gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
172.217.21.161 21 kB URL gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
IP 172.217.21.161:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (12266)
Hash 7a58fe26cd16f34e82ce31afadea46af
b960aa1b42f98141f95a3d8ebb4e9404ae4dd685
42f0910c28dfc7ae97f5ab29e72ccfa91492a3e29c0f0b7b2f1d1cd8ec5ffbf8
GET /2023/09/download-borneo-schematics-tool-v60.html HTTP/1.1
Host: gsmzakiritaly.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
expires: Sun, 03 Dec 2023 21:45:33 GMT
date: Sun, 03 Dec 2023 21:45:33 GMT
cache-control: private, max-age=0
last-modified: Sun, 03 Dec 2023 19:24:17 GMT
etag: W/"c3078c6430801f04bd837713a91bc48c4b3cb92a7e9fd4a7da609ec0a0e4bde7"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 21205
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.jsdelivr.net/gh/jettheme/js@0.5.5/main.js
151.101.129.229 6.3 kB URL cdn.jsdelivr.net/gh/jettheme/js@0.5.5/main.js
IP 151.101.129.229:0
File type ASCII text, with very long lines (12577)
Hash 6fde6634cd4204232b3d56c45f4666fc
ea49ad939d97cba1cffd6af6471d525d07b07340
94b103190c505e7ce35a8f196437db358e5d45c0071c0f65231c0e6211316826
GET /gh/jettheme/js@0.5.5/main.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 0.5.5
x-jsd-version-type: version
etag: W/"3122-6kmtk52Xy6HP/Wr2Rx1SXQewc0A"
content-encoding: br
accept-ranges: bytes
date: Sun, 03 Dec 2023 21:45:34 GMT
age: 3536600
x-served-by: cache-fra-eddf8230104-FRA, cache-bma1668-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6319
X-Firefox-Spdy: h2
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css
151.101.129.229 26 kB URL cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css
IP 151.101.129.229:0
File type Unicode text, UTF-8 text, with very long lines (65306)
Hash 94994c66fec8c3468b269dc0cc242151
ec16bd19bf4ae9bc2e2336ac409a503bbbdaacad
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
GET /npm/bootstrap@5.1.3/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 5.1.3
x-jsd-version-type: version
etag: W/"28021-7Ba9Gb9K6bwuIzasQJpQO7varK0"
content-encoding: br
accept-ranges: bytes
date: Sun, 03 Dec 2023 21:45:34 GMT
age: 17136325
x-served-by: cache-fra-eddf8230037-FRA, cache-bma1668-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 26333
X-Firefox-Spdy: h2
www.profitablecreativeformat.com/cae0cd89ee87f4aee0fd50e5bdb9f34f/invoke.js
173.233.137.36 11 kB URL www.profitablecreativeformat.com/cae0cd89ee87f4aee0fd50e5bdb9f34f/invoke.js
IP 173.233.137.36:0
File type exported SGML document, ASCII text, with very long lines (29622), with no line terminators
Hash 1bbbb1ff00929c13da3b2f7b15f24173
d35f5de71c24b462d0187bb0ad80b1c7525584fa
d768029bb71859be557f16beaceaaf85f5123793b0545e3c6b39d1fa2745e2e5
GET /cae0cd89ee87f4aee0fd50e5bdb9f34f/invoke.js HTTP/1.1
Host: www.profitablecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:34 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 75d77c72406170c88f5226313827c4f9
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
www.profitablecreativeformat.com/592d00171bc63833e1494511eb426cf1/invoke.js
173.233.137.36 11 kB URL www.profitablecreativeformat.com/592d00171bc63833e1494511eb426cf1/invoke.js
IP 173.233.137.36:0
File type exported SGML document, ASCII text, with very long lines (29607), with no line terminators
Hash 0daf084d2abdbba9e62800245d5091bb
3f713eeb106ce0acc794aebe738e0572e38a4ee2
f308f495c95d010806089be669812a8921a12fe237552161e042bd3d3a22bf42
GET /592d00171bc63833e1494511eb426cf1/invoke.js HTTP/1.1
Host: www.profitablecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:34 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9f883dc8ffb147be46f21a4f75967f8d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
proftrafficcounter.com/stats
18.184.210.76 40 B URL proftrafficcounter.com/stats
IP 18.184.210.76:0
File type ASCII text, with no line terminators
Hash c93a7e69fc4e1224ba1846c1a4a0ba5a
2468e838936e68462e8c8005ae5ef5235178c860
200e607c4b8e839247d693372add735140070f4b8691d517f7620645de845823
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 21:45:34 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://gsmzakiritaly.blogspot.com
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Wed, 30 Nov 2033 21:45:34 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
proftrafficcounter.com/stats
18.184.210.76 40 B URL proftrafficcounter.com/stats
IP 18.184.210.76:0
File type ASCII text, with no line terminators
Hash c93a7e69fc4e1224ba1846c1a4a0ba5a
2468e838936e68462e8c8005ae5ef5235178c860
200e607c4b8e839247d693372add735140070f4b8691d517f7620645de845823
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 03 Dec 2023 21:45:35 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://gsmzakiritaly.blogspot.com
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
www.profitablecreativeformat.com/592d00171bc63833e1494511eb426cf1/invoke.js
173.233.137.36 11 kB URL www.profitablecreativeformat.com/592d00171bc63833e1494511eb426cf1/invoke.js
IP 173.233.137.36:0
File type exported SGML document, ASCII text, with very long lines (29592), with no line terminators
Hash 5d54b8ea34b84bf40ec9d8ad0212ff78
098fb83d2c0eb25e40b9d05b3d67147e2ca4629b
