27:D0:14:82:27:FD:B5:EA:CA:D2:11:6E
ValidityThu, 12 Oct 2023 09:07:20 GMT - Wed, 10 Jan 2024 09:07:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/v1/elapsedtime?f=banner%20300x250&sc=449e4fe3501746fda88f88df1f88ddf7&hn=zh.hentai-img.com&et=587 HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:19 GMT
content-length: 0
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
chartersettlingtense.com/pixel/sbs?c=1
0 B URL chartersettlingtense.com/pixel/sbs?c=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: chartersettlingtense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: u_pl=16484303; uid_id2=09812937-74fd-4394-94f8-e11058c24376:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:19 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
www.googletagmanager.com/gtag/js?id=UA-140250734-2
69 kB URL www.googletagmanager.com/gtag/js?id=UA-140250734-2
IP
File type ASCII text, with very long lines (4179)
Hash fdd01d561c440e6ec06ec61feb0a30e4
19016df7f4cdfb32262a61a780c312e57535ddfe
448862b7f2aa9d7e7e7188388b5ac74dec00b067154d8daf0b5811f152abbabd
GET /gtag/js?id=UA-140250734-2 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ads.imagevenue.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:19 GMT
expires: Mon, 27 Nov 2023 21:29:19 GMT
cache-control: private, max-age=900
last-modified: Mon, 27 Nov 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 68715
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lby2kd27c.com/chicken.gif?z=1863026&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=6I6SzgUK9sUmKrm2DXoux3px4M58bbAlBTMqi8HXujPTt56twWa-yp-TDOR1X0dGdpR4yvW0YIUbgGhY3b-Y27-WA6BabJ0S62ICc137-367RfTLvRd-iCjym3Rg2_gvGCCXLMVKEh35Oq6RBZLGX-rZ6EoyIcEUCGdQ-RxLrG7q5NtFidBaOQZZs4y0YCnKrbt11slISJggzczsy_wC8BNOPVTzuufJnVDxERZyMoNF3fAwCNYeiGCtGndqnBtmEnDuibQLWZdZp_abQNoLjebUdSBkDVTgDktvs8zEFzEgACyBFqOhzGXbnw9ZQZeXREyox1LUIkZAgZqrS35s_cY4pMBvmidnGfbCzVoZ7X5wa6ncUPgLGLjyFVc0SXO7SvKEIOZSeGixhNJfygjQgKgaI6N4WQVAWubnWM5kUsHUQSvoVUI-PCc1wQSN4Mni2nolCq9rsGxDKTLGhkWoxImOlQK3qAr2dkGlfoIMWdhsgoXt6zeTfDqVCfllEe1OUIEjaFZpPfQhmrnRU3kmz7Sq27NnbSGhr7TTamZ5mPXTfpoHFqADm4cc68mjwHtwS4aYP0EwK0htoIDpRtah-9FuQjVHG_1LakUkUkctiRluHA8-KvaV8gRmKP9OCJyxAmQN4pXbXH-whzDCrwxQFhY91CF44GNqIj99hBx01z9eZB5WGRt6Yl9r_eQloBGiVYmLamvzVGxIWOPCXRu1LzMst4zvmXfgPH9w-eHmUjTXqN0ko0ZE2VJhKrv2gCBdOCVW-G0Tu92WsmxAY0YNIEdSvnaV4uldMT_3XTI2wNroSs6OBpB3_eqBNYhUyiL2QwiA0xH02csCFTnRkcbmCFSxE4OrvVSwA7iYilYBBYdvjvQzReP1i4leKYxXgCjQg3EmwbQjeJ0VFP49Uq-Wejxz-05YlobPZttBpnzEKuQ0ZaQK_URC4u58dupf9ycmtpVbe8t_zWp1CxyXvKkCMRZAIlfhUQI1udrFRqFTCFuBRKUi0-RF13EXTMYMVtfh79w=&im=1&freq=1&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=7429834031419904&eclog=0&sp=1&im=1&pload=4231
43 B URL lby2kd27c.com/chicken.gif?z=1863026&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=6I6SzgUK9sUmKrm2DXoux3px4M58bbAlBTMqi8HXujPTt56twWa-yp-TDOR1X0dGdpR4yvW0YIUbgGhY3b-Y27-WA6BabJ0S62ICc137-367RfTLvRd-iCjym3Rg2_gvGCCXLMVKEh35Oq6RBZLGX-rZ6EoyIcEUCGdQ-RxLrG7q5NtFidBaOQZZs4y0YCnKrbt11slISJggzczsy_wC8BNOPVTzuufJnVDxERZyMoNF3fAwCNYeiGCtGndqnBtmEnDuibQLWZdZp_abQNoLjebUdSBkDVTgDktvs8zEFzEgACyBFqOhzGXbnw9ZQZeXREyox1LUIkZAgZqrS35s_cY4pMBvmidnGfbCzVoZ7X5wa6ncUPgLGLjyFVc0SXO7SvKEIOZSeGixhNJfygjQgKgaI6N4WQVAWubnWM5kUsHUQSvoVUI-PCc1wQSN4Mni2nolCq9rsGxDKTLGhkWoxImOlQK3qAr2dkGlfoIMWdhsgoXt6zeTfDqVCfllEe1OUIEjaFZpPfQhmrnRU3kmz7Sq27NnbSGhr7TTamZ5mPXTfpoHFqADm4cc68mjwHtwS4aYP0EwK0htoIDpRtah-9FuQjVHG_1LakUkUkctiRluHA8-KvaV8gRmKP9OCJyxAmQN4pXbXH-whzDCrwxQFhY91CF44GNqIj99hBx01z9eZB5WGRt6Yl9r_eQloBGiVYmLamvzVGxIWOPCXRu1LzMst4zvmXfgPH9w-eHmUjTXqN0ko0ZE2VJhKrv2gCBdOCVW-G0Tu92WsmxAY0YNIEdSvnaV4uldMT_3XTI2wNroSs6OBpB3_eqBNYhUyiL2QwiA0xH02csCFTnRkcbmCFSxE4OrvVSwA7iYilYBBYdvjvQzReP1i4leKYxXgCjQg3EmwbQjeJ0VFP49Uq-Wejxz-05YlobPZttBpnzEKuQ0ZaQK_URC4u58dupf9ycmtpVbe8t_zWp1CxyXvKkCMRZAIlfhUQI1udrFRqFTCFuBRKUi0-RF13EXTMYMVtfh79w=&im=1&freq=1&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=7429834031419904&eclog=0&sp=1&im=1&pload=4231
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
GET /chicken.gif?z=1863026&pb=d64bc3b7ad815a9d4158365b4ee43ebf1701127754&psp=6I6SzgUK9sUmKrm2DXoux3px4M58bbAlBTMqi8HXujPTt56twWa-yp-TDOR1X0dGdpR4yvW0YIUbgGhY3b-Y27-WA6BabJ0S62ICc137-367RfTLvRd-iCjym3Rg2_gvGCCXLMVKEh35Oq6RBZLGX-rZ6EoyIcEUCGdQ-RxLrG7q5NtFidBaOQZZs4y0YCnKrbt11slISJggzczsy_wC8BNOPVTzuufJnVDxERZyMoNF3fAwCNYeiGCtGndqnBtmEnDuibQLWZdZp_abQNoLjebUdSBkDVTgDktvs8zEFzEgACyBFqOhzGXbnw9ZQZeXREyox1LUIkZAgZqrS35s_cY4pMBvmidnGfbCzVoZ7X5wa6ncUPgLGLjyFVc0SXO7SvKEIOZSeGixhNJfygjQgKgaI6N4WQVAWubnWM5kUsHUQSvoVUI-PCc1wQSN4Mni2nolCq9rsGxDKTLGhkWoxImOlQK3qAr2dkGlfoIMWdhsgoXt6zeTfDqVCfllEe1OUIEjaFZpPfQhmrnRU3kmz7Sq27NnbSGhr7TTamZ5mPXTfpoHFqADm4cc68mjwHtwS4aYP0EwK0htoIDpRtah-9FuQjVHG_1LakUkUkctiRluHA8-KvaV8gRmKP9OCJyxAmQN4pXbXH-whzDCrwxQFhY91CF44GNqIj99hBx01z9eZB5WGRt6Yl9r_eQloBGiVYmLamvzVGxIWOPCXRu1LzMst4zvmXfgPH9w-eHmUjTXqN0ko0ZE2VJhKrv2gCBdOCVW-G0Tu92WsmxAY0YNIEdSvnaV4uldMT_3XTI2wNroSs6OBpB3_eqBNYhUyiL2QwiA0xH02csCFTnRkcbmCFSxE4OrvVSwA7iYilYBBYdvjvQzReP1i4leKYxXgCjQg3EmwbQjeJ0VFP49Uq-Wejxz-05YlobPZttBpnzEKuQ0ZaQK_URC4u58dupf9ycmtpVbe8t_zWp1CxyXvKkCMRZAIlfhUQI1udrFRqFTCFuBRKUi0-RF13EXTMYMVtfh79w=&im=1&freq=1&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=7429834031419904&eclog=0&sp=1&im=1&pload=4231 HTTP/1.1
Host: lby2kd27c.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: CHCK=1; UID=23112716292f5d8548e9954808a9ea053dc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-EB0XLE583X
200 OK 93 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-EB0XLE583X
IP
Requested by https://collectionofbestporn.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash fc5f790e978ad47aea265241a7d53d02
154b234704366229295d997d07fb07a31e4538bf
72564b986058334f4f2ac0bffcf79b03d7b8e6078118dbf314a7cf6d2d932a48
GET /gtag/js?id=G-EB0XLE583X HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://collectionofbestporn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:19 GMT
expires: Mon, 27 Nov 2023 21:29:19 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 93443
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
go.fxmnba.com/app/domain-checker/check-result
204 No Content 0 B URL POST HTTP/3 go.fxmnba.com/app/domain-checker/check-result
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 174
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:19 GMT
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrs3hJVdo5HtfaGejxJ8WZvH4VJc; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd77479c1eb500-OSL
alt-svc: h3=":443"; ma=86400
ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js
30 kB URL ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js
IP
File type ASCII text, with very long lines (32025)
Hash 4a356126b9573eb7bd1e9a7494737410
8258d046f17dd3c15a5d3984e1868b7b5d1db329
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
GET /ajax/libs/jquery/2.1.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ads.imagevenue.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29725
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 23 Nov 2023 04:48:28 GMT
expires: Fri, 22 Nov 2024 04:48:28 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 405651
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
stripchat.global/checkUrl
15 B URL stripchat.global/checkUrl
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7fb97eb7c8636552ad068f6d56b5ea34
b69679936779fb02503bc0fe1374a737cc762ecb
e78008828abaa93c4462e326ef384dcda1443352a0f24bdeedada6a6fdbfd1d5
GET /checkUrl HTTP/1.1
Host: stripchat.global
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
content-length: 15
access-control-allow-origin: https://creative.fxmnba.com
cf-cache-status: DYNAMIC
set-cookie: __cflb=04dToajuB2cYa95JPJmk1yQQMjYKLnwYTJ3rUUPqv4; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7747ed77712b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
code.jquery.com/jquery-1.12.4.min.js
200 OK 34 kB URL GET HTTP/2 code.jquery.com/jquery-1.12.4.min.js
IP
Requested by https://collectionofbestporn.com/
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File type ASCII text, with very long lines (32077)
Hash 4f252523d4af0b478c810c2547a63e19
5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
GET /jquery-1.12.4.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://collectionofbestporn.com
DNT: 1
Connection: keep-alive
Referer: https://collectionofbestporn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-17b8b"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Mon, 27 Nov 2023 21:29:19 GMT
age: 6319953
x-served-by: cache-lga21956-LGA, cache-bma1682-BMA
x-cache: HIT, HIT
x-cache-hits: 232, 122888
x-timer: S1701120559.380584,VS0,VE0
vary: Accept-Encoding
content-length: 33738
X-Firefox-Spdy: h2
img.strpst.com/thumbs/1701120510/121357251_webp
5.7 kB URL img.strpst.com/thumbs/1701120510/121357251_webp
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 270x360, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 38e829799c52311ddfccf3df5931d999
4432430a8eff720b02db7dbc93557b28458fa9ad
76222c753c298c1ca4f49c522ad3050d5d58b13884767b74b4041a0385b0c192
GET /thumbs/1701120510/121357251_webp HTTP/1.1
Host: img.strpst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/webp
content-length: 5738
etag: "38e829799c52311ddfccf3df5931d999"
last-modified: Mon, 27 Nov 2023 21:27:27 GMT
cache-control: public, max-age=1800, s-maxage=1800
access-control-allow-origin: *
access-control-allow-methods: GET
cf-cache-status: HIT
age: 49
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7748dc5b56c4-OSL
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/api/models?tag=girls&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1
200 OK 162 kB URL GET HTTP/3 go.bbrdbr.com/api/models?tag=girls&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text, with very long lines (1706), with no line terminators
Size 162 kB (162068 bytes)
Hash 086165d0b1399a33d03c7fe474524e77
d02ee7c21f8ec0b786f80804f0570833e2fdaa77
6193756ced2e67f9206140acce16fae67da2fa9b081fc883c982bb41d9adcf83
GET /api/models?tag=girls&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:24:14 GMT
cf-cache-status: EXPIRED
set-cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7747b986b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
poweredby.jads.co/adshow.php?adzone=681607
200 OK 1.7 kB URL GET HTTP/1.1 poweredby.jads.co/adshow.php?adzone=681607
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerSectigo Limited
Subject*.jads.co
Fingerprint9E:B2:20:AC:19:4B:72:8F:12:D9:D6:5A:6A:B5:BE:EE:46:13:48:EB
ValidityMon, 26 Dec 2022 00:00:00 GMT - Fri, 26 Jan 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (412), with CRLF, LF line terminators
Hash 8b9e636df8439d23b769aabea97960ad
eea331fc90250b47626d6e81ce36c71efc367886
1c8f114619a3fbc0db78b7afd28b512ab89ef82710b2e3ac812843fa2464fa32
GET /adshow.php?adzone=681607 HTTP/1.1
Host: poweredby.jads.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 27 Nov 2023 21:29:19 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=1545af51060e34967c70483f92083b97; expires=Tue, 26-Nov-2024 21:29:14 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.jads.co
imps32597=1; expires=Tue, 28-Nov-2023 21:29:19 GMT; Max-Age=86400; path=/; SameSite=None; Secure; domain=.jads.co
juicy_data_1=YToxOntpOjc2NzAxMDtpOjE3MDEzNzk3NTQ7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259195; path=/; SameSite=None; Secure; domain=jads.co
juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Thu, 30-Nov-2023 21:29:14 GMT; Max-Age=259195; path=/; SameSite=None; Secure; domain=jads.co
Content-Encoding: gzip
go.bbrdbr.com/abc.gif?sourceId=300cps2asgirl&creativeId=300cps2asgirl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1544%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1082%2C%22duration%22%3A266%2C%22transferSize%22%3A80725%7D%5D&mh=-1589949085
103 B URL go.bbrdbr.com/abc.gif?sourceId=300cps2asgirl&creativeId=300cps2asgirl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1544%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1082%2C%22duration%22%3A266%2C%22transferSize%22%3A80725%7D%5D&mh=-1589949085
IP
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash 8c99886486b9a004383cb4df29011c43
d79ca4754481fc59598bc08fcdf354900918bffe
bda00b0f6892b1c6991e793b42654ad1807694e2ffabcbc4eb1399379737ef6c
GET /abc.gif?sourceId=300cps2asgirl&creativeId=300cps2asgirl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1544%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1082%2C%22duration%22%3A266%2C%22transferSize%22%3A80725%7D%5D&mh=-1589949085 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/gif
content-length: 103
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd77490b79b4f3-OSL
alt-svc: h3=":443"; ma=86400
img.strpst.com/thumbs/1701120510/77154776_webp
200 OK 3.6 kB URL GET HTTP/3 img.strpst.com/thumbs/1701120510/77154776_webp
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectimg.strpst.com
FingerprintED:62:74:FE:E4:F5:89:43:B3:49:55:FE:18:19:0D:29:24:96:75:BC
ValidityMon, 03 Apr 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 270x360, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 2e313e6456946316c6ffca1ea2a7ce54
8628a864e85b73423fb17f8d4014cfa9d4e21acf
f45e4e70006ac5b2b017020bd88f19d42a7883edaffb5893597d7617517661c6
GET /thumbs/1701120510/77154776_webp HTTP/1.1
Host: img.strpst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/webp
content-length: 3558
etag: "2e313e6456946316c6ffca1ea2a7ce54"
last-modified: Mon, 27 Nov 2023 21:27:51 GMT
cache-control: public, max-age=1800, s-maxage=1800
access-control-allow-origin: *
access-control-allow-methods: GET
cf-cache-status: HIT
age: 53
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77498d7c56c4-OSL
alt-svc: h3=":443"; ma=86400
img.strpst.com/thumbs/1701120510/77154776_webp
200 OK 3.6 kB URL GET HTTP/3 img.strpst.com/thumbs/1701120510/77154776_webp
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectimg.strpst.com
FingerprintED:62:74:FE:E4:F5:89:43:B3:49:55:FE:18:19:0D:29:24:96:75:BC
ValidityMon, 03 Apr 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 270x360, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 2e313e6456946316c6ffca1ea2a7ce54
8628a864e85b73423fb17f8d4014cfa9d4e21acf
f45e4e70006ac5b2b017020bd88f19d42a7883edaffb5893597d7617517661c6
GET /thumbs/1701120510/77154776_webp HTTP/1.1
Host: img.strpst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/webp
content-length: 3558
etag: "2e313e6456946316c6ffca1ea2a7ce54"
last-modified: Mon, 27 Nov 2023 21:27:51 GMT
cache-control: public, max-age=1800, s-maxage=1800
access-control-allow-origin: *
access-control-allow-methods: GET
cf-cache-status: HIT
age: 53
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77499d8f56c4-OSL
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1585%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1134%2C%22duration%22%3A259%2C%22transferSize%22%3A4625%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1135%2C%22duration%22%3A269%2C%22transferSize%22%3A80725%7D%5D&mh=-1845257871
103 B URL go.bbrdbr.com/abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1585%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1134%2C%22duration%22%3A259%2C%22transferSize%22%3A4625%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1135%2C%22duration%22%3A269%2C%22transferSize%22%3A80725%7D%5D&mh=-1845257871
IP
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash 8c99886486b9a004383cb4df29011c43
d79ca4754481fc59598bc08fcdf354900918bffe
bda00b0f6892b1c6991e793b42654ad1807694e2ffabcbc4eb1399379737ef6c
GET /abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1585%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1134%2C%22duration%22%3A259%2C%22transferSize%22%3A4625%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1135%2C%22duration%22%3A269%2C%22transferSize%22%3A80725%7D%5D&mh=-1845257871 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/gif
content-length: 103
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd77498c0ab4f3-OSL
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/app/domain-checker/check-result
204 No Content 0 B URL POST HTTP/3 go.fxmnba.com/app/domain-checker/check-result
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 174
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:19 GMT
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtr56YkGQJnK1T6jZPUKTzUVyP5yN; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd77498e15b500-OSL
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1639%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1120%2C%22duration%22%3A239%2C%22transferSize%22%3A80725%7D%5D&mh=1530945595
200 OK 103 B URL GET HTTP/3 go.bbrdbr.com/abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1639%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1120%2C%22duration%22%3A239%2C%22transferSize%22%3A80725%7D%5D&mh=1530945595
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash 8c99886486b9a004383cb4df29011c43
d79ca4754481fc59598bc08fcdf354900918bffe
bda00b0f6892b1c6991e793b42654ad1807694e2ffabcbc4eb1399379737ef6c
GET /abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A1639%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A1120%2C%22duration%22%3A239%2C%22transferSize%22%3A80725%7D%5D&mh=1530945595 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: image/gif
content-length: 103
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd7749dc98b4f3-OSL
alt-svc: h3=":443"; ma=86400
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: Uy+BI0f9xi3njNOl7P4PsULkPp0g6ssxBGHnYb4mQe+eet3x2+C470ZEAYzLvRraWhXf8LMEGWU=
x-amz-request-id: WWWZDEMQD0DJ51HX
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.bbrdbr.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5134
expires: Tue, 28 Nov 2023 01:29:19 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774a3bb056a4-OSL
alt-svc: h3=":443"; ma=86400
cdn.zblkqa.com/checkUrl
200 OK 15 B IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerSectigo Limited
Subject*.zblkqa.com
Fingerprint78:E7:B2:86:25:92:88:24:6D:8D:51:1E:AC:78:AC:9C:F3:91:E1:EA
ValidityTue, 17 Oct 2023 00:00:00 GMT - Sat, 16 Nov 2024 23:59:59 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 7fb97eb7c8636552ad068f6d56b5ea34
b69679936779fb02503bc0fe1374a737cc762ecb
e78008828abaa93c4462e326ef384dcda1443352a0f24bdeedada6a6fdbfd1d5
GET /checkUrl HTTP/1.1
Host: cdn.zblkqa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: text/plain
content-length: 15
access-control-allow-origin: *
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 81cbc549488fb8b2-AMS
alt-svc: h3=":443"; ma=86400
age: 2702131
accept-ranges: bytes
X-Firefox-Spdy: h2
xhlive.cam/checkUrl
15 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7fb97eb7c8636552ad068f6d56b5ea34
b69679936779fb02503bc0fe1374a737cc762ecb
e78008828abaa93c4462e326ef384dcda1443352a0f24bdeedada6a6fdbfd1d5
GET /checkUrl HTTP/1.1
Host: xhlive.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
content-length: 15
access-control-allow-origin: https://creative.bbrdbr.com
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuGyDLPvii6XBe577FFREDmAeDkJWyy8Ke8WYUX3Q8; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774a7b0fb51e-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
xlivesex.com/checkUrl
15 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7fb97eb7c8636552ad068f6d56b5ea34
b69679936779fb02503bc0fe1374a737cc762ecb
e78008828abaa93c4462e326ef384dcda1443352a0f24bdeedada6a6fdbfd1d5
GET /checkUrl HTTP/1.1
Host: xlivesex.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
content-length: 15
access-control-allow-origin: https://creative.bbrdbr.com
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuFLvK1H1SdXppSyYHZ3tS1ah8iSYLTqZ4xJtX86b6; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 20:29:19 GMT; HttpOnly
_cfuvid=51q69TpQUYIU4Z.q2TgYathxKfOx8VmMMlnjHmkBXJk-1701120559804-0-604800000; path=/; domain=.xlivesex.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 82cd774a7c5bb515-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.css
200 OK 889 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/main.672e6e87c69b0c60653e.css
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with very long lines (13396), with no line terminators
Size 889 kB (888796 bytes)
Hash d55b785d72863fbb8425a36b7d675ec2
546cda15b6fb2a67ce1f102dc82eefb6f749f9c3
a4d09f6a50b6d96e7f22ab12f406dcf44be0d815105018cc5c7f1105fbf597f7
GET /widgets/v4/Universal/main.672e6e87c69b0c60653e.css HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: text/css
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-3454"
expires: Mon, 27 Nov 2023 21:29:16 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 10
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77483a4ab4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/app/domain-checker/check-result
204 No Content 0 B URL POST HTTP/3 go.bbrdbr.com/app/domain-checker/check-result
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 174
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:19 GMT
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtr4j9PoyecweyjPhCfdnJmmxGUZr; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774baf26b4f3-OSL
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/event/ml
200 OK 125 B IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash 6dbf7ea4f31dbe2b1f7e43982cd0b874
39d2234324df03fcee28f02db3f316d1e45a243f
4aaa72e51cceb5bdd08e8b9f5dca256b8704502ee7bb1fd2a429fa02b232d19a
POST /event/ml HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 172
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=0H28upDCGznfDm9XVDQgYY38nUsBbmd1yxagTKNW8TE; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd77477bf0b500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/app/domain-checker/check-result
204 No Content 0 B URL POST HTTP/3 go.bbrdbr.com/app/domain-checker/check-result
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 173
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:19 GMT
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774bbf41b4f3-OSL
alt-svc: h3=":443"; ma=86400
img.strpst.com/thumbs/1701120510/77154776_webp
200 OK 3.6 kB URL GET HTTP/3 img.strpst.com/thumbs/1701120510/77154776_webp
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectimg.strpst.com
FingerprintED:62:74:FE:E4:F5:89:43:B3:49:55:FE:18:19:0D:29:24:96:75:BC
ValidityMon, 03 Apr 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 270x360, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 2e313e6456946316c6ffca1ea2a7ce54
8628a864e85b73423fb17f8d4014cfa9d4e21acf
f45e4e70006ac5b2b017020bd88f19d42a7883edaffb5893597d7617517661c6
GET /thumbs/1701120510/77154776_webp HTTP/1.1
Host: img.strpst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: image/webp
content-length: 3558
etag: "2e313e6456946316c6ffca1ea2a7ce54"
last-modified: Mon, 27 Nov 2023 21:27:51 GMT
cache-control: public, max-age=1800, s-maxage=1800
access-control-allow-origin: *
access-control-allow-methods: GET
cf-cache-status: HIT
age: 54
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774c085e56c4-OSL
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A486%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A197%2C%22duration%22%3A77%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A197%2C%22duration%22%3A77%2C%22transferSize%22%3A4626%7D%5D&mh=1693434423
103 B URL go.bbrdbr.com/abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A486%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A197%2C%22duration%22%3A77%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A197%2C%22duration%22%3A77%2C%22transferSize%22%3A4626%7D%5D&mh=1693434423
IP
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash 8c99886486b9a004383cb4df29011c43
d79ca4754481fc59598bc08fcdf354900918bffe
bda00b0f6892b1c6991e793b42654ad1807694e2ffabcbc4eb1399379737ef6c
GET /abc.gif?sourceId=300cps2girlwl&creativeId=300cps2girlwl&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&action=sbSignupWithModel&modelsLimit=1&actionButtonPlacement=bottom&thumbSizeKey=big&hideButtonOnSmallSpots=1&hideTitleOnSmallSpots=1&hideModelNameOnSmallSpots=1&buttonColor=%23DC0C2C&liveBadgeColor=%2300bd8f&language=en&thumbFit=cover&quality=original&stripcashR=0&thumbType=default&kbLimit=0&modelsInWatchHistoryCount=-1&modelsInFavoritesCount=-1&userType=newuser&modelsCount=1&segment=hls-newAPI&landing=WidgetV4Universal&referrer=https%3A%2F%2Fr.trackwilltrk.com%2F&i=0&ib=0&filtersMatch=1&m=%5B%7B%22type%22%3A%22navigation%22%2C%22startTime%22%3A0%2C%22duration%22%3A486%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A197%2C%22duration%22%3A77%2C%22transferSize%22%3A80725%7D%2C%7B%22type%22%3A%22resource%22%2C%22startTime%22%3A197%2C%22duration%22%3A77%2C%22transferSize%22%3A4626%7D%5D&mh=1693434423 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: image/gif
content-length: 103
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82cd774c1fbab4f3-OSL
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/api/models?tag=girls&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1
200 OK 759 B URL GET HTTP/3 go.bbrdbr.com/api/models?tag=girls&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text, with very long lines (1706), with no line terminators
Hash 086165d0b1399a33d03c7fe474524e77
d02ee7c21f8ec0b786f80804f0570833e2fdaa77
6193756ced2e67f9206140acce16fae67da2fa9b081fc883c982bb41d9adcf83
GET /api/models?tag=girls&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Cookie: __cflb=0H28upDCGznfDm9XVD3SofQ5NjJpXSe6Hm2urQULqJc
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:24:14 GMT
cf-cache-status: HIT
age: 0
server: cloudflare
cf-ray: 82cd774b7ef4b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/app/domain-checker/get-check
200 OK 376 B URL GET HTTP/3 go.bbrdbr.com/app/domain-checker/get-check
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash a4bc2f8238ca466df16377ada2df6df2
58b03a4b4aa43f9f93a0921b3c300d99fadf482a
3797754d1eede856cf259907231e3d601e2bceecd10da53041b772868bd57d2e
GET /app/domain-checker/get-check HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrt9a1bWqoF8S1xZuN666z6yANda; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7747c9b5b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/app/domain-checker/check-result
204 No Content 0 B URL POST HTTP/3 go.bbrdbr.com/app/domain-checker/check-result
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 173
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:20 GMT
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrt9a1bWqoF8S1xZv6ucJYkbS37z; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:20 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774e3aa9b4f3-OSL