58fbfd707db3ab73aed160470c0f8b80f818193f800b493e786fb00b3db4939b
GET /592d00171bc63833e1494511eb426cf1/invoke.js HTTP/1.1
Host: www.profitablecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5360de32f2b05f6c1285418f07c50a55
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
pl20005622.toprevenuegate.com/15/7e/23/157e23c5b697fe50125b06bcfa02ee87.js
173.233.137.52 16 kB URL pl20005622.toprevenuegate.com/15/7e/23/157e23c5b697fe50125b06bcfa02ee87.js
IP 173.233.137.52:0
File type ASCII text, with very long lines (42838), with no line terminators
Hash ce261a16ffd3f2a768ca345ced589043
af639aece3ac50fc742a9b264e9ece580f3560ee
d4f0ce2736adfaee67b1b5053533f3839e2d10027cfe1eb8eba599c2e2f12c4e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /15/7e/23/157e23c5b697fe50125b06bcfa02ee87.js HTTP/1.1
Host: pl20005622.toprevenuegate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2df041de44f8f679fb44d6e32d82d57f
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqExOsX3LnkQKNleq-XSDcVoIvGc4VXkzZGm0KH5cj4NTS4tVltwZ9Idso_jrXKbrjdHDD9OkIor9ZFDkeCkk39GRjuYPfq3FY_kOJAt9pwulP_ZVldMJG2LDPfg6pNiprBaR3tSQaobDxDYXv8VocDxFVkc5i56RxHspk2yhyphenhyphenE-VhMXKfX46NjtAzttXl/s452/IMG-20230926-WA0049.jpg
142.250.74.97 22 kB URL blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqExOsX3LnkQKNleq-XSDcVoIvGc4VXkzZGm0KH5cj4NTS4tVltwZ9Idso_jrXKbrjdHDD9OkIor9ZFDkeCkk39GRjuYPfq3FY_kOJAt9pwulP_ZVldMJG2LDPfg6pNiprBaR3tSQaobDxDYXv8VocDxFVkc5i56RxHspk2yhyphenhyphenE-VhMXKfX46NjtAzttXl/s452/IMG-20230926-WA0049.jpg
IP 142.250.74.97:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 452x376, components 3\012- data
Hash ebf5c03efebf9628d3dd80afaa23ea91
c5f9ea3e29cb95aa51fcf3203a53b5d20a5ac48c
7016c89255a9fb85367541b206fed089303d419fb1355ec9fbd8f04d0804b3e5
GET /img/b/R29vZ2xl/AVvXsEiqExOsX3LnkQKNleq-XSDcVoIvGc4VXkzZGm0KH5cj4NTS4tVltwZ9Idso_jrXKbrjdHDD9OkIor9ZFDkeCkk39GRjuYPfq3FY_kOJAt9pwulP_ZVldMJG2LDPfg6pNiprBaR3tSQaobDxDYXv8VocDxFVkc5i56RxHspk2yhyphenhyphenE-VhMXKfX46NjtAzttXl/s452/IMG-20230926-WA0049.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v4ad4"
expires: Mon, 04 Dec 2023 21:45:35 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="IMG-20230926-WA0049.jpg"
x-content-type-options: nosniff
date: Sun, 03 Dec 2023 21:45:35 GMT
server: fife
content-length: 21542
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-9PhCWI4sS4WeTlP-EOCWyz5nkylRdhnaUReyxIwPF-11B402l7MmWo0tE3Vqvmg3q6akF6jMedBrLAeLYYVjEA8n957K6hw5OdwXrk-BcIhKLcnSDI3KVYUbfZxdkoQUZJgCSC0eu8_E9zWZp4eBkryHTEMvw9Lq4miFh35hf6UJBT_l0Z0yOWVhtdGF/w640-h394/images%20(25).jpeg
142.250.74.97 90 kB URL blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-9PhCWI4sS4WeTlP-EOCWyz5nkylRdhnaUReyxIwPF-11B402l7MmWo0tE3Vqvmg3q6akF6jMedBrLAeLYYVjEA8n957K6hw5OdwXrk-BcIhKLcnSDI3KVYUbfZxdkoQUZJgCSC0eu8_E9zWZp4eBkryHTEMvw9Lq4miFh35hf6UJBT_l0Z0yOWVhtdGF/w640-h394/images%20(25).jpeg
IP 142.250.74.97:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 640x393, components 3\012- data
Hash 0159b6a2e136e72546fb1d764a5c0edb
9c899e0007e34e5ec6c6dac697da572920e31b38
890dc30b808633274cd2afaca7b2f24cee3322caa5248621b738ee4b4a674732
GET /img/b/R29vZ2xl/AVvXsEg-9PhCWI4sS4WeTlP-EOCWyz5nkylRdhnaUReyxIwPF-11B402l7MmWo0tE3Vqvmg3q6akF6jMedBrLAeLYYVjEA8n957K6hw5OdwXrk-BcIhKLcnSDI3KVYUbfZxdkoQUZJgCSC0eu8_E9zWZp4eBkryHTEMvw9Lq4miFh35hf6UJBT_l0Z0yOWVhtdGF/w640-h394/images%20(25).jpeg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v4ada"
expires: Mon, 04 Dec 2023 21:45:35 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="images (25).jpeg"
x-content-type-options: nosniff
date: Sun, 03 Dec 2023 21:45:35 GMT
server: fife
content-length: 90490
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
evaporatehorizontally.com/watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
173.233.137.52 0 B URL evaporatehorizontally.com/watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
IP 173.233.137.52:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1 HTTP/1.1
Host: evaporatehorizontally.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Credentials: true
Location: https://evaporatehorizontally.com/watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=7f3fe07f927566ffe80fcf69529bc7b989006dd893fc1d78d87cc37b78c97a8b2e85df3c41377e3b925182ec4d47e9608a53d85d44efe7b305a922d553142d1298a92b1ee9eabe4f972544d0b6dc92fa42e7e21cf9f744b93083d6d16bbac2&pst=1701639995&rmtc=t
Set-Cookie: u_pl=19905081; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTA4MSwiayI6ImNhZTBjZDg5ZWU4N2Y0YWVlMGZkNTBlNWJkYjlmMzRmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyMywicHQiOjQsInBrIjoieXY2OXhhYWkiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.YIozVaS6BPzb7K1xda7KweofeCQ05kxOE4b4S5vrCjU; expires=Sun, 03 Dec 2023 21:46:35 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6942a8eff49744444c83fb07ef9b4699
Strict-Transport-Security: max-age=0; includeSubdomains
gracesmallerland.com/watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
192.243.59.12 0 B URL gracesmallerland.com/watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
IP 192.243.59.12:0
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1 HTTP/1.1
Host: gracesmallerland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Credentials: true
Location: https://gracesmallerland.com/watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=a9cdac2db1ce4d6083589b666dcf641689ecc312582a6239d6f6a31808b963381c476bf19cdb97eeebde83ff71886cc02e46f62bca1e17f76d53b08180a54f5d6e5b9067af142ed3e66f02d4a2f1351a73181471a3699b195c7a7e25d7026a&pst=1701639995&rmtc=t
Set-Cookie: u_pl=19905106; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.U8z-LD5kBWR5wXFx32NKIWu2bBAgo2kM6nH0COyoZ7U; expires=Sun, 03 Dec 2023 21:46:35 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: bcfe6b80b5b52dc7c4db0b1dc95cca62
Strict-Transport-Security: max-age=0; includeSubdomains
rotundfetch.com/watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
192.243.61.227 0 B URL rotundfetch.com/watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
IP 192.243.61.227:0
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1 HTTP/1.1
Host: rotundfetch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Credentials: true
Location: https://rotundfetch.com/watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=20e285f1e7a6140b5dd23b3d90092d435f602323286e004ec4ac986a7481360c0c31a9fe4e2db4bebfba76145de1036988659f5a334a94a255cfaa6e44caddb107991c9c817824fb22532938b845c54019543065a2674c0ba3ce0a84eea220&pst=1701639995&rmtc=t
Set-Cookie: u_pl=19905106; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.U8z-LD5kBWR5wXFx32NKIWu2bBAgo2kM6nH0COyoZ7U; expires=Sun, 03 Dec 2023 21:46:35 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 69b1353539572df38a5806c4c7b3d9a1
Strict-Transport-Security: max-age=0; includeSubdomains
evaporatehorizontally.com/watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=7f3fe07f927566ffe80fcf69529bc7b989006dd893fc1d78d87cc37b78c97a8b2e85df3c41377e3b925182ec4d47e9608a53d85d44efe7b305a922d553142d1298a92b1ee9eabe4f972544d0b6dc92fa42e7e21cf9f744b93083d6d16bbac2&pst=1701639995&rmtc=t
173.233.137.52 641 B URL evaporatehorizontally.com/watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=7f3fe07f927566ffe80fcf69529bc7b989006dd893fc1d78d87cc37b78c97a8b2e85df3c41377e3b925182ec4d47e9608a53d85d44efe7b305a922d553142d1298a92b1ee9eabe4f972544d0b6dc92fa42e7e21cf9f744b93083d6d16bbac2&pst=1701639995&rmtc=t
IP 173.233.137.52:0
File type HTML document text\012- HTML document, ASCII text, with very long lines (603)
Hash 1f09f8240bde7f5e3efed09611c3ad29
1e49b1c8b5c20377a5569eaef45538314d7796f8
f9aca342959f54240b3c2916d58304fbd351298578ae6a76eae6b2dc2953dbc7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.266376837451.js?key=cae0cd89ee87f4aee0fd50e5bdb9f34f&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=7f3fe07f927566ffe80fcf69529bc7b989006dd893fc1d78d87cc37b78c97a8b2e85df3c41377e3b925182ec4d47e9608a53d85d44efe7b305a922d553142d1298a92b1ee9eabe4f972544d0b6dc92fa42e7e21cf9f744b93083d6d16bbac2&pst=1701639995&rmtc=t HTTP/1.1
Host: evaporatehorizontally.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
Referer: https://gsmzakiritaly.blogspot.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=19905081; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTA4MSwiayI6ImNhZTBjZDg5ZWU4N2Y0YWVlMGZkNTBlNWJkYjlmMzRmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyMywicHQiOjQsInBrIjoieXY2OXhhYWkiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.YIozVaS6BPzb7K1xda7KweofeCQ05kxOE4b4S5vrCjU
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:35 GMT; secure; SameSite=None
iprc3a1405634423a855a5b94f2604c0118b=2717343; expires=Mon, 04 Dec 2023 23:45:35 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
uncs=1; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
pdhtkv23=true; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
uncs23=1; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5e57ce43f8f9aed01059e2dbbefcaa9b
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
gracesmallerland.com/watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=a9cdac2db1ce4d6083589b666dcf641689ecc312582a6239d6f6a31808b963381c476bf19cdb97eeebde83ff71886cc02e46f62bca1e17f76d53b08180a54f5d6e5b9067af142ed3e66f02d4a2f1351a73181471a3699b195c7a7e25d7026a&pst=1701639995&rmtc=t
192.243.59.12 644 B URL gracesmallerland.com/watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=a9cdac2db1ce4d6083589b666dcf641689ecc312582a6239d6f6a31808b963381c476bf19cdb97eeebde83ff71886cc02e46f62bca1e17f76d53b08180a54f5d6e5b9067af142ed3e66f02d4a2f1351a73181471a3699b195c7a7e25d7026a&pst=1701639995&rmtc=t
IP 192.243.59.12:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document, ASCII text, with very long lines (604)
Hash 6c9ee7bf4686ac64dc190f3084cadd83
b5214c3f7d8622487b7683533d64db8bfbba590a
0db754e3dbffc24a2cbe78417e769ef2b71a666e71928ce3ab6862aaee8ddff7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.450485246463.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=a9cdac2db1ce4d6083589b666dcf641689ecc312582a6239d6f6a31808b963381c476bf19cdb97eeebde83ff71886cc02e46f62bca1e17f76d53b08180a54f5d6e5b9067af142ed3e66f02d4a2f1351a73181471a3699b195c7a7e25d7026a&pst=1701639995&rmtc=t HTTP/1.1
Host: gracesmallerland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