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_init_Sgko0GII6JC6IwvO.mp4
200 OK 1.2 kB URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_init_Sgko0GII6JC6IwvO.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
File type ISO Media, MP4 Base Media v5 \012- data
Hash 98d2e04da508ad29d3a9bcd8c3853d76
b946d289e1dd9a3da41363ee6269cc9ebee966e3
f18560a67880487cc1d4ebefda6cdf0faaba470a9dcd8e03d76d284aaaccd36a
GET /hls/77154776/77154776_480p_init_Sgko0GII6JC6IwvO.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 1217
last-modified: Mon, 27 Nov 2023 20:47:38 GMT
etag: "6565006a-4c1"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 50
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774e6d9256a5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
go.bbrdbr.com/thumbs/view
200 OK 1.4 kB URL POST HTTP/3 go.bbrdbr.com/thumbs/view
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash bfe363acc6ae8191db9b9689e66fbd1a
ddf6ab321831dc6bcf4b126bfffc75316d6bd7de
e622ca647c2f830572bbef2bbdba6a219a8f1988918fc9c755dd1d3507c6303f
POST /thumbs/view HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 86
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrs3hJVdo5HtfaGekh7ei8ZuL9o2; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:20 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774ce8d8b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
b-hls-18.doppiocdn.com/hls/121357251/121357251_240p_init_MV7nXYVRJfrx9DQo.mp4
200 OK 1.2 kB URL GET HTTP/2 b-hls-18.doppiocdn.com/hls/121357251/121357251_240p_init_MV7nXYVRJfrx9DQo.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
File type ISO Media, MP4 Base Media v5 \012- data
Hash 1a78c1b13dca86cd7831e4c715f1aa16
c062a25038267a142fd568fa2c14d3dd2fdb2648
e72012e4788e88a85dd7125625416011cd260dbb900eed2f729e2c8e32dadd30
GET /hls/121357251/121357251_240p_init_MV7nXYVRJfrx9DQo.mp4 HTTP/1.1
Host: b-hls-18.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 1217
last-modified: Mon, 27 Nov 2023 21:03:45 GMT
etag: "65650431-4c1"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 45
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774e8dc956a5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
creative.bbrdbr.com/widgets/v4/Universal/hls.4cfa5b780bfed20a8b26.js
200 OK 502 B URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/hls.4cfa5b780bfed20a8b26.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 22f22b49cc901aa95826401f7ce0930c
6471abdd35ab6d511b67d73ad1375f1ee0f255de
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3
GET /widgets/v4/Universal/hls.4cfa5b780bfed20a8b26.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-3d"
expires: Mon, 27 Nov 2023 21:29:24 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 4
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774a6d74b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4
200 OK 323 kB URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 323 kB (323141 bytes)
Hash 434c7ca71cf726159d00fc02daadf4f0
aa045f6bf9522eeb26394535d90127d37ef030e9
2f1df6fc57b2cacb19e8359221c62cb28b42e985638f2f4fbf01900357e81969
GET /hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 323141
last-modified: Mon, 27 Nov 2023 21:29:14 GMT
etag: "65650a2a-4ee45"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 4
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774f2e7656c6-OSL
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4
200 OK 323 kB URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 323 kB (323141 bytes)
Hash 434c7ca71cf726159d00fc02daadf4f0
aa045f6bf9522eeb26394535d90127d37ef030e9
2f1df6fc57b2cacb19e8359221c62cb28b42e985638f2f4fbf01900357e81969
GET /hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 323141
last-modified: Mon, 27 Nov 2023 21:29:14 GMT
etag: "65650a2a-4ee45"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 4
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774f3e8656c6-OSL
alt-svc: h3=":443"; ma=86400
b-hls-18.doppiocdn.com/hls/121357251/121357251_240p_763_nO2kMq8zS6qkIUNy_1701120551.mp4
200 OK 178 kB URL GET HTTP/3 b-hls-18.doppiocdn.com/hls/121357251/121357251_240p_763_nO2kMq8zS6qkIUNy_1701120551.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 178 kB (178443 bytes)
Hash 698c45afea4afbea4ee610af37918386
d3d7fb4cf47a4d55ac90b32564c5496ac8ffd082
388aefc104b392ae59adfb53eb7063dcae109b4c1cb00cb51eae65f7ca3c69e3
GET /hls/121357251/121357251_240p_763_nO2kMq8zS6qkIUNy_1701120551.mp4 HTTP/1.1
Host: b-hls-18.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 178443
last-modified: Mon, 27 Nov 2023 21:29:13 GMT
etag: "65650a29-2b90b"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 4
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774faf2d56c6-OSL
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4
314 kB URL b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4
IP
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 314 kB (314334 bytes)
Hash 868f97bd8b536f582546389182aa9431
3175c0979d83a1c380395ecc92b8f6563e00b3c4
f8f97076b7177c862c590752bbc3acaf42058df3b65dab474b3fb30f045a4c03
GET /hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 314334
last-modified: Mon, 27 Nov 2023 21:29:16 GMT
etag: "65650a2c-4cbde"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 2
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7750d90d56c6-OSL
alt-svc: h3=":443"; ma=86400
edge-hls.doppiocdn.com/hls/77154776/master/77154776_480p.m3u8
173 kB URL edge-hls.doppiocdn.com/hls/77154776/master/77154776_480p.m3u8
IP
Size 173 kB (173017 bytes)
Hash 3305f3a9def7b60dda5b5f98fc1971ea
5216f9823f10d34987c965ff5d0dea6279939644
5248ec36269684b30e7c441a417ef65cdc7eb2f6f085ffdf15b2582714750de7
GET /hls/77154776/master/77154776_480p.m3u8 HTTP/1.1
Host: edge-hls.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:19 GMT
x-proxy-cache: EXPIRED
cache-control: public, max-age=3, s-maxage=3
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 1
server: cloudflare
cf-ray: 82cd77503fff56c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=e&output=js
0 B URL go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=e&output=js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=e&output=js HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
x-backend-server: nl2-web-200
X-Firefox-Spdy: h2
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4
314 kB URL b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4
IP
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 314 kB (314334 bytes)
Hash 868f97bd8b536f582546389182aa9431
3175c0979d83a1c380395ecc92b8f6563e00b3c4
f8f97076b7177c862c590752bbc3acaf42058df3b65dab474b3fb30f045a4c03
GET /hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 314334
last-modified: Mon, 27 Nov 2023 21:29:16 GMT
etag: "65650a2c-4cbde"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 2
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7750d91456c6-OSL
alt-svc: h3=":443"; ma=86400
creative.bbrdbr.com/widgets/v4/Universal/hls.4cfa5b780bfed20a8b26.js
200 OK 53 B URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/hls.4cfa5b780bfed20a8b26.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 22f22b49cc901aa95826401f7ce0930c
6471abdd35ab6d511b67d73ad1375f1ee0f255de
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3
GET /widgets/v4/Universal/hls.4cfa5b780bfed20a8b26.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-3d"
expires: Mon, 27 Nov 2023 21:29:24 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 5
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774e7af9b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_init_Sgko0GII6JC6IwvO.mp4
200 OK 1.2 kB URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_init_Sgko0GII6JC6IwvO.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
File type ISO Media, MP4 Base Media v5 \012- data
Hash 98d2e04da508ad29d3a9bcd8c3853d76
b946d289e1dd9a3da41363ee6269cc9ebee966e3
f18560a67880487cc1d4ebefda6cdf0faaba470a9dcd8e03d76d284aaaccd36a
GET /hls/77154776/77154776_480p_init_Sgko0GII6JC6IwvO.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: video/mp4
content-length: 1217
last-modified: Mon, 27 Nov 2023 20:47:38 GMT
etag: "6565006a-4c1"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 51
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77524b1556c6-OSL
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4
200 OK 323 kB URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 323 kB (323141 bytes)
Hash 434c7ca71cf726159d00fc02daadf4f0
aa045f6bf9522eeb26394535d90127d37ef030e9
2f1df6fc57b2cacb19e8359221c62cb28b42e985638f2f4fbf01900357e81969
GET /hls/77154776/77154776_480p_1608_yxdhcMbZbKKsW3uD_1701120552.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: video/mp4
content-length: 323141
last-modified: Mon, 27 Nov 2023 21:29:14 GMT
etag: "65650a2a-4ee45"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 5
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77527b3e56c6-OSL
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4
314 kB URL b-hls-01.doppiocdn.com/hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4
IP
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 314 kB (314334 bytes)
Hash 868f97bd8b536f582546389182aa9431
3175c0979d83a1c380395ecc92b8f6563e00b3c4
f8f97076b7177c862c590752bbc3acaf42058df3b65dab474b3fb30f045a4c03
GET /hls/77154776/77154776_480p_1609_deFAoDAVdEc3iMfT_1701120554.mp4 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: video/mp4
content-length: 314334
last-modified: Mon, 27 Nov 2023 21:29:16 GMT
etag: "65650a2c-4cbde"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 3
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77548db156c6-OSL
alt-svc: h3=":443"; ma=86400
creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
200 OK 804 B URL GET HTTP/3 creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
IP
Requested by https://collectionofbestporn.com/
Certificate IssuerGoogle Trust Services LLC
Subjectmnaspm.com
FingerprintD2:26:54:49:EC:5C:B3:8E:40:54:41:6D:0E:21:1C:E8:A8:48:BD:EE
ValidityFri, 20 Oct 2023 15:37:06 GMT - Thu, 18 Jan 2024 15:37:05 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a6b07d1eb77b824381f42141b4a1a41b
ba5943a6f69bd07ab938361763ba1c976a583333
ce28d2c85ff8e35e11c047196015fc97f7c1fd1b9349f8285c2497b83da068ae
GET /LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240 HTTP/1.1
Host: creative.mnaspm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://twinrdsrv.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: text/html
last-modified: Thu, 23 Nov 2023 14:34:33 GMT
expires: Mon, 27 Nov 2023 21:29:26 GMT
cache-control: max-age=10
strict-transport-security: max-age=15768000
pragma: public
report-to: { "endpoints":[{ "url": "https://go.stripchat.com/report" }], "group": "default", "max_age": 1048576 }
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: HIT
age: 1
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7752ae8bb517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
video.ktkjmp.com/adsbygoogle.js
200 OK 16 B URL GET HTTP/3 video.ktkjmp.com/adsbygoogle.js
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectvideo.ktkjmp.com
Fingerprint02:C1:75:9D:DD:6A:66:20:9E:A3:46:1B:5E:A4:87:83:5A:09:92:93
ValiditySun, 02 Jul 2023 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT
Hash 3d7f7a60216d40dea48e495fef6903c9
fecdb5184f55cf012563d78940eb97b10b9cc99b
96d83ac9f20fc0b88404f307f135e212642e02d6ea295c96b28aed0d771a224f
GET /adsbygoogle.js HTTP/1.1
Host: video.ktkjmp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.mnaspm.com/
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: application/javascript
content-length: 16
x-amz-id-2: eOt3YX0Nm2YrsRFghHjY+ldPpZhMsRS8Tg9HXo+sQY2MfQ8piotah5MMqRgsIwcNTLmVbQ2iqoU=
x-amz-request-id: Y49M74J1R1NSP1TJ
last-modified: Thu, 10 Mar 2022 13:52:07 GMT
etag: "3d7f7a60216d40dea48e495fef6903c9"
x-amz-meta-s3cmd-attrs: atime:1646920284/ctime:1646920283/gid:20/gname:staff/md5:3d7f7a60216d40dea48e495fef6903c9/mode:33188/mtime:1646920283/uid:501/uname:mikhailchubar
x-amz-version-id: eIgLIBoMMcsEXtxOH6UDjWyfAquRpkIG
access-control-allow-origin: https://creative.mnaspm.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, x-requested-with
cf-cache-status: HIT
age: 5143
expires: Tue, 28 Nov 2023 01:29:21 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77568e8156a4-OSL
alt-svc: h3=":443"; ma=86400
unseenreport.com/pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=65aa283021630dfd9030555c4c61a78c&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
1 B URL unseenreport.com/pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=65aa283021630dfd9030555c4c61a78c&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
IP
ASN #39572 DataWeb Global Group B.V.
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=65aa283021630dfd9030555c4c61a78c&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:21 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5d918e4e7ec772c0ab053c6ee983b338
Strict-Transport-Security: max-age=0; includeSubdomains
unseenreport.com/pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=a7bf874835d806f885e035b6acb3f0eb&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
1 B URL unseenreport.com/pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=a7bf874835d806f885e035b6acb3f0eb&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
IP
ASN #39572 DataWeb Global Group B.V.