Referer: https://gsmzakiritaly.blogspot.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=19905106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.U8z-LD5kBWR5wXFx32NKIWu2bBAgo2kM6nH0COyoZ7U
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:35 GMT; secure; SameSite=None
iprc7d1f7361dc08c0f6a8aed6a236638235=2717340; expires=Mon, 04 Dec 2023 23:45:35 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
uncs=1; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
pdhtkv5=true; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
uncs5=1; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: aff6da9b9af93f7a6e188f287d1d9efc
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
rotundfetch.com/watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=20e285f1e7a6140b5dd23b3d90092d435f602323286e004ec4ac986a7481360c0c31a9fe4e2db4bebfba76145de1036988659f5a334a94a255cfaa6e44caddb107991c9c817824fb22532938b845c54019543065a2674c0ba3ce0a84eea220&pst=1701639995&rmtc=t
192.243.61.227 2.1 kB URL rotundfetch.com/watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=20e285f1e7a6140b5dd23b3d90092d435f602323286e004ec4ac986a7481360c0c31a9fe4e2db4bebfba76145de1036988659f5a334a94a255cfaa6e44caddb107991c9c817824fb22532938b845c54019543065a2674c0ba3ce0a84eea220&pst=1701639995&rmtc=t
IP 192.243.61.227:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document, ASCII text, with very long lines (2655)
Hash b65e06e9a9f2b9cafcac21f0fba2302a
7fe781b713a4af41d6580d8fbf65d292a8fffa52
a18ae739fe1daa7dc4c68bdc35e9e19238add16520fa73e4ab2e4c805cd007b9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.768810082523.js?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&shu=20e285f1e7a6140b5dd23b3d90092d435f602323286e004ec4ac986a7481360c0c31a9fe4e2db4bebfba76145de1036988659f5a334a94a255cfaa6e44caddb107991c9c817824fb22532938b845c54019543065a2674c0ba3ce0a84eea220&pst=1701639995&rmtc=t HTTP/1.1
Host: rotundfetch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://gsmzakiritaly.blogspot.com
Referer: https://gsmzakiritaly.blogspot.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=19905106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.U8z-LD5kBWR5wXFx32NKIWu2bBAgo2kM6nH0COyoZ7U
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:35 GMT; secure; SameSite=None
iprcf66bc0d91d49757fa98af0a02974f020=3569806; expires=Mon, 04 Dec 2023 01:45:35 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
uncs=1; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
pdhtkv5=true; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
uncs5=1; expires=Mon, 04 Dec 2023 21:45:35 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a8dc513427b5ba576aa685aae33245fc
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
gsmzakiritaly.blogspot.com/2023/09/download-miracle-power-tools-v33.html
172.217.21.161 22 kB URL gsmzakiritaly.blogspot.com/2023/09/download-miracle-power-tools-v33.html
IP 172.217.21.161:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (12266)
Hash 27dc2dcb3da0a4acc1149a0a27ba5ce1
8e33f3571272db111d5f3be4c1759122b7480e15
67e91b5c26ef36938e9ba31b4024b2afdb33ba992b21994081f0ff90761c585f
GET /2023/09/download-miracle-power-tools-v33.html HTTP/1.1
Host: gsmzakiritaly.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/html
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
Cookie: dom3ic8zudi28v8lr6fgphwffqoz0j6c=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
expires: Sun, 03 Dec 2023 21:45:35 GMT
date: Sun, 03 Dec 2023 21:45:35 GMT
cache-control: private, max-age=0
last-modified: Sun, 03 Dec 2023 19:24:17 GMT
etag: W/"c3078c6430801f04bd837713a91bc48c4b3cb92a7e9fd4a7da609ec0a0e4bde7"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 21723
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
gracesmallerland.com/watch.450485246463?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
192.243.59.12 1.5 kB URL gracesmallerland.com/watch.450485246463?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
IP 192.243.59.12:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (1056)
Hash ae268eb40873b186f2e908f8a456a6b4
597edf6d2e8557cfa92b76b48fa18288c147dc52
b3bfc17b540f2ad56bf82546d86fc0da6dd357223eecbe859c20e56e261fad8b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.450485246463?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1 HTTP/1.1
Host: gracesmallerland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Cookie: u_pl=19905106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.U8z-LD5kBWR5wXFx32NKIWu2bBAgo2kM6nH0COyoZ7U; uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; iprc7d1f7361dc08c0f6a8aed6a236638235=2717340; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 21:45:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoyLCJhdSI6MiwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjpmYWxzZSwiciI6Imh0dHBzOi8vZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20vMjAyMy8wOS9kb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sIiwiYXIiOltdfX0.ZjZQNLVFU1aYtWIvTLv7LuIY6FCmo2tUpIkgZbM931s; expires=Sun, 03 Dec 2023 21:46:36 GMT; secure; SameSite=None
uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:36 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0b970f9944f3885bde2755b2f164b07b