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=a7bf874835d806f885e035b6acb3f0eb&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:21 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 828db8ff9039427d4660166f6b702274
Strict-Transport-Security: max-age=0; includeSubdomains
unseenreport.com/pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=055652d312c99a6037d12337a6a1a7a4&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
1 B URL GET unseenreport.com/pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=055652d312c99a6037d12337a6a1a7a4&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=09812937-74fd-4394-94f8-e11058c24376&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=055652d312c99a6037d12337a6a1a7a4&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 27 Nov 2023 21:29:21 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5b72409d12ae5dce264f9efbf04b8995
Strict-Transport-Security: max-age=0; includeSubdomains
crmpt.livejasmin.com/post/play?ms_rnd=1701120560.31066&pstool=400_31&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&category=girl&origin=twinrdsrv.com
200 OK 17 kB URL GET HTTP/2 crmpt.livejasmin.com/post/play?ms_rnd=1701120560.31066&pstool=400_31&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&category=girl&origin=twinrdsrv.com
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Requested by https://ads.imagevenue.com/
Certificate IssuerLet's Encrypt
Subjectcrmpt.livejasmin.com
Fingerprint94:36:98:3E:6B:F5:EC:61:46:A3:7A:E2:90:5F:85:61:58:F1:57:AA
ValiditySun, 26 Nov 2023 16:01:07 GMT - Sat, 24 Feb 2024 16:01:06 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash 8cb89d730c93ef3909f28b0664ac32e8
684332d8cb94801e7ed81941f2e5a710ec65d0f7
9960967bdb9fce514a698343d27672e58af77f57f3bc1d6be6ec7a0aabaf23c3
GET /post/play?ms_rnd=1701120560.31066&pstool=400_31&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&category=girl&origin=twinrdsrv.com HTTP/1.1
Host: crmpt.livejasmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmentjg.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-ud-id: tNY0M/Tzm
cache-control: no-cache
date: Mon, 27 Nov 2023 21:29:21 GMT
server: unknown
x-cache-status: R-MISS
set-cookie: psui=a59f007fbf3384ccc33cc586d5d348f0; Path=/; Expires=Wed, 27-Dec-23 21:29:21 GMT; SameSite=None; Secure
content-encoding: gzip
X-Firefox-Spdy: h2
creative.bbrdbr.com/widgets/v4/Universal/lang/en.json
200 OK 96 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/lang/en.json
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash 69a54638b649d7ce4748bd42c4b6dade
a2dfe9f8791952fbc5cc44d4757b031a6cee1731
0c25fbbff92c994866041b57d519aa22aa84d55b6b31bcf681dd5b74668cb750
GET /widgets/v4/Universal/lang/en.json HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/json
last-modified: Thu, 23 Nov 2023 14:37:17 GMT
etag: W/"655f639d-ac"
expires: Mon, 27 Nov 2023 21:29:17 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 4
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77458e97b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
edge-hls.doppiocdn.com/hls/77154776/master/77154776_480p.m3u8
1.1 kB URL edge-hls.doppiocdn.com/hls/77154776/master/77154776_480p.m3u8
IP
Hash 3305f3a9def7b60dda5b5f98fc1971ea
5216f9823f10d34987c965ff5d0dea6279939644
5248ec36269684b30e7c441a417ef65cdc7eb2f6f085ffdf15b2582714750de7
GET /hls/77154776/master/77154776_480p.m3u8 HTTP/1.1
Host: edge-hls.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:19 GMT
x-proxy-cache: EXPIRED
cache-control: public, max-age=3, s-maxage=3
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 1
server: cloudflare
cf-ray: 82cd774c0a9d56a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
stripchat.ooo/checkUrl
15 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7fb97eb7c8636552ad068f6d56b5ea34
b69679936779fb02503bc0fe1374a737cc762ecb
e78008828abaa93c4462e326ef384dcda1443352a0f24bdeedada6a6fdbfd1d5
GET /checkUrl HTTP/1.1
Host: stripchat.ooo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.mnaspm.com/
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/json
content-length: 15
access-control-allow-origin: https://creative.mnaspm.com
cf-cache-status: DYNAMIC
set-cookie: __cflb=0H28vf6sQBvhykduxTL3KtyBAnQ2zUYP3hoQYpPgXtg; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:22 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7759c956b51b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
go.mnaspm.com/app/domain-checker/check-result
0 B URL POST go.mnaspm.com/app/domain-checker/check-result
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerGoogle Trust Services LLC
Subjectmnaspm.com
FingerprintD2:26:54:49:EC:5C:B3:8E:40:54:41:6D:0E:21:1C:E8:A8:48:BD:EE
ValidityFri, 20 Oct 2023 15:37:06 GMT - Thu, 18 Jan 2024 15:37:05 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /app/domain-checker/check-result HTTP/1.1
Host: go.mnaspm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.mnaspm.com/
Content-Type: text/plain;charset=UTF-8
Content-Length: 174
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Mon, 27 Nov 2023 21:29:22 GMT
access-control-allow-origin: https://creative.mnaspm.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrth8k2gcTaYMvv6wenTTW2Pt9fJ; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:22 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd775ad8bdb517-OSL
alt-svc: h3=":443"; ma=86400
pt-static1.jsmsat.com/npe/pu/play/css/play-v451014.css
158 kB URL pt-static1.jsmsat.com/npe/pu/play/css/play-v451014.css
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type gzip compressed data, max speed, from Unix\012- data
Size 158 kB (157758 bytes)
Hash 049ef0819607eb52cae0b02132d169e6
c982696ca81fb77685e9415ddd43ac2105b6e25f
0b6979d4895ef3b08f872bd782672a13609f9062bb36e3d606f270429a1a7d6c
GET /npe/pu/play/css/play-v451014.css HTTP/1.1
Host: pt-static1.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: text/css
last-modified: Fri, 24 Nov 2023 16:22:51 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"6560cddb-16f81"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
content-encoding: gzip
X-Firefox-Spdy: h2
pt-static1.jsmsat.com/npe/_common/fonts/awepromotools-v451014.woff
2.0 kB URL pt-static1.jsmsat.com/npe/_common/fonts/awepromotools-v451014.woff
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type Web Open Font Format, TrueType, length 2012, version 0.0\012- data
Hash fa3ce3d548dc5dee1dc96d2fc739f879
6a05a3a6c264d90e9780d20e0ee104401b21b35a
faf04186101fc9c07cae4daafc4fc83d2a0a0298634106b9d4482f81df4632e3
GET /npe/_common/fonts/awepromotools-v451014.woff HTTP/1.1
Host: pt-static1.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://crmpt.livejasmin.com
DNT: 1
Connection: keep-alive
Referer: https://pt-static1.jsmsat.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/font-woff
content-length: 2012
last-modified: Fri, 24 Nov 2023 16:22:50 GMT
etag: "6560cdda-7dc"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
accept-ranges: bytes
X-Firefox-Spdy: h2
pt-static1.jsmsat.com/npe/_common/fonts/roboto_bold-webfont-v451014.woff
90 kB URL pt-static1.jsmsat.com/npe/_common/fonts/roboto_bold-webfont-v451014.woff
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type Web Open Font Format, TrueType, length 89584, version 2.1150\012- data
Hash 5da9ea748f871afd777b452f15c71f2f
65603d39f5473276cbff6bf6f23e984240ec4f68
e485cf8605b5490285c439b818a7123f5855c6a3e831b01046c6dc62718bac88
GET /npe/_common/fonts/roboto_bold-webfont-v451014.woff HTTP/1.1
Host: pt-static1.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://crmpt.livejasmin.com
DNT: 1
Connection: keep-alive
Referer: https://pt-static1.jsmsat.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/font-woff
content-length: 89584
last-modified: Fri, 24 Nov 2023 16:22:50 GMT
etag: "6560cdda-15df0"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
accept-ranges: bytes
X-Firefox-Spdy: h2
pt-static5.jsmsat.com/npe/bonuscredit/bonuscredit-v451014.js
70 kB URL pt-static5.jsmsat.com/npe/bonuscredit/bonuscredit-v451014.js
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type gzip compressed data, max speed, from Unix\012- data
Hash 72fa718a47fd48087473db58ae6c579b
89ac36eacd96f5848538b0a6ae275b1336078fe1
2f270c4853f5462443c9b2a01e74aa1432ae46ed026d4aaeec5540706b2389e0
GET /npe/bonuscredit/bonuscredit-v451014.js HTTP/1.1
Host: pt-static5.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/javascript
last-modified: Fri, 24 Nov 2023 16:22:51 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"6560cddb-63bb"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
content-encoding: gzip
X-Firefox-Spdy: h2
pt-static1.jsmsat.com/npe/image/smilies_ex.png
8.5 kB URL pt-static1.jsmsat.com/npe/image/smilies_ex.png
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type PNG image data, 536 x 138, 8-bit colormap, non-interlaced\012- data
Hash 53fc00ebf44066190d5faea2a7931e7c
21178ac1ffb10f958d26d17a0fe49d5d31a00720
63526a6642f64fadb44cd33d634bb626f8e96af3f850215cfdd78a9c609fc85c
GET /npe/image/smilies_ex.png HTTP/1.1
Host: pt-static1.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: image/png
content-length: 8533
last-modified: Wed, 25 Oct 2023 07:01:55 GMT
etag: "6538bd63-2155"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
accept-ranges: bytes
X-Firefox-Spdy: h2
pt-static4.jsmsat.com/npe/image/bonus_badge/hh90_f_mob-v451014.png
141 kB URL pt-static4.jsmsat.com/npe/image/bonus_badge/hh90_f_mob-v451014.png
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type PNG image data, 890 x 500, 8-bit colormap, non-interlaced\012- data
Size 141 kB (140582 bytes)
Hash 1b2192daa3b8ee47ae62f645f74c25c0
ba3775111447700c4c906545619afb374b6081e2
31182235624a4f02964aede9515aa866ea95c4e7614ef604c1c785046ccf5399
GET /npe/image/bonus_badge/hh90_f_mob-v451014.png HTTP/1.1
Host: pt-static4.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: image/png
content-length: 140582
last-modified: Fri, 24 Nov 2023 16:22:50 GMT
etag: "6560cdda-22526"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
accept-ranges: bytes
X-Firefox-Spdy: h2
pt-static2.jsmsat.com/npe/pu/play/script/pu.play-v451014.js
85 kB URL pt-static2.jsmsat.com/npe/pu/play/script/pu.play-v451014.js
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type gzip compressed data, max speed, from Unix\012- data
Hash c7b914a2a03828403d6d1417c7b7466f
72507b44ac68f3568b06736ead83445df1e43673
5ae7ea23b496e2813c302cc8333344f26995ae39402890ab6ac715e0fdda3415
GET /npe/pu/play/script/pu.play-v451014.js HTTP/1.1
Host: pt-static2.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/javascript
last-modified: Fri, 24 Nov 2023 16:22:51 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"6560cddb-39a99"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
cache-control: max-age=1209600
content-encoding: gzip
X-Firefox-Spdy: h2
galleryn1.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f1d/d0c8b8417232c0c5f784b35403defa54_glamour_215x121.jpg?cno=cef3
10 kB URL galleryn1.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f1d/d0c8b8417232c0c5f784b35403defa54_glamour_215x121.jpg?cno=cef3
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 215x121, components 3\012- data
Hash 7a836674988db5a6e2d8d2904d72803e
3d552b2309d4e992b91baff92e8337fb0bcf1d47
784679d0f58e9b077cdd361ae3cffb98334e1011c908bbde47a4996744263de5
GET /ff268cab8d9fbae1ed7506f97496274f1d/d0c8b8417232c0c5f784b35403defa54_glamour_215x121.jpg?cno=cef3 HTTP/1.1
Host: galleryn1.vcmdiawe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: image/jpeg
content-length: 10093
last-modified: Wed, 28 Jun 2023 22:02:49 GMT
x-rgw-object-type: Normal
etag: "7a836674988db5a6e2d8d2904d72803e"
access-control-allow-origin: *
x-content-type-options: nosniff
x-cache-source: Origin
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
server: unknown
x-cdn-node: sesto
cache-control: max-age=1209600
x-real-source: -
accept-ranges: bytes
X-Firefox-Spdy: h2
b-hls-11.doppiocdn.com/hls/59028862/59028862_240p_266_YWjJWKj3wNFUdgEU_1701120554.mp4
155 kB URL b-hls-11.doppiocdn.com/hls/59028862/59028862_240p_266_YWjJWKj3wNFUdgEU_1701120554.mp4
IP
Size 155 kB (155339 bytes)
Hash 6a9c6cabc867fca5fdcdbd6831a1a758
f1a6e2f573e2abb1bf956a202459208756356bbb
21e6bbe6bd636d57e4ea1dae81779eef839f13fd28635a1e7b95b986a81933ab
GET /hls/59028862/59028862_240p_266_YWjJWKj3wNFUdgEU_1701120554.mp4 HTTP/1.1
Host: b-hls-11.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Referer: https://creative.mnaspm.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: video/mp4
content-length: 155339
last-modified: Mon, 27 Nov 2023 21:29:16 GMT
etag: "65650a2c-25ecb"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 4
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd775c9fd456c6-OSL
alt-svc: h3=":443"; ma=86400
galleryn0.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f1d/d0c8b8417232c0c5f784b35403defa54_glamour_896x504.jpg
101 kB URL galleryn0.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f1d/d0c8b8417232c0c5f784b35403defa54_glamour_896x504.jpg
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 896x504, components 3\012- data
Size 101 kB (100564 bytes)
Hash a35a6b214423085b2b6f01b142d7220e
c9e8621dc39017d4279b3f91fcb4e23ecb9196c2
bcc5c43dee77aa4c66a03651119758cd504ae3b6416ee1490e6c9b95df9a03fd
GET /ff268cab8d9fbae1ed7506f97496274f1d/d0c8b8417232c0c5f784b35403defa54_glamour_896x504.jpg HTTP/1.1
Host: galleryn0.vcmdiawe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: image/jpeg
content-length: 100564
last-modified: Wed, 28 Jun 2023 22:02:49 GMT
x-rgw-object-type: Normal
etag: "a35a6b214423085b2b6f01b142d7220e"
access-control-allow-origin: *
x-content-type-options: nosniff
x-cache-source: Origin