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
rotundfetch.com/watch.768810082523?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
192.243.61.227 1.6 kB URL rotundfetch.com/watch.768810082523?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
IP 192.243.61.227:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (1088)
Hash 5b4dea7eeb1da8bb3eccf6b61c04283e
df0cc4d9b28f52a11d4955cc777f95633bce9a26
3cc6d69f4624f3fd0b1310aa4fcf96e323e9d7142eae7a184f5e2dc8db3f31bf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.768810082523?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1 HTTP/1.1
Host: rotundfetch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Cookie: u_pl=19905106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8yMDIzLzA5L2Rvd25sb2FkLWJvcm5lby1zY2hlbWF0aWNzLXRvb2wtdjYwLmh0bWwiLCJhciI6W119fQ.U8z-LD5kBWR5wXFx32NKIWu2bBAgo2kM6nH0COyoZ7U; uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; iprcf66bc0d91d49757fa98af0a02974f020=3569806; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoyLCJhdSI6MiwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjpmYWxzZSwiciI6Imh0dHBzOi8vZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20vMjAyMy8wOS9kb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sIiwiYXIiOltdfX0.ZjZQNLVFU1aYtWIvTLv7LuIY6FCmo2tUpIkgZbM931s; expires=Sun, 03 Dec 2023 21:46:36 GMT; secure; SameSite=None
uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:36 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4d96a3efe04ccaa7248d67b40ddf1c28
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
rotundfetch.com/api/users?token=L3dhdGNoLjc2ODgxMDA4MjUyMz9kZXY9ZSZrZXk9NTkyZDAwMTcxYmM2MzgzM2UxNDk0NTExZWI0MjZjZjEma3c9JTVCJTI2cXVvdCUzQmRvd25sb2FkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jib3JuZW8lMjZxdW90JTNCJTJDJTI2cXVvdCUzQnNjaGVtYXRpY3MlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnRvb2wlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnY2JTI2cXVvdCUzQiUyQyUyNnF1b3QlM0IwJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JpbnN0YWxsYXRpb24lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmZpbGUlRTIlOUMlODUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQi0lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmdzbSUyNnF1b3QlM0IlMkMlMjZxdW90JTNCemFraXIlMjZxdW90JTNCJTVEJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYyMDIzJTJGMDklMkZkb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sJnJlcz0xNC4zMDk1JnJtdGM9dCZzaHU9N2FkOWZlMGY4ZjJkOWQwOGE1ZjQ3MjMxYzZjNGRmODRkMDJlOWFhMmJiZGQxZjlmYzNjMWM0MWZmOTI5ZGRiZTBlNWJlNGJiNTk5Y2NmY2I2MzM1MDAyMzdmYmZkNDhkYTUzOTk4ZTIzY2NkZmM0MDBlZGI1N2NjOTUzODU5ZTdlZDc3ZWNjNmY0NjFiZTI3N2EwOWMzZWIyZTAzNTEyMWVlYmQyNTIxNDhmN2VkMDE4NTI5MWQ4YzI3YzdmNSZ0ej0wJnV1aWQ9NDhjMjMwMzItYjU2ZS00MThiLTkyMDQtMDYxYmUxY2RjZTY0JTNBMyUzQTE%3D&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&pii=&in=false
192.243.61.227 1.9 kB URL rotundfetch.com/api/users?token=L3dhdGNoLjc2ODgxMDA4MjUyMz9kZXY9ZSZrZXk9NTkyZDAwMTcxYmM2MzgzM2UxNDk0NTExZWI0MjZjZjEma3c9JTVCJTI2cXVvdCUzQmRvd25sb2FkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jib3JuZW8lMjZxdW90JTNCJTJDJTI2cXVvdCUzQnNjaGVtYXRpY3MlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnRvb2wlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnY2JTI2cXVvdCUzQiUyQyUyNnF1b3QlM0IwJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JpbnN0YWxsYXRpb24lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmZpbGUlRTIlOUMlODUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQi0lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmdzbSUyNnF1b3QlM0IlMkMlMjZxdW90JTNCemFraXIlMjZxdW90JTNCJTVEJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYyMDIzJTJGMDklMkZkb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sJnJlcz0xNC4zMDk1JnJtdGM9dCZzaHU9N2FkOWZlMGY4ZjJkOWQwOGE1ZjQ3MjMxYzZjNGRmODRkMDJlOWFhMmJiZGQxZjlmYzNjMWM0MWZmOTI5ZGRiZTBlNWJlNGJiNTk5Y2NmY2I2MzM1MDAyMzdmYmZkNDhkYTUzOTk4ZTIzY2NkZmM0MDBlZGI1N2NjOTUzODU5ZTdlZDc3ZWNjNmY0NjFiZTI3N2EwOWMzZWIyZTAzNTEyMWVlYmQyNTIxNDhmN2VkMDE4NTI5MWQ4YzI3YzdmNSZ0ej0wJnV1aWQ9NDhjMjMwMzItYjU2ZS00MThiLTkyMDQtMDYxYmUxY2RjZTY0JTNBMyUzQTE%3D&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&pii=&in=false
IP 192.243.61.227:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2582)
Hash eafff6f389b5bfee6ea32c02d3523227
77d5bb00e993f670e92849d83f5c079d01e13e5f
40d8ce6956f366e8ff0e1e47d963178c82b2e5cceb31a6e073d852ad4e3d06fb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /api/users?token=L3dhdGNoLjc2ODgxMDA4MjUyMz9kZXY9ZSZrZXk9NTkyZDAwMTcxYmM2MzgzM2UxNDk0NTExZWI0MjZjZjEma3c9JTVCJTI2cXVvdCUzQmRvd25sb2FkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jib3JuZW8lMjZxdW90JTNCJTJDJTI2cXVvdCUzQnNjaGVtYXRpY3MlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnRvb2wlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnY2JTI2cXVvdCUzQiUyQyUyNnF1b3QlM0IwJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JpbnN0YWxsYXRpb24lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmZpbGUlRTIlOUMlODUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQi0lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmdzbSUyNnF1b3QlM0IlMkMlMjZxdW90JTNCemFraXIlMjZxdW90JTNCJTVEJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYyMDIzJTJGMDklMkZkb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sJnJlcz0xNC4zMDk1JnJtdGM9dCZzaHU9N2FkOWZlMGY4ZjJkOWQwOGE1ZjQ3MjMxYzZjNGRmODRkMDJlOWFhMmJiZGQxZjlmYzNjMWM0MWZmOTI5ZGRiZTBlNWJlNGJiNTk5Y2NmY2I2MzM1MDAyMzdmYmZkNDhkYTUzOTk4ZTIzY2NkZmM0MDBlZGI1N2NjOTUzODU5ZTdlZDc3ZWNjNmY0NjFiZTI3N2EwOWMzZWIyZTAzNTEyMWVlYmQyNTIxNDhmN2VkMDE4NTI5MWQ4YzI3YzdmNSZ0ej0wJnV1aWQ9NDhjMjMwMzItYjU2ZS00MThiLTkyMDQtMDYxYmUxY2RjZTY0JTNBMyUzQTE%3D&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&pii=&in=false HTTP/1.1
Host: rotundfetch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rotundfetch.com/watch.768810082523?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
Cookie: u_pl=19905106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoyLCJhdSI6MiwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjpmYWxzZSwiciI6Imh0dHBzOi8vZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20vMjAyMy8wOS9kb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sIiwiYXIiOltdfX0.ZjZQNLVFU1aYtWIvTLv7LuIY6FCmo2tUpIkgZbM931s; uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; iprcf66bc0d91d49757fa98af0a02974f020=3569806; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:36 GMT; secure; SameSite=None
uncs=2; expires=Mon, 04 Dec 2023 21:45:36 GMT; secure; SameSite=None
uncs5=2; expires=Mon, 04 Dec 2023 21:45:36 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 83f585885862c89b3e22af1ca626965d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
gracesmallerland.com/api/users?token=L3dhdGNoLjQ1MDQ4NTI0NjQ2Mz9kZXY9ZSZrZXk9NTkyZDAwMTcxYmM2MzgzM2UxNDk0NTExZWI0MjZjZjEma3c9JTVCJTI2cXVvdCUzQmRvd25sb2FkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jib3JuZW8lMjZxdW90JTNCJTJDJTI2cXVvdCUzQnNjaGVtYXRpY3MlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnRvb2wlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnY2JTI2cXVvdCUzQiUyQyUyNnF1b3QlM0IwJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JpbnN0YWxsYXRpb24lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmZpbGUlRTIlOUMlODUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQi0lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmdzbSUyNnF1b3QlM0IlMkMlMjZxdW90JTNCemFraXIlMjZxdW90JTNCJTVEJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYyMDIzJTJGMDklMkZkb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sJnJlcz0xNC4zMDk1JnJtdGM9dCZzaHU9MDY4Njc4MGRmOWY3NGM5MWNlM2Q5NzNkZGY4ZDA2NjBlMWZiZTk3Mjk4NjVlNzFlNzdlMGVjNTFlODM5NGExZDEzNzg1ZjY4MGQwODBkMjNmMjc2MzE3NjBhZjcyMjllNmY4NzBjZDEyMTZmZWIyYzk4ZWQ0MjExNjMxOGY0OTBmOGU5NWM0MzVlYTY4YjkyM2FjOTMzMWVjMzJlMjVhYjg3NTI1ZiZ0ej0wJnV1aWQ9NDhjMjMwMzItYjU2ZS00MThiLTkyMDQtMDYxYmUxY2RjZTY0JTNBMyUzQTE%3D&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&pii=&in=false
192.243.59.12 1.8 kB URL gracesmallerland.com/api/users?token=L3dhdGNoLjQ1MDQ4NTI0NjQ2Mz9kZXY9ZSZrZXk9NTkyZDAwMTcxYmM2MzgzM2UxNDk0NTExZWI0MjZjZjEma3c9JTVCJTI2cXVvdCUzQmRvd25sb2FkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jib3JuZW8lMjZxdW90JTNCJTJDJTI2cXVvdCUzQnNjaGVtYXRpY3MlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnRvb2wlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnY2JTI2cXVvdCUzQiUyQyUyNnF1b3QlM0IwJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JpbnN0YWxsYXRpb24lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmZpbGUlRTIlOUMlODUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQi0lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmdzbSUyNnF1b3QlM0IlMkMlMjZxdW90JTNCemFraXIlMjZxdW90JTNCJTVEJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYyMDIzJTJGMDklMkZkb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sJnJlcz0xNC4zMDk1JnJtdGM9dCZzaHU9MDY4Njc4MGRmOWY3NGM5MWNlM2Q5NzNkZGY4ZDA2NjBlMWZiZTk3Mjk4NjVlNzFlNzdlMGVjNTFlODM5NGExZDEzNzg1ZjY4MGQwODBkMjNmMjc2MzE3NjBhZjcyMjllNmY4NzBjZDEyMTZmZWIyYzk4ZWQ0MjExNjMxOGY0OTBmOGU5NWM0MzVlYTY4YjkyM2FjOTMzMWVjMzJlMjVhYjg3NTI1ZiZ0ej0wJnV1aWQ9NDhjMjMwMzItYjU2ZS00MThiLTkyMDQtMDYxYmUxY2RjZTY0JTNBMyUzQTE%3D&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&pii=&in=false
IP 192.243.59.12:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2565)
Hash 73c167edd9055e8b991e2e8201aab899
e3b18dc62cf068b8469a042b1de403b6ccbf274f
49e4d1b0a0892c68512cc95b10d6e21c4661fc303f1f53355799829376e613db
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /api/users?token=L3dhdGNoLjQ1MDQ4NTI0NjQ2Mz9kZXY9ZSZrZXk9NTkyZDAwMTcxYmM2MzgzM2UxNDk0NTExZWI0MjZjZjEma3c9JTVCJTI2cXVvdCUzQmRvd25sb2FkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jib3JuZW8lMjZxdW90JTNCJTJDJTI2cXVvdCUzQnNjaGVtYXRpY3MlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnRvb2wlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnY2JTI2cXVvdCUzQiUyQyUyNnF1b3QlM0IwJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JpbnN0YWxsYXRpb24lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmZpbGUlRTIlOUMlODUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQi0lMjZxdW90JTNCJTJDJTI2cXVvdCUzQmdzbSUyNnF1b3QlM0IlMkMlMjZxdW90JTNCemFraXIlMjZxdW90JTNCJTVEJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYyMDIzJTJGMDklMkZkb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sJnJlcz0xNC4zMDk1JnJtdGM9dCZzaHU9MDY4Njc4MGRmOWY3NGM5MWNlM2Q5NzNkZGY4ZDA2NjBlMWZiZTk3Mjk4NjVlNzFlNzdlMGVjNTFlODM5NGExZDEzNzg1ZjY4MGQwODBkMjNmMjc2MzE3NjBhZjcyMjllNmY4NzBjZDEyMTZmZWIyYzk4ZWQ0MjExNjMxOGY0OTBmOGU5NWM0MzVlYTY4YjkyM2FjOTMzMWVjMzJlMjVhYjg3NTI1ZiZ0ej0wJnV1aWQ9NDhjMjMwMzItYjU2ZS00MThiLTkyMDQtMDYxYmUxY2RjZTY0JTNBMyUzQTE%3D&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1&pii=&in=false HTTP/1.1