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
server: unknown
x-cdn-node: sesto
cache-control: max-age=1209600
x-real-source: -
accept-ranges: bytes
X-Firefox-Spdy: h2
go.mnaspm.com/api/models?quality=240p&forceClient=1&stripcashR=0&limit=1&usePreroll=0&webp=1
199 kB URL go.mnaspm.com/api/models?quality=240p&forceClient=1&stripcashR=0&limit=1&usePreroll=0&webp=1
IP
Certificate IssuerGoogle Trust Services LLC
Subjectmnaspm.com
FingerprintD2:26:54:49:EC:5C:B3:8E:40:54:41:6D:0E:21:1C:E8:A8:48:BD:EE
ValidityFri, 20 Oct 2023 15:37:06 GMT - Thu, 18 Jan 2024 15:37:05 GMT
File type JSON data\012- , ASCII text, with very long lines (1821), with no line terminators
Size 199 kB (199414 bytes)
Hash ec287d51788bd988a69ae31640333b08
0513aa467fef9f0c7c8c3fbf2f00da0d16c98818
928c2d03fb35fb6094bed94f10c83f5114e2a15cb8f5ef9c472111ea361180cf
GET /api/models?quality=240p&forceClient=1&stripcashR=0&limit=1&usePreroll=0&webp=1 HTTP/1.1
Host: go.mnaspm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.mnaspm.com/
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Cookie: __cflb=0H28upDCGznfDm9XVE9CKHVnP1Wapb1ubpsG7TnwHrk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: application/json
access-control-allow-origin: https://creative.mnaspm.com
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:28:58 GMT
cf-cache-status: HIT
age: 1
server: cloudflare
cf-ray: 82cd77578c43b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
galleryn0.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f19/9a157907a07217f6fcd54d61e55e89a0_glamour_896x504.jpg
92 kB URL galleryn0.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f19/9a157907a07217f6fcd54d61e55e89a0_glamour_896x504.jpg
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 896x504, components 3\012- data
Hash 22880381d0f3aba28738af40e995b4a8
f7139b8b056b788b1381d0def7ebce68cb4927bc
7d6af76b5ea1f5378eb738ba64b2d73986c6ddcb27b85a35b3ef2bc06a3ef3ee
GET /ff268cab8d9fbae1ed7506f97496274f19/9a157907a07217f6fcd54d61e55e89a0_glamour_896x504.jpg HTTP/1.1
Host: galleryn0.vcmdiawe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: image/jpeg
content-length: 92495
last-modified: Tue, 18 Jul 2023 23:12:51 GMT
x-rgw-object-type: Normal
etag: "22880381d0f3aba28738af40e995b4a8"
access-control-allow-origin: *
x-content-type-options: nosniff
x-cache-source: Origin
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:22 GMT
server: unknown
x-cdn-node: sesto
cache-control: max-age=1209600
x-real-source: -
accept-ranges: bytes
X-Firefox-Spdy: h2
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p.m3u8
200 OK 333 B URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p.m3u8
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Hash 6cb15eff00aada2dedbf3beb9071d605
4899cedf21c624eb1632ad6a976e756829ea2bd5
c492c0c72f198a929aa43761abf0c9775661da65bd311d8c504fac3000e3516d
GET /hls/77154776/77154776_480p.m3u8 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:22 GMT
x-proxy-cache: MISS
cache-control: public, max-age=1, s-maxage=1
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 0
server: cloudflare
cf-ray: 82cd775dc91656c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
b-hls-11.doppiocdn.com/hls/59028862/59028862_240p.m3u8
1.2 MB URL b-hls-11.doppiocdn.com/hls/59028862/59028862_240p.m3u8
IP
Size 1.2 MB (1238050 bytes)
Hash 914ac34af2a7b299ae48efed85e4775b
a101ed7097d012035f9c2d001811d4f0199ad265
0543fe8dd7ec9cf12e96bdbe94b7df2111aa625d7f4d428f6fc112ad74d93bc9
GET /hls/59028862/59028862_240p.m3u8 HTTP/1.1
Host: b-hls-11.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Referer: https://creative.mnaspm.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:21 GMT
x-proxy-cache: MISS
cache-control: public, max-age=1, s-maxage=1
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 0
server: cloudflare
cf-ray: 82cd775bced856c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
pt-static4.jsmsat.com/npe/_common/fonts/pt-icons-v451014.woff
22 kB URL pt-static4.jsmsat.com/npe/_common/fonts/pt-icons-v451014.woff
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type Web Open Font Format, TrueType, length 22336, version 1.0\012- data
Hash 68d6c2571b31b2aec684df15d90a7d12
81b540636375d8648d30839a810f73907923d1db
33e3503ef3a7dc205b9a36025f8ec534daad28ae8773c930c245d463d250f472
GET /npe/_common/fonts/pt-icons-v451014.woff HTTP/1.1
Host: pt-static4.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://crmpt.livejasmin.com
DNT: 1
Connection: keep-alive
Referer: https://pt-static4.jsmsat.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:23 GMT
content-type: application/font-woff
content-length: 22336
last-modified: Fri, 24 Nov 2023 16:22:50 GMT
etag: "6560cdda-5740"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:23 GMT
cache-control: max-age=1209600
accept-ranges: bytes
X-Firefox-Spdy: h2
pt-static2.jsmsat.com/npe/pu/fslf/jsm/script/pu.fslf-v451014.js
363 kB URL pt-static2.jsmsat.com/npe/pu/fslf/jsm/script/pu.fslf-v451014.js
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type gzip compressed data, max speed, from Unix\012- data
Size 363 kB (363000 bytes)
Hash 57ae14d0ce63584f3e99acddbd45b956
3dabc964c1ff191007ee49adc0c8637678ec453a
b89d3a90617a4074d51d0d73fe7c98c111a4396b23a868c1401ab47321dc5dd4
GET /npe/pu/fslf/jsm/script/pu.fslf-v451014.js HTTP/1.1
Host: pt-static2.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:23 GMT
content-type: application/javascript
last-modified: Fri, 24 Nov 2023 16:22:51 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"6560cddb-d75f3"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:23 GMT
cache-control: max-age=1209600
content-encoding: gzip
X-Firefox-Spdy: h2
galleryn2.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f10/01bd7d9d62f5500b0e8b08ffe5c2f3ca_glamour_896x504.jpg?cno=67e6
45 kB URL galleryn2.vcmdiawe.com/ff268cab8d9fbae1ed7506f97496274f10/01bd7d9d62f5500b0e8b08ffe5c2f3ca_glamour_896x504.jpg?cno=67e6
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 896x504, components 3\012- data
Hash cebaf741240152ee4bfce88c35aebaa0
25510a5f2ca07951b45f264fee1bea87f138875c
a6b877534c1b02f4790269150b0170583dfaf9f7b4bccb59de4b37fe793ac28a
GET /ff268cab8d9fbae1ed7506f97496274f10/01bd7d9d62f5500b0e8b08ffe5c2f3ca_glamour_896x504.jpg?cno=67e6 HTTP/1.1
Host: galleryn2.vcmdiawe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:23 GMT
content-type: image/jpeg
content-length: 44931
last-modified: Mon, 23 Oct 2023 13:47:09 GMT
x-rgw-object-type: Normal
etag: "cebaf741240152ee4bfce88c35aebaa0"
access-control-allow-origin: *
x-content-type-options: nosniff
x-cache-source: Origin
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:23 GMT
server: unknown
x-cdn-node: sesto
cache-control: max-age=1209600
x-real-source: -
accept-ranges: bytes
X-Firefox-Spdy: h2
crmpt.livejasmin.com/MsKqp/mp3.gif?ms_rnd=1701120560.31066&pstool=400_18&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&origin=twinrdsrv.com&categoryName=girl&rrc=3&im=1
43 B URL crmpt.livejasmin.com/MsKqp/mp3.gif?ms_rnd=1701120560.31066&pstool=400_18&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&origin=twinrdsrv.com&categoryName=girl&rrc=3&im=1
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Certificate IssuerLet's Encrypt
Subjectcrmpt.livejasmin.com
Fingerprint94:36:98:3E:6B:F5:EC:61:46:A3:7A:E2:90:5F:85:61:58:F1:57:AA
ValiditySun, 26 Nov 2023 16:01:07 GMT - Sat, 24 Feb 2024 16:01:06 GMT
File type GIF image data 18759 x 18759\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /MsKqp/mp3.gif?ms_rnd=1701120560.31066&pstool=400_18&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&origin=twinrdsrv.com&categoryName=girl&rrc=3&im=1 HTTP/1.1
Host: crmpt.livejasmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/post/fslf?ms_rnd=1701120560.31066&pstool=400_18&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&origin=twinrdsrv.com&categoryName=girl&rrc=3
Cookie: psui=a59f007fbf3384ccc33cc586d5d348f0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:23 GMT
content-type: image/gif
content-length: 43
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: unknown
set-cookie: psui=a59f007fbf3384ccc33cc586d5d348f0; Path=/; Expires=Wed, 27-Dec-23 21:29:23 GMT; SameSite=None; Secure
expires: Mon, 27 Nov 2023 21:29:22 GMT
cache-control: no-cache
access-control-allow-origin: *
X-Firefox-Spdy: h2
pt-static1.jsmsat.com/npe/image/pt_di-v451014.png
20 kB URL pt-static1.jsmsat.com/npe/image/pt_di-v451014.png
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type PNG image data, 320 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash 2a39f133a8af87dc3b845832ff6d30cb
e67bba16969705430f54e65ad0a241ff987aa273
0d4451ade7ff63c59585c3637be283849dedd52d49886c6a7e73ec1364337ad4
GET /npe/image/pt_di-v451014.png HTTP/1.1
Host: pt-static1.jsmsat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:23 GMT
content-type: image/png
content-length: 20381
last-modified: Fri, 24 Nov 2023 16:22:50 GMT
etag: "6560cdda-4f9d"
access-control-allow-origin: *
server: unknown
x-cdn-node: sesto
x-cache-status: R-HIT
expires: Mon, 11 Dec 2023 21:29:23 GMT
cache-control: max-age=1209600
accept-ranges: bytes
X-Firefox-Spdy: h2
creative.mnaspm.com/LPOmega/images/logo.svg
183 kB URL creative.mnaspm.com/LPOmega/images/logo.svg
IP
Certificate IssuerGoogle Trust Services LLC
Subjectmnaspm.com
FingerprintD2:26:54:49:EC:5C:B3:8E:40:54:41:6D:0E:21:1C:E8:A8:48:BD:EE
ValidityFri, 20 Oct 2023 15:37:06 GMT - Thu, 18 Jan 2024 15:37:05 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (4655), with no line terminators
Size 183 kB (182885 bytes)
Hash f256810f45872537d8f56066f2568dcd
d28e722a54d7a4b06364f161c5b255301ec29e89
54d39b4f66fbe6cce470e791c17c3e38f015b046a55e3ff22cb22cdb741879bb
GET /LPOmega/images/logo.svg HTTP/1.1
Host: creative.mnaspm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: image/svg+xml
last-modified: Thu, 23 Nov 2023 14:34:48 GMT
etag: W/"655f6308-122f"
expires: Mon, 27 Nov 2023 21:29:30 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 0
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77578c46b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
lsc-edge-95-128-121-34.dditscdn.com/memberChat/jasmina9b7a4b7-01d1-4fbe-8ade-ca517ed12c5130a8e3e2a2a773cee8eaa87be4c7a003?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkb2NsZXIubHNjLmFwaSIsImF1ZCI6Ijk1LjEyOC4xMjEuMzQiLCJuaWNrIjoiYTliN2E0YjctMDFkMS00ZmJlLThhZGUtY2E1MTdlZDEyYzUxIiwiaGFzaCI6IjMwYThlM2UyYTJhNzczY2VlOGVhYTg3YmU0YzdhMDAzIiwianRpIjo0Mzc3NjYxMTk1MDc4NjgxLCJpYXQiOjE3MDExMjA1NjQsImV4cCI6MTcwMTEyMDYyNH0.tNLMGgYKU0sYU7PsDfo0sKzZZzWM0aG8T1xxUbB2fEs
0 B URL lsc-edge-95-128-121-34.dditscdn.com/memberChat/jasmina9b7a4b7-01d1-4fbe-8ade-ca517ed12c5130a8e3e2a2a773cee8eaa87be4c7a003?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkb2NsZXIubHNjLmFwaSIsImF1ZCI6Ijk1LjEyOC4xMjEuMzQiLCJuaWNrIjoiYTliN2E0YjctMDFkMS00ZmJlLThhZGUtY2E1MTdlZDEyYzUxIiwiaGFzaCI6IjMwYThlM2UyYTJhNzczY2VlOGVhYTg3YmU0YzdhMDAzIiwianRpIjo0Mzc3NjYxMTk1MDc4NjgxLCJpYXQiOjE3MDExMjA1NjQsImV4cCI6MTcwMTEyMDYyNH0.tNLMGgYKU0sYU7PsDfo0sKzZZzWM0aG8T1xxUbB2fEs
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /memberChat/jasmina9b7a4b7-01d1-4fbe-8ade-ca517ed12c5130a8e3e2a2a773cee8eaa87be4c7a003?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkb2NsZXIubHNjLmFwaSIsImF1ZCI6Ijk1LjEyOC4xMjEuMzQiLCJuaWNrIjoiYTliN2E0YjctMDFkMS00ZmJlLThhZGUtY2E1MTdlZDEyYzUxIiwiaGFzaCI6IjMwYThlM2UyYTJhNzczY2VlOGVhYTg3YmU0YzdhMDAzIiwianRpIjo0Mzc3NjYxMTk1MDc4NjgxLCJpYXQiOjE3MDExMjA1NjQsImV4cCI6MTcwMTEyMDYyNH0.tNLMGgYKU0sYU7PsDfo0sKzZZzWM0aG8T1xxUbB2fEs HTTP/1.1
Host: lsc-edge-95-128-121-34.dditscdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://crmpt.livejasmin.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: BT4npH1jtxULfxm7g9FaDg==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Date: Mon, 27 Nov 2023 21:29:24 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: SqZxpxpU/9/RY2qJHVamEfxn+iU=
Server: unknown
gallery.vcmdiawe.com/lpp/0/a9b7a4b7-01d1-4fbe-8ade-ca517ed12c51/a9b7a4b7-01d1-4fbe-8ade-ca517ed12c51.20.mp4
1.3 MB URL gallery.vcmdiawe.com/lpp/0/a9b7a4b7-01d1-4fbe-8ade-ca517ed12c51/a9b7a4b7-01d1-4fbe-8ade-ca517ed12c51.20.mp4
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
File type ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]\012- data
Size 1.3 MB (1259335 bytes)
Hash 3c46bf4a8b998071abd51cbbc5cd6173
af0673d2afdf12375f479f3f4d097ccba659b2f4
25e2e6d999fc531bf28dd78e249b02feab3879714e9c9a36b6221ecacbdde794
GET /lpp/0/a9b7a4b7-01d1-4fbe-8ade-ca517ed12c51/a9b7a4b7-01d1-4fbe-8ade-ca517ed12c51.20.mp4 HTTP/1.1
Host: gallery.vcmdiawe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 206 Partial Content
date: Mon, 27 Nov 2023 21:29:24 GMT
content-type: video/mp4
content-length: 1259335
last-modified: Mon, 27 Nov 2023 21:29:19 GMT
etag: "65650a2f-133747"
x-cache-source: Streampreroll
access-control-allow-origin: *
x-content-type-options: nosniff
cache-control: max-age=60
expires: Mon, 27 Nov 2023 21:30:24 GMT
server: unknown
x-cdn-node: sesto
x-cache-status: R-MISS
x-real-source: -, -
content-range: bytes 0-1259334/1259335
X-Firefox-Spdy: h2
ngs-edge-95-128-120-40.dditscdn.com/eyJhbGciOiJIUzI1NiJ9.eyJhbGxvd0g1TGl2ZVByb3h5Ijp0cnVlLCJvcmlnaW4iOiIqIiwicHJvdG9jb2wiOiJoNWxpdmUiLCJzZXJ2ZXIiOiJ3c3M6Ly9uZ3MtZWRnZS05NS0xMjgtMTIwLTQwLmRkaXRzY2RuLmNvbSIsInRva2VuSWQiOiJNQ3hrTURkaE9UY3daUzAyTURVeUxUUTVOREl0WVRKallTMHpPV1l5T1RKbE1tRmxOemNzTVN3MVpqZ3dOemd5T0N4TlREUllkSE1yU0U5SGVYcHNXVmhQT0RSM2JtUjFZamhMYzJNOSIsInN0cmVhbUlkIjoiYWU1MTI5ZDMtZjVkNC00NjJhLWIxMWQtZWZhZDVhOTY0NzM5IiwidHlwZSI6InZpZXciLCJjSWQiOiJ3cWJmaGxsM29pOXppbmJnIiwiYXVkIjoidmlld2VyIiwiaXNzIjoiZG9jbGVyLnN0cmVhbWluZy5zdHJlYW1jb250cm9sbGVyIiwiaWF0IjoxNzAxMTIwNTY1LCJleHAiOjE3MDExMjA2MjV9.62MfsNgyB5zp5TJ7RsiETdyl6EaxyThlOijyGPE93AA?