Host: gracesmallerland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gracesmallerland.com/watch.450485246463?key=592d00171bc63833e1494511eb426cf1&kw=%5B%22download%22%2C%22borneo%22%2C%22schematics%22%2C%22tool%22%2C%22v6%22%2C%220%22%2C%22installation%22%2C%22file%E2%9C%85%22%2C%22-%22%2C%22gsm%22%2C%22zakir%22%5D&refer=https%3A%2F%2Fgsmzakiritaly.blogspot.com%2F2023%2F09%2Fdownload-borneo-schematics-tool-v60.html&tz=0&dev=e&res=14.3095&uuid=48c23032-b56e-418b-9204-061be1cdce64%3A3%3A1
Cookie: u_pl=19905106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTkwNTEwNiwiayI6IjU5MmQwMDE3MWJjNjM4MzNlMTQ5NDUxMWViNDI2Y2YxIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzQwNDMxLCJwaWQiOjEwNjkxNzcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJuYmhlbWRtdmQiLCJ0IjoxfSwidSI6eyJ1IjoyLCJhdSI6MiwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjpmYWxzZSwiciI6Imh0dHBzOi8vZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20vMjAyMy8wOS9kb3dubG9hZC1ib3JuZW8tc2NoZW1hdGljcy10b29sLXY2MC5odG1sIiwiYXIiOltdfX0.ZjZQNLVFU1aYtWIvTLv7LuIY6FCmo2tUpIkgZbM931s; uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; iprc7d1f7361dc08c0f6a8aed6a236638235=2717340; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 21:45:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
Access-Control-Allow-Origin: https://gsmzakiritaly.blogspot.com/2023/09/download-borneo-schematics-tool-v60.html
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=48c23032-b56e-418b-9204-061be1cdce64:3:1; expires=Sun, 10 Dec 2023 21:45:36 GMT; secure; SameSite=None
uncs=2; expires=Mon, 04 Dec 2023 21:45:36 GMT; secure; SameSite=None
uncs5=2; expires=Mon, 04 Dec 2023 21:45:36 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1388e86c57ff119fe41629e95e7e4136
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
barelydresstraitor.com/pixel/sbe?t=1&error=timeout
173.233.137.44 0 B URL barelydresstraitor.com/pixel/sbe?t=1&error=timeout
IP 173.233.137.44:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbe?t=1&error=timeout HTTP/1.1
Host: barelydresstraitor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:36 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
cdn.cloudimagesb.com/bi/20/e3/73/20e37305f9c2ecb5b587d1f3883a305a/1615305522.jpg
45.133.44.10 80 kB URL cdn.cloudimagesb.com/bi/20/e3/73/20e37305f9c2ecb5b587d1f3883a305a/1615305522.jpg
IP 45.133.44.10:0
ASN #39572 DataWeb Global Group B.V.
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Windows), datetime=2021:02:25 16:33:19 DIY-Thermocam raw data\012- (Lepton 2.x), scale 19557-26228, spot sensor temperature 1125978593735313417306112.000000, unit celsius, color scheme 0, calibration: offset 32.000000, slope 1148166967002312781328285696.000000], baseline, precision 8, 300x250, components 3\012- data
Hash 289da76e26976ad373111d5b46ee343c
e9c46a40e8a4e18fcb87d405a55fdd7822bee76d
c9c6641d1d5c1edb8b52b5b3c70aea99acca261902ac9f23046c60a0535b7886
GET /bi/20/e3/73/20e37305f9c2ecb5b587d1f3883a305a/1615305522.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gracesmallerland.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 21:45:36 GMT
content-type: image/jpeg
content-length: 80197
server: nginx/1.21.6
last-modified: Tue, 09 Mar 2021 15:58:51 GMT
etag: "60479b3b-13945"
expires: Tue, 05 Dec 2023 21:45:36 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/bi/f5/bb/fa/f5bbfa1582e1560a406243d2e1dab0ef/1667985041.jpg
45.133.44.10 21 kB URL cdn.cloudimagesb.com/bi/f5/bb/fa/f5bbfa1582e1560a406243d2e1dab0ef/1667985041.jpg
IP 45.133.44.10:0
ASN #39572 DataWeb Global Group B.V.
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 300x250, components 3\012- data
Hash 167d35c09d694e382879e26697b6cf74
a6f339223ed4b825a3f1efccddfd5c26d67800c8
18bd7ffa3ad1416060b515014d50e03e18f53117a82816035e829590588b40f3
GET /bi/f5/bb/fa/f5bbfa1582e1560a406243d2e1dab0ef/1667985041.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rotundfetch.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 21:45:36 GMT
content-type: image/jpeg
content-length: 20715
server: nginx/1.21.6
last-modified: Wed, 09 Nov 2022 09:10:49 GMT
etag: "636b6e99-50eb"
expires: Tue, 05 Dec 2023 21:45:36 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
conqueredallrightswell.com/dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=19905081
192.243.61.227 1.4 kB URL conqueredallrightswell.com/dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=19905081
IP 192.243.61.227:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (488)
Hash 884b22ddd6e101746279247531456a67
78d2500480f241a7f0ef9a6470e74f0a1b4d9d36
1425f6d4b65b1544ec7e9ecc5c08cfebd9b15ead6608a11a12d8555fa0a0540f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=19905081 HTTP/1.1