0 B URL ngs-edge-95-128-120-40.dditscdn.com/eyJhbGciOiJIUzI1NiJ9.eyJhbGxvd0g1TGl2ZVByb3h5Ijp0cnVlLCJvcmlnaW4iOiIqIiwicHJvdG9jb2wiOiJoNWxpdmUiLCJzZXJ2ZXIiOiJ3c3M6Ly9uZ3MtZWRnZS05NS0xMjgtMTIwLTQwLmRkaXRzY2RuLmNvbSIsInRva2VuSWQiOiJNQ3hrTURkaE9UY3daUzAyTURVeUxUUTVOREl0WVRKallTMHpPV1l5T1RKbE1tRmxOemNzTVN3MVpqZ3dOemd5T0N4TlREUllkSE1yU0U5SGVYcHNXVmhQT0RSM2JtUjFZamhMYzJNOSIsInN0cmVhbUlkIjoiYWU1MTI5ZDMtZjVkNC00NjJhLWIxMWQtZWZhZDVhOTY0NzM5IiwidHlwZSI6InZpZXciLCJjSWQiOiJ3cWJmaGxsM29pOXppbmJnIiwiYXVkIjoidmlld2VyIiwiaXNzIjoiZG9jbGVyLnN0cmVhbWluZy5zdHJlYW1jb250cm9sbGVyIiwiaWF0IjoxNzAxMTIwNTY1LCJleHAiOjE3MDExMjA2MjV9.62MfsNgyB5zp5TJ7RsiETdyl6EaxyThlOijyGPE93AA?
IP
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /eyJhbGciOiJIUzI1NiJ9.eyJhbGxvd0g1TGl2ZVByb3h5Ijp0cnVlLCJvcmlnaW4iOiIqIiwicHJvdG9jb2wiOiJoNWxpdmUiLCJzZXJ2ZXIiOiJ3c3M6Ly9uZ3MtZWRnZS05NS0xMjgtMTIwLTQwLmRkaXRzY2RuLmNvbSIsInRva2VuSWQiOiJNQ3hrTURkaE9UY3daUzAyTURVeUxUUTVOREl0WVRKallTMHpPV1l5T1RKbE1tRmxOemNzTVN3MVpqZ3dOemd5T0N4TlREUllkSE1yU0U5SGVYcHNXVmhQT0RSM2JtUjFZamhMYzJNOSIsInN0cmVhbUlkIjoiYWU1MTI5ZDMtZjVkNC00NjJhLWIxMWQtZWZhZDVhOTY0NzM5IiwidHlwZSI6InZpZXciLCJjSWQiOiJ3cWJmaGxsM29pOXppbmJnIiwiYXVkIjoidmlld2VyIiwiaXNzIjoiZG9jbGVyLnN0cmVhbWluZy5zdHJlYW1jb250cm9sbGVyIiwiaWF0IjoxNzAxMTIwNTY1LCJleHAiOjE3MDExMjA2MjV9.62MfsNgyB5zp5TJ7RsiETdyl6EaxyThlOijyGPE93AA? HTTP/1.1
Host: ngs-edge-95-128-120-40.dditscdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://crmpt.livejasmin.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: mqKK0gG4dH8a+8pH15BxxQ==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Date: Mon, 27 Nov 2023 21:29:25 GMT
Connection: upgrade
server: ngs-h5live-proxy
Upgrade: websocket
Sec-WebSocket-Accept: R1NjgDOVXQhSLw0ezMHXQ9yIqTc=
adsmediabox.com/cobp.php?utm_source=ja&utm_medium=imp&utm_campaign=555555&t=170112056&sid=555555&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
726 B URL adsmediabox.com/cobp.php?utm_source=ja&utm_medium=imp&utm_campaign=555555&t=170112056&sid=555555&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
IP
ASN #43350 NForce Entertainment B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (340)
Hash e48364705976b09f9466f5909b2da220
c16b472ea13d5805fe410165a5329704dd2d825c
56beecc07f90739e934e9461d3c6773e8b66883307f5698d57577efee8b1e316
GET /cobp.php?utm_source=ja&utm_medium=imp&utm_campaign=555555&t=170112056&sid=555555&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242 HTTP/1.1
Host: adsmediabox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Mon, 27 Nov 2023 21:29:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __ttrec=1; expires=Tue, 28-Nov-2023 21:29:28 GMT; Max-Age=86400; path=/
Content-Encoding: gzip
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p.m3u8
200 OK 383 B URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p.m3u8
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Hash 3a73f580812b0f0ce828409679d1162d
b4f4a3e05b987ca243a75419ae91d4743da4107f
1ae56c0e16bfa0f4c288fe9ed1379edea62baa814859dc57a7bb2525814f7f79
GET /hls/77154776/77154776_480p.m3u8 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:20 GMT
x-proxy-cache: MISS
cache-control: public, max-age=1, s-maxage=1
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 0
server: cloudflare
cf-ray: 82cd7751095656c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
b-hls-01.doppiocdn.com/hls/77154776/77154776_480p.m3u8
200 OK 684 B URL GET HTTP/3 b-hls-01.doppiocdn.com/hls/77154776/77154776_480p.m3u8
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Hash 9ae03a448b3b1ffa7c0c47a76ea8d5c6
e0023c9e683498daa5590f03808a192a151f4f87
136f39c1fdb265e33c118877565b20830f18e48b083872ec27cb4cfebb240c72
GET /hls/77154776/77154776_480p.m3u8 HTTP/1.1
Host: b-hls-01.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:26 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:26 GMT
x-proxy-cache: MISS
cache-control: public, max-age=1, s-maxage=1
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
server: cloudflare
cf-ray: 82cd7771d8bc56c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
edge-hls.doppiocdn.com/hls/121357251/master/121357251_240p.m3u8
200 OK 226 B URL GET HTTP/2 edge-hls.doppiocdn.com/hls/121357251/master/121357251_240p.m3u8
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
File type M3U playlist, ASCII text, with no line terminators
Hash 67f6b45d5fa0f821edd33129e2789a89
f16d1e4b10ebc29d0f6f4fc305219b255ca8434d
d448796c284fb3fe7249a6c96f63db22c69b3320035afa4ce5fb23bbfa652d4a
GET /hls/121357251/master/121357251_240p.m3u8 HTTP/1.1
Host: edge-hls.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/vnd.apple.mpegurl
vary: Accept-Encoding
last-modified: Mon, 27 Nov 2023 21:29:18 GMT
x-proxy-cache: EXPIRED
cache-control: public, max-age=3, s-maxage=3
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
set-cookie: __cflb=02DiuDqTDHWLb7zSddG9z9dnCh3o3hTZTpbVTQpYttBba; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:20 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774bea7f56a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/js/script.js
200 OK 892 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/notifications/text_bubble/2/js/script.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (959), with no line terminators
Hash 9d441b1ef0d4f07226844f2a75309fe0
588ed7e74f0c215a09e72131be39b930479dccf9
5df48723b4f69d2ecdd0de387d4233bf720e3c0cac669645d8a5ca6cb31e9bf8
GET /sb/ssp/notifications/text_bubble/2/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript
last-modified: Tue, 12 Jul 2022 10:56:18 GMT
etag: W/"62cd5352-37c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 107279
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RRfnhjULCEQpzhPNznIhXTD1fmPX3vQnD8iHSOlrGwUUIFNcRSArzZyCwxXbNDphjRQOCFMFDgR6GWWxaWubNxLhw%2F1qzc6FgTlyqu0ouJY2TyG8r9eDh0DI1cAuCDk5Ti5rn1plL7eN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77412d78b951-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
go.bbrdbr.com/config?url=https%3A%2F%2Fcreative.bbrdbr.com%2Fwidgets%2Fv4%2FUniversal%3Ftag%3Dgirls%26thumbsMargin%3D0%26gridRows%3D1%26gridColumns%3D1%26sourceId%3D300cps2girlwl%26creativeId%3D300cps2girlwl%26responsive%3D0%26hideButton%3D1%26hideTitle%3D1%26userId%3Debe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75%26autoplay%3Dall%26autoplayForce%3D1%26action%3DsbSignupWithModel%26memberId%3D%7Bclickid%7D
200 OK 6.8 kB URL GET HTTP/3 go.bbrdbr.com/config?url=https%3A%2F%2Fcreative.bbrdbr.com%2Fwidgets%2Fv4%2FUniversal%3Ftag%3Dgirls%26thumbsMargin%3D0%26gridRows%3D1%26gridColumns%3D1%26sourceId%3D300cps2girlwl%26creativeId%3D300cps2girlwl%26responsive%3D0%26hideButton%3D1%26hideTitle%3D1%26userId%3Debe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75%26autoplay%3Dall%26autoplayForce%3D1%26action%3DsbSignupWithModel%26memberId%3D%7Bclickid%7D
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with very long lines (8856), with no line terminators
Hash c069232f06b74a964b337fda51d46e90
4790f2bc83320591314614bab61688b903bdd24d
514c87683773433572e8cfa969d3eb4d34108d6e585f10d33f4d38a2a07c4c8e
GET /config?url=https%3A%2F%2Fcreative.bbrdbr.com%2Fwidgets%2Fv4%2FUniversal%3Ftag%3Dgirls%26thumbsMargin%3D0%26gridRows%3D1%26gridColumns%3D1%26sourceId%3D300cps2girlwl%26creativeId%3D300cps2girlwl%26responsive%3D0%26hideButton%3D1%26hideTitle%3D1%26userId%3Debe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75%26autoplay%3Dall%26autoplayForce%3D1%26action%3DsbSignupWithModel%26memberId%3D%7Bclickid%7D HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:21:07 GMT
cf-cache-status: HIT
age: 191
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774a2d1ab4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
b-hls-11.doppiocdn.com/hls/59028862/59028862_240p_init_5H5OqHzQrLhDnTrQ.mp4
200 OK 1.2 kB URL GET HTTP/3 b-hls-11.doppiocdn.com/hls/59028862/59028862_240p_init_5H5OqHzQrLhDnTrQ.mp4
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
File type ISO Media, MP4 Base Media v5 \012- data
Hash 4f853820526aa931ca500b3f1e9de113
e16da7ccdc60874d99a989108925ef7f9a56404d
dfac90c13b5c0755b1fd784b66563f9bd3bfc9440b8808752d71fb1818561cad
GET /hls/59028862/59028862_240p_init_5H5OqHzQrLhDnTrQ.mp4 HTTP/1.1
Host: b-hls-11.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Referer: https://creative.mnaspm.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:22 GMT
content-type: video/mp4
content-length: 1218
last-modified: Mon, 27 Nov 2023 21:20:21 GMT
etag: "65650815-4c2"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 10
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd775c1f3856c6-OSL
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=G-X41HPMWNWB&l=dataLayer&cx=c
200 OK 229 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-X41HPMWNWB&l=dataLayer&cx=c
IP
Requested by https://ads.imagevenue.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Size 229 kB (228869 bytes)
Hash d893ec2495cc4c4fa2941a57decc841b
3fc2116f1b08cc6d0bc0c716035700f8c582d804
738aec30c0a5285c78c987c14bb8b1babbaf90c3d137787ffe7c9d4fa232aebd
GET /gtag/js?id=G-X41HPMWNWB&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ads.imagevenue.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:19 GMT
expires: Mon, 27 Nov 2023 21:29:19 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 81125
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
200 OK 7.4 kB URL GET HTTP/2 tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
IP
ASN #24940 Hetzner Online GmbH
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
FingerprintF2:3C:80:FB:F4:C8:BF:02:DD:BF:23:DD:27:74:AB:0B:89:F6:13:5E
ValiditySun, 12 Nov 2023 09:06:58 GMT - Sat, 10 Feb 2024 09:06:57 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (7505), with no line terminators
Hash 56480d246100165cb505026535e57b55
a4d9b65d6bfee24e3f312e4a66d3c6e60a0431fb
ab9d6806179c17ff930aa79f8d3177ba4c99dfc41dfdab5a778694745ad5e5b3
GET /iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0 HTTP/1.1
Host: tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: text/html; charset=utf-8
pragma: no-cache
expires: 0
vary: Accept-Encoding, *
x-api-version: 2
link: <https://lcdn.tsyndicate.com/sdk/v1/b.b.js>; rel=preload; as=script
x-request-id: 3b15fc2d9ba1a2e0
set-cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8; expires=Mon, 27 May 2024 21:29:14 GMT; domain=.tsyndicate.com; path=/; HttpOnly; secure; SameSite=None
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
content-encoding: gzip
X-Firefox-Spdy: h2
b-hls-18.doppiocdn.com/hls/121357251/121357251_240p_764_NBgBOFehA35NHrWS_1701120553.mp4
200 OK 173 kB URL GET HTTP/3 b-hls-18.doppiocdn.com/hls/121357251/121357251_240p_764_NBgBOFehA35NHrWS_1701120553.mp4
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint99:FA:E1:1F:E8:F6:A1:57:63:A7:AA:BD:3E:C1:94:58:E7:83:02:13
ValiditySat, 21 Jan 2023 00:00:00 GMT - Sun, 21 Jan 2024 23:59:59 GMT
Size 173 kB (172828 bytes)
Hash 3d99d09b1e91bae72ed998cf456211ef
fdcbeab53866d1d237241ec937562de5dba828fb
e08f4ac3d9df84d679a8a398488995a7c71dbcce121934a47efd2d136bf1a402
GET /hls/121357251/121357251_240p_764_NBgBOFehA35NHrWS_1701120553.mp4 HTTP/1.1
Host: b-hls-18.doppiocdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: video/mp4
content-length: 172828
last-modified: Mon, 27 Nov 2023 21:29:15 GMT
etag: "65650a2b-2a31c"
cache-control: public, max-age=60, s-maxage=60
access-control-allow-origin: *
timing-allow-origin: *
cf-cache-status: HIT
age: 2
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7750e92a56c6-OSL
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/api/models?tag=girls%2Fasian&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1
200 OK 1.7 kB URL GET HTTP/3 go.bbrdbr.com/api/models?tag=girls%2Fasian&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls/asian&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2asgirl&creativeId=300cps2asgirl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&showModal=signup&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with very long lines (1801), with no line terminators
Hash 6ea4733e0ab1eee63202ea38ae38652d
e94e555366a79629044e76950493555fbb363fac
b10e602f750876d8610d3afdcf9a0e3c3f70088646f069205e6444f88e8260d3
GET /api/models?tag=girls%2Fasian&forceClient=1&stripcashR=0&limit=1&usePreroll&webp=1 HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:28:12 GMT
cf-cache-status: HIT
age: 7
server: cloudflare
cf-ray: 82cd7747c9afb4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/app/domain-checker/get-check
200 OK 130 B URL GET HTTP/3 go.fxmnba.com/app/domain-checker/get-check
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 32648850e69c57084b90d6200e713516
963be5cd79df0217656ee170f74d309550aa7105
b0651b918b92cb5d4d85296c321a078b73797ae4e670f993b8b3d8fd7ef24b0a
GET /app/domain-checker/get-check HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/json
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtrsnD7QZBLqqpmg3HKvX1fPaR9Sk; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:18 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd774529e1b500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/app/domain-checker/get-check
200 OK 127 B URL GET HTTP/3 go.fxmnba.com/app/domain-checker/get-check
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5e8cadd13721a59d980327198c5e0b61
9aa76691c22275f193954671d2baa134ebf55bb2
5dc8fc504aed22cf12b4ed86bea42a516ae0387c59e78dd1bf18f22272f76f12
GET /app/domain-checker/get-check HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: application/json
access-control-allow-origin: https://creative.fxmnba.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuDFRFiBZBvMSLtqG3jTHqF85wnSu135QPyHXUYQLt; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:17 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd773d18cdb500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/api/models?quality=240p&webp=1&forceClient=1&stripcashR=0&limit=1&usePreroll=0
200 OK 1.8 kB URL GET HTTP/3 go.fxmnba.com/api/models?quality=240p&webp=1&forceClient=1&stripcashR=0&limit=1&usePreroll=0
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with very long lines (1963), with no line terminators
Hash dabe40a9d58201ecbbd00c87bece032a
d025ec1356db90532c6a9fb50567bdb8901f4a85
a1ffc915b705f91430007997a14cd7b17c8d7a59df6e73599b207049b65d5be9
GET /api/models?quality=240p&webp=1&forceClient=1&stripcashR=0&limit=1&usePreroll=0 HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Cookie: __cflb=02DiuDFRFiBZBvMSLtr4jPouUtFUmSRgcNyzPQWW6gjuE
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/json
access-control-allow-origin: https://creative.fxmnba.com
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:28:57 GMT
cf-cache-status: HIT
age: 10
server: cloudflare
cf-ray: 82cd77422e72b500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.fxmnba.com/api/models?quality=240p&webp=1&forceClient=1&stripcashR=0&limit=1&usePreroll=0
200 OK 1.8 kB URL GET HTTP/3 go.fxmnba.com/api/models?quality=240p&webp=1&forceClient=1&stripcashR=0&limit=1&usePreroll=0
IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b-J92et3_uOWomWc9MFU-DQBhM_OPOC6EyjytPbPjYziikbEhxKiikFtShm8nEpEWtTYZW-tROJe4d8hk1QYbVyFdGcfc_apVFxiq9o2XjRK3cU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with very long lines (1963), with no line terminators
Hash dabe40a9d58201ecbbd00c87bece032a
d025ec1356db90532c6a9fb50567bdb8901f4a85
a1ffc915b705f91430007997a14cd7b17c8d7a59df6e73599b207049b65d5be9
GET /api/models?quality=240p&webp=1&forceClient=1&stripcashR=0&limit=1&usePreroll=0 HTTP/1.1
Host: go.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: application/json
access-control-allow-origin: https://creative.fxmnba.com
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:28:57 GMT
cf-cache-status: HIT
age: 9
server: cloudflare
cf-ray: 82cd773c3fecb500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
porn-images-xxx.com/api/w/?m=html&search_type=merge&language=zh&count=4&domain=porn-images-xxx.com&tag[]=english
0 B URL POST porn-images-xxx.com/api/w/?m=html&search_type=merge&language=zh&count=4&domain=porn-images-xxx.com&tag[]=english
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /api/w/?m=html&search_type=merge&language=zh&count=4&domain=porn-images-xxx.com&tag[]=english HTTP/1.1
Host: porn-images-xxx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zh.hentai-img.com
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
200 OK 7.4 kB URL GET HTTP/2 tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
IP
ASN #24940 Hetzner Online GmbH
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
FingerprintF2:3C:80:FB:F4:C8:BF:02:DD:BF:23:DD:27:74:AB:0B:89:F6:13:5E
ValiditySun, 12 Nov 2023 09:06:58 GMT - Sat, 10 Feb 2024 09:06:57 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (7461), with no line terminators
Hash e7d52a215f13c295c4c243017699a4b9
f40e7e99e326f49e302525bfed30df2e88202e6c
6900c0c88ba0593080204a40babc4b2a0efff71d8fd18e550c9a835e77cdc2e7
GET /iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0 HTTP/1.1
Host: tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:15 GMT
content-type: text/html; charset=utf-8
pragma: no-cache
expires: 0
vary: Accept-Encoding, *
x-api-version: 2
link: <https://lcdn.tsyndicate.com/sdk/v1/b.b.js>; rel=preload; as=script
x-request-id: 031142c36aa58470
set-cookie: ts_uid=3289b521-1a01-478f-826a-f897bc08bac8; expires=Mon, 27 May 2024 21:29:15 GMT; domain=.tsyndicate.com; path=/; HttpOnly; secure; SameSite=None
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
content-encoding: gzip
X-Firefox-Spdy: h2
static.hentai-img.com/css/pc/style.min.css?t=20160213_01
200 OK 22 kB URL GET HTTP/3 static.hentai-img.com/css/pc/style.min.css?t=20160213_01
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /css/pc/style.min.css?t=20160213_01 HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 16 Jun 2023 07:58:42 GMT
etag: W/"648c1632-57f1"
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Origin, Authorization, Accept
access-control-allow-credentials: true
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 1451973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xCJQyTKj9M5SzAwGu6Fz9N4%2F7MDlOebKKHnvYkfh48bLsiVOBvpHmi8OYIZfO%2FSgKtNxsbzMskMvbHpb%2BkmbzkaIcmlODUoZgy%2FtjsIYg8H%2FENCPereo9QfW0Bgnkjtf73FdjGWidJM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cd771e5aa463cf-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.mnaspm.com/config?url=https%3A%2F%2Fcreative.mnaspm.com%2FLPOmega%3Faction%3DsbSignupWithModel%26campaignId%3D553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d%26campaignType%3Dsmartpop%26creativeId%3D47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69%26iterationId%3D764447%26masterSmartpopId%3D1738%26memberId%3Dd32faefd-d4aa-4458-8e0d-b7d73602808b%26p1%3DInterstitial_Remnant_tier1%26p2%3D46315%26p3%3D1660%26quality%3D240p%26ruleId%3D12%26smartpopId%3D1674%26sourceId%3DCOBP_Interstitial_Desk%26trackOff%3D1%26usePreroll%3D0%26userId%3D0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646%26variationId%3D32240
200 OK 6.8 kB URL GET HTTP/3 go.mnaspm.com/config?url=https%3A%2F%2Fcreative.mnaspm.com%2FLPOmega%3Faction%3DsbSignupWithModel%26campaignId%3D553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d%26campaignType%3Dsmartpop%26creativeId%3D47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69%26iterationId%3D764447%26masterSmartpopId%3D1738%26memberId%3Dd32faefd-d4aa-4458-8e0d-b7d73602808b%26p1%3DInterstitial_Remnant_tier1%26p2%3D46315%26p3%3D1660%26quality%3D240p%26ruleId%3D12%26smartpopId%3D1674%26sourceId%3DCOBP_Interstitial_Desk%26trackOff%3D1%26usePreroll%3D0%26userId%3D0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646%26variationId%3D32240
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerGoogle Trust Services LLC
Subjectmnaspm.com
FingerprintD2:26:54:49:EC:5C:B3:8E:40:54:41:6D:0E:21:1C:E8:A8:48:BD:EE
ValidityFri, 20 Oct 2023 15:37:06 GMT - Thu, 18 Jan 2024 15:37:05 GMT
File type ASCII text, with very long lines (8856), with no line terminators
Hash 0306c80e68cc6e82d0a2cf9d1850ab2b
1a3e2a4ecb23be9bb32a838b2e5873ec99b3bdd9
b7b520c1a6977ca66422f0140674ea0b91cc3dba62007ac2e7cfb85aee6d96b7
GET /config?url=https%3A%2F%2Fcreative.mnaspm.com%2FLPOmega%3Faction%3DsbSignupWithModel%26campaignId%3D553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d%26campaignType%3Dsmartpop%26creativeId%3D47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69%26iterationId%3D764447%26masterSmartpopId%3D1738%26memberId%3Dd32faefd-d4aa-4458-8e0d-b7d73602808b%26p1%3DInterstitial_Remnant_tier1%26p2%3D46315%26p3%3D1660%26quality%3D240p%26ruleId%3D12%26smartpopId%3D1674%26sourceId%3DCOBP_Interstitial_Desk%26trackOff%3D1%26usePreroll%3D0%26userId%3D0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646%26variationId%3D32240 HTTP/1.1
Host: go.mnaspm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.mnaspm.com/
Origin: https://creative.mnaspm.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: application/json
access-control-allow-origin: https://creative.mnaspm.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:29:21 GMT
cf-cache-status: MISS
set-cookie: __cflb=0H28upDCGznfDm9XVE9SipefN9YVHPp3dqN6itRZdDW; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 21:29:21 GMT; HttpOnly
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77568b1bb517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
creative.mnaspm.com/widgets/AgeVerification/lang/en.json
200 OK 3.8 kB URL GET HTTP/3 creative.mnaspm.com/widgets/AgeVerification/lang/en.json
IP
Requested by https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
Certificate IssuerGoogle Trust Services LLC
Subjectmnaspm.com
FingerprintD2:26:54:49:EC:5C:B3:8E:40:54:41:6D:0E:21:1C:E8:A8:48:BD:EE
ValidityFri, 20 Oct 2023 15:37:06 GMT - Thu, 18 Jan 2024 15:37:05 GMT
File type Unicode text, UTF-8 text, with very long lines (3893), with no line terminators
Hash 439492a182f83d206bc2866395232d07
f6680107d67d58a60979d0cc5e0df445df20f3c5
8cb9b080564a499f7fe089136876d951b70f26d23cbe4fa4078808830b461108
GET /widgets/AgeVerification/lang/en.json HTTP/1.1
Host: creative.mnaspm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.mnaspm.com/LPOmega?action=sbSignupWithModel&campaignId=553bf2d804f4c7122ece9d547dc5292db8681e5318e66bd4b8318815b1c5538d&campaignType=smartpop&creativeId=47df8ac6172a002efc9148d4edcb886af0647b890930dd6c15d0a48205704c69&iterationId=764447&masterSmartpopId=1738&memberId=d32faefd-d4aa-4458-8e0d-b7d73602808b&p1=Interstitial_Remnant_tier1&p2=46315&p3=1660&quality=240p&ruleId=12&smartpopId=1674&sourceId=COBP_Interstitial_Desk&trackOff=1&usePreroll=0&userId=0d0cdc753eed23068b893e6a636a40ccaadc69dc4a5ec7ee080ed62b15816646&variationId=32240
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:21 GMT
content-type: application/json
last-modified: Thu, 23 Nov 2023 14:35:16 GMT
etag: W/"655f6324-f06"
expires: Mon, 27 Nov 2023 21:29:19 GMT
cache-control: max-age=10
cf-cache-status: HIT
age: 6
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77567b10b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
static.hentai-img.com/js/common/jquery-2.2.4.min.js
200 OK 86 kB URL GET HTTP/3 static.hentai-img.com/js/common/jquery-2.2.4.min.js
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerGoogle Trust Services LLC
Subjecthentai-img.com
Fingerprint0C:0F:5D:D5:C9:A9:F5:C7:7D:41:9B:02:8F:21:4E:22:66:97:A6:23
ValiditySat, 21 Oct 2023 10:38:53 GMT - Fri, 19 Jan 2024 10:38:52 GMT
File type ASCII text, with very long lines (32065)
Hash 2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
GET /js/common/jquery-2.2.4.min.js HTTP/1.1
Host: static.hentai-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Cookie: adsense=pc-ca-ipp%3D1701120546
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:12 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 16 Jun 2023 07:58:42 GMT
etag: W/"648c1632-14e4a"
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Origin, Authorization, Accept
access-control-allow-credentials: true
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-cache: HIT
cf-cache-status: HIT
age: 2209644
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eVFnvzC9UBGJc1r%2BgWQf1mcdiGqpgfVjZUygzbs9QZz2B9PQaAli7GKozc8wxEXw2HopZqbgO%2FnbMSTSVL8jFfYZaS%2FxZjpbCmshMqInd3axOP%2F9P3SKgp4asANXXZ9Bbt05vNN4zXw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cd771e6aef63cf-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
creative.bbrdbr.com/widgets/v4/Universal/vendors~hls.13f01a3a9d7e36c14415.js
200 OK 178 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/vendors~hls.13f01a3a9d7e36c14415.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with very long lines (45140)
Size 178 kB (177865 bytes)
Hash 4a1e862a348e6713dfcce18e9cda2f42
47bed78ef29844bec68da443a6b0add48936b61b
b3b83266dde6fa2870ddc1cc812233d8baa03727cd4d65733ed5ee7a4fbb4490
GET /widgets/v4/Universal/vendors~hls.13f01a3a9d7e36c14415.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-2b6c9"
expires: Mon, 27 Nov 2023 21:29:19 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 3
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774ade46b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
12ezo5v60.com/get/1989865?zoneid=1989865&jp=_cl08nyhsv1dxn0iokp4es5&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1&freq=0
200 OK 18 kB URL GET HTTP/2 12ezo5v60.com/get/1989865?zoneid=1989865&jp=_cl08nyhsv1dxn0iokp4es5&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1&freq=0
IP
Requested by https://zh.hentai-img.com/image/deltarune-noelle-holiday-collection-part-2-r34/attachment/576/
Certificate IssuerBuypass AS-983163327
Subject
Fingerprint70:51:DF:98:CE:0D:50:0F:B3:1F:AB:6A:98:92:B4:3C:98:3A:AC:A0
ValidityThu, 16 Nov 2023 01:40:00 GMT - Mon, 13 May 2024 21:59:00 GMT
File type ASCII text, with very long lines (18150), with no line terminators
Hash 27753be3b195c9ab3504f6afa13a4d39
52af8a20dc02bc7d48c50cb59a210c639df07e9d
8e120e2fdee833fc52de27fec069243e7b22073a3deb3bce7098e3754ee4061d
GET /get/1989865?zoneid=1989865&jp=_cl08nyhsv1dxn0iokp4es5&nojs=0&abvar=0&febuild=1.0.178&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=1800334497160704&eclog=0&sp=1&im=1&freq=0 HTTP/1.1
Host: 12ezo5v60.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zh.hentai-img.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: CHCK=1; Path=/; Expires=Mon, 30 Dec 2024 21:29:14 GMT; Secure; SameSite=None
UID=231127162931b77092262f4cc2b606ff51a8; Path=/; Expires=Mon, 30 Dec 2024 21:29:14 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=b&output=js
200 OK 0 B URL GET HTTP/2 go.eabids.com/conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=b&output=js
IP
Requested by https://adsmediabox.com/jrt-cb.php?r=136058&cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242
Certificate IssuerLet's Encrypt
Subjectgo.eabids.com
FingerprintE5:44:EA:89:06:0E:AD:1B:B6:06:EB:98:BB:4A:C6:55:B7:01:14:8E
ValidityThu, 05 Oct 2023 21:00:10 GMT - Wed, 03 Jan 2024 21:00:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /conversion.go?cid=2|160180|186576806|no|109134|4318694|8003903|1|0|46|50304|,,,,,|4|0|0|3,12,25,29|0|0|en|1|91.90.42.154|0|0|0|0|3143242&conv_type=b&output=js HTTP/1.1
Host: go.eabids.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsmediabox.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Nov 2023 21:29:18 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
x-backend-server: nl2-web-200
X-Firefox-Spdy: h2
www.googletagmanager.com/gtm.js?id=GTM-MJ29FD7
335 kB URL GET www.googletagmanager.com/gtm.js?id=GTM-MJ29FD7
IP
Requested by https://crmpt.livejasmin.com/post/fslf?ms_rnd=1701120560.31066&pstool=400_18&psid=ed_imgvdt&site=jsm&utm_medium=partner&utm_source=tr&origin=twinrdsrv.com&categoryName=girl&rrc=3
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (61863)
Size 335 kB (335403 bytes)
Hash f1ba055504eb34d45801a77e4c4f840f
42d518b983fb96f12e9a593df3133f757c4aabaa
b2d58d1b4df4b78b616c2f427b763fe76ede3087951de4f9b7a86b8f29ad8856
GET /gtm.js?id=GTM-MJ29FD7 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://crmpt.livejasmin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 27 Nov 2023 21:29:23 GMT
expires: Mon, 27 Nov 2023 21:29:23 GMT
cache-control: private, max-age=900
last-modified: Mon, 27 Nov 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 94288
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
creative.bbrdbr.com/widgets/v4/Universal/vendors~hls.13f01a3a9d7e36c14415.js
200 OK 178 kB URL GET HTTP/3 creative.bbrdbr.com/widgets/v4/Universal/vendors~hls.13f01a3a9d7e36c14415.js
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with very long lines (45140)
Size 178 kB (177865 bytes)
Hash 4a1e862a348e6713dfcce18e9cda2f42
47bed78ef29844bec68da443a6b0add48936b61b
b3b83266dde6fa2870ddc1cc812233d8baa03727cd4d65733ed5ee7a4fbb4490
GET /widgets/v4/Universal/vendors~hls.13f01a3a9d7e36c14415.js HTTP/1.1
Host: creative.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 23 Nov 2023 14:38:50 GMT
etag: W/"655f63fa-2b6c9"
expires: Mon, 27 Nov 2023 21:29:19 GMT
cache-control: max-age=10
pragma: public
cf-cache-status: HIT
age: 4
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd774e7af4b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
200 OK 811 B URL GET HTTP/3 creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
IP
Requested by https://tsyndicate.com/iframes2/449e4fe3501746fda88f88df1f88ddf7.html?keywords=Deltarune%20Noelle%20Holiday%20Collection%20Part%202%20(R34)%20-%20576%2F1526&subid=1863026-2407948-32-30-0-windows-windows%2B10-no&adb=0&clientjs=1&w=1280&h=1024&tz=0
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint11:C8:29:33:4C:A0:2A:F3:EF:92:BC:95:11:62:B8:7A:AD:73:70:42
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (872), with no line terminators
Hash c72e056cd01671e0e53e1be37e5b29ec
44d2211f84a922401458d095aa595a3320040c96
5609d268dd4d7959a25a6a7f3c8ec2c1c4f93f54819a1623dfc4bc46bb0084e0
GET /widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=IDzZPdETghcCF_ROsuj1pxWrcCy21FCMOusZSTSxuIn5yPKRheN-4XB7R-ikL_VMMohgkT6_JliMY66YhtjLw9g1H5OY8jyRIzBDrPlBCfHPuEk_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1 HTTP/1.1
Host: creative.fxmnba.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tsyndicate.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 27 Nov 2023 21:29:17 GMT
content-type: text/html
last-modified: Thu, 23 Nov 2023 14:37:17 GMT
expires: Mon, 27 Nov 2023 21:29:12 GMT
cache-control: max-age=10
strict-transport-security: max-age=15768000
pragma: public
report-to: { "endpoints":[{ "url": "https://go.stripchat.com/report" }], "group": "default", "max_age": 1048576 }
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cf-cache-status: HIT
age: 10
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd77396c5db500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
go.bbrdbr.com/config?url=https%3A%2F%2Fcreative.bbrdbr.com%2Fwidgets%2Fv4%2FUniversal%3Ftag%3Dgirls%26thumbsMargin%3D0%26gridRows%3D1%26gridColumns%3D1%26sourceId%3D300cps2girlwl%26creativeId%3D300cps2girlwl%26responsive%3D0%26hideButton%3D1%26hideTitle%3D1%26userId%3Debe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75%26autoplay%3Dall%26autoplayForce%3D1%26action%3DsbSignupWithModel%26memberId%3D%7Bclickid%7D
200 OK 6.8 kB URL GET HTTP/2 go.bbrdbr.com/config?url=https%3A%2F%2Fcreative.bbrdbr.com%2Fwidgets%2Fv4%2FUniversal%3Ftag%3Dgirls%26thumbsMargin%3D0%26gridRows%3D1%26gridColumns%3D1%26sourceId%3D300cps2girlwl%26creativeId%3D300cps2girlwl%26responsive%3D0%26hideButton%3D1%26hideTitle%3D1%26userId%3Debe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75%26autoplay%3Dall%26autoplayForce%3D1%26action%3DsbSignupWithModel%26memberId%3D%7Bclickid%7D
IP
Requested by https://creative.bbrdbr.com/widgets/v4/Universal?tag=girls&thumbsMargin=0&gridRows=1&gridColumns=1&sourceId=300cps2girlwl&creativeId=300cps2girlwl&responsive=0&hideButton=1&hideTitle=1&userId=ebe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75&autoplay=all&autoplayForce=1&action=sbSignupWithModel&memberId={clickid}
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint2A:9F:63:77:CB:A5:1C:FD:6E:10:F5:29:D2:FB:51:F4:7C:EC:36:A2
ValiditySun, 26 Feb 2023 00:00:00 GMT - Sun, 25 Feb 2024 23:59:59 GMT
File type ASCII text, with very long lines (8856), with no line terminators
Hash c069232f06b74a964b337fda51d46e90
4790f2bc83320591314614bab61688b903bdd24d
514c87683773433572e8cfa969d3eb4d34108d6e585f10d33f4d38a2a07c4c8e
GET /config?url=https%3A%2F%2Fcreative.bbrdbr.com%2Fwidgets%2Fv4%2FUniversal%3Ftag%3Dgirls%26thumbsMargin%3D0%26gridRows%3D1%26gridColumns%3D1%26sourceId%3D300cps2girlwl%26creativeId%3D300cps2girlwl%26responsive%3D0%26hideButton%3D1%26hideTitle%3D1%26userId%3Debe1e2aa04642c4dc9f7e9a5dfdb455c9ef1b6825ab8b9414a96e56e40140e75%26autoplay%3Dall%26autoplayForce%3D1%26action%3DsbSignupWithModel%26memberId%3D%7Bclickid%7D HTTP/1.1
Host: go.bbrdbr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://creative.bbrdbr.com/
Origin: https://creative.bbrdbr.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
access-control-allow-origin: https://creative.bbrdbr.com
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
last-modified: Mon, 27 Nov 2023 21:21:07 GMT
cf-cache-status: HIT
age: 191
vary: Accept-Encoding
server: cloudflare
cf-ray: 82cd7745db805696-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
stripchat.com/checkUrl
200 OK 15 B IP
Requested by https://creative.fxmnba.com/widgets/v4/Universal?action=sbSignupWithModel&buttonColor=%23930606&campaignId=128029786fbed96fe880330bb083ecce41e122ba08e2711908bc9493ef368344&campaignType=smartpop&creativeId=d61a8beea3946d486612a3452b3d53ba84299ee51efd9260534d85230347af08&iterationId=765913&liveBadgeColor=%23ff0707&masterSmartpopId=1914&memberId=b1UHLWQsNx9qQ965j9-sVOlQz5EjkOVTppvne3th9rb1TP0io6xauo2nueV7tlCX4hzBChUxR92ZPMr5L-y1gdYYxIsgMIWxVWAyaD0kwSCPWVU_gUIDRUi&mlView=1&p1=3803312&quality=240p&ruleId=17&smartpopId=1548&sourceId=271333&usePreroll=0&userId=ed4e3449202a44afa8131507a9d12a1c962321860e4bfcc2aa1b33a18897b60e&variationId=32246&webp=1
Certificate IssuerCloudflare, Inc.
Subjectstripchat.com
FingerprintC0:02:7B:8A:1C:D4:CF:03:00:4A:76:E5:EE:AD:2C:13:CC:2D:4E:6A
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash 1d644ae7e24f3430d634f21c1d94a975
5752bf80588493a9914d4fddf9ed3b31857d90ac
c9df5a7f763aff50375511af681843ba40d4d6ce044521c440515f7e04a2bff7
GET /checkUrl HTTP/1.1
Host: stripchat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, br
Referer: https://creative.fxmnba.com/
Origin: https://creative.fxmnba.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 27 Nov 2023 21:29:19 GMT
content-type: application/json
content-length: 15
access-control-allow-origin: https://creative.fxmnba.com
cf-cache-status: DYNAMIC
set-cookie: __cflb=02DiuFntVtrkFMde1diFtg6nocEFEWohTpAY2gAedp22p; SameSite=None; Secure; path=/; expires=Tue, 28-Nov-23 20:29:19 GMT; HttpOnly
server: cloudflare
cf-ray: 82cd7745e80ab511-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
172.64.97.22
93.93.51.201
148.251.120.78
104.18.63.130
185.94.236.253
45.131.147.145
0.0.0.0
185.196.197.35