Host: conqueredallrightswell.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsmzakiritaly.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=16122660; expires=Mon, 04 Dec 2023 21:45:36 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjEyMjY2MCwiayI6Ijg2MzcwNWJjYmI0YjZhNTU0ZGRiMzU5NjY1Mzk1YTZmIiwic2lkIjoiMTk5MDUwODEiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozLCJhaWQiOjI4LCJwdCI6NCwicGsiOiJkeWZjMWswOSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8iLCJhciI6W119fQ._C5cKkV2tMzTCmwuiW7DCfRr25h90muY9jhN6TGwPVo; expires=Sun, 03 Dec 2023 21:46:36 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 734454d3252c05b3b06661ba521f17bc
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
conqueredallrightswell.com/api/users?token=L2R5ZmMxazA5P2tleT04NjM3MDViY2JiNGI2YTU1NGRkYjM1OTY2NTM5NWE2ZiZwc2lkPTE5OTA1MDgxJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYmcm10Yz10JnNodT02MWQzMTViOTQ0ZmQ4ZGMzYjJlNzA3NGM2YjM5NzM1NjM2ZmJjMjhlNjVjYTRiMzljYzFiN2U3ODg5NGIyMzYxOWJmYjlmZDUwODY2NjQwZDM0MzhiMjM5YzEzZjNkYTdiMTE2ZGI0MmRjYWUwNzBiZTU5NzRjZmU2OTUxMzIwYTc0YzY4MDNhNDkzYmNhN2NlMTczMzY0OTU4ZWEzYjc4YWQxZjUxNDI3M2ZlN2YyYzg0YjFiYzc1ZmM%3D&uuid=&pii=&in=false
173.233.139.164 0 B URL conqueredallrightswell.com/api/users?token=L2R5ZmMxazA5P2tleT04NjM3MDViY2JiNGI2YTU1NGRkYjM1OTY2NTM5NWE2ZiZwc2lkPTE5OTA1MDgxJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYmcm10Yz10JnNodT02MWQzMTViOTQ0ZmQ4ZGMzYjJlNzA3NGM2YjM5NzM1NjM2ZmJjMjhlNjVjYTRiMzljYzFiN2U3ODg5NGIyMzYxOWJmYjlmZDUwODY2NjQwZDM0MzhiMjM5YzEzZjNkYTdiMTE2ZGI0MmRjYWUwNzBiZTU5NzRjZmU2OTUxMzIwYTc0YzY4MDNhNDkzYmNhN2NlMTczMzY0OTU4ZWEzYjc4YWQxZjUxNDI3M2ZlN2YyYzg0YjFiYzc1ZmM%3D&uuid=&pii=&in=false
IP 173.233.139.164:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /api/users?token=L2R5ZmMxazA5P2tleT04NjM3MDViY2JiNGI2YTU1NGRkYjM1OTY2NTM5NWE2ZiZwc2lkPTE5OTA1MDgxJnBzdD0xNzAxNjM5OTk2JnJlZmVyPWh0dHBzJTNBJTJGJTJGZ3NtemFraXJpdGFseS5ibG9nc3BvdC5jb20lMkYmcm10Yz10JnNodT02MWQzMTViOTQ0ZmQ4ZGMzYjJlNzA3NGM2YjM5NzM1NjM2ZmJjMjhlNjVjYTRiMzljYzFiN2U3ODg5NGIyMzYxOWJmYjlmZDUwODY2NjQwZDM0MzhiMjM5YzEzZjNkYTdiMTE2ZGI0MmRjYWUwNzBiZTU5NzRjZmU2OTUxMzIwYTc0YzY4MDNhNDkzYmNhN2NlMTczMzY0OTU4ZWEzYjc4YWQxZjUxNDI3M2ZlN2YyYzg0YjFiYzc1ZmM%3D&uuid=&pii=&in=false HTTP/1.1
Host: conqueredallrightswell.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://conqueredallrightswell.com/dyfc1k09?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=16122660
Cookie: u_pl=16122660; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjEyMjY2MCwiayI6Ijg2MzcwNWJjYmI0YjZhNTU0ZGRiMzU5NjY1Mzk1YTZmIiwic2lkIjoiMTk5MDUwODEiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozLCJhaWQiOjI4LCJwdCI6NCwicGsiOiJkeWZjMWswOSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9nc216YWtpcml0YWx5LmJsb2dzcG90LmNvbS8iLCJhciI6W119fQ._C5cKkV2tMzTCmwuiW7DCfRr25h90muY9jhN6TGwPVo; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:37 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: https://violationphysics.click/c9b2l0k.php?key=wkroiqew1c9guvr0kbe2&SUB_ID_SHORT=3008fc674a9be62bee28f2f30deeaf75&COST_CPA=0.100000&PLACEMENT_ID=16122660&CAMPAIGN_ID=882703&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2569625
Set-Cookie: iprcde703c2c6a755d52dafdeebef0364ee1=4641329; expires=Mon, 04 Dec 2023 21:45:37 GMT
pdhtkv=true; expires=Mon, 04 Dec 2023 21:45:37 GMT
uncs=1; expires=Mon, 04 Dec 2023 21:45:37 GMT
pdhtkv28=true; expires=Mon, 04 Dec 2023 21:45:37 GMT
uncs28=1; expires=Mon, 04 Dec 2023 21:45:37 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7270a75e155206a4f0040e0c40ec6820
Strict-Transport-Security: max-age=0; includeSubdomains
violationphysics.click/c9b2l0k.php?key=wkroiqew1c9guvr0kbe2&SUB_ID_SHORT=3008fc674a9be62bee28f2f30deeaf75&COST_CPA=0.100000&PLACEMENT_ID=16122660&CAMPAIGN_ID=882703&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2569625
192.64.81.118 0 B URL violationphysics.click/c9b2l0k.php?key=wkroiqew1c9guvr0kbe2&SUB_ID_SHORT=3008fc674a9be62bee28f2f30deeaf75&COST_CPA=0.100000&PLACEMENT_ID=16122660&CAMPAIGN_ID=882703&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2569625
IP 192.64.81.118:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /c9b2l0k.php?key=wkroiqew1c9guvr0kbe2&SUB_ID_SHORT=3008fc674a9be62bee28f2f30deeaf75&COST_CPA=0.100000&PLACEMENT_ID=16122660&CAMPAIGN_ID=882703&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2569625 HTTP/1.1
Host: violationphysics.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conqueredallrightswell.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.22.0
Date: Sun, 03 Dec 2023 21:45:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=h9ik4ka6m7; expires=Mon, 04-Dec-2023 21:45:38 GMT; Max-Age=86400; path=/; secure; SameSite=none
uclickhash=h9ik4ka6m7-h9ik4ka6m7-hq1m-0-q5a4bl-ftxofe-ft8pdz-34570e; expires=Mon, 04-Dec-2023 21:45:38 GMT; Max-Age=86400; path=/; secure; SameSite=none
Location: https://vvfal.rigelbetelgeuse.top/?pl=zKByXHsQK0ydGD7DogbGyA&click_id=fed7fh9ik4ka6m7841&sub_id=16122660
Strict-Transport-Security: max-age=31536000
vvfal.rigelbetelgeuse.top/?pl=zKByXHsQK0ydGD7DogbGyA&click_id=fed7fh9ik4ka6m7841&sub_id=16122660
104.21.22.161 0 B URL vvfal.rigelbetelgeuse.top/?pl=zKByXHsQK0ydGD7DogbGyA&click_id=fed7fh9ik4ka6m7841&sub_id=16122660
IP 104.21.22.161:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?pl=zKByXHsQK0ydGD7DogbGyA&click_id=fed7fh9ik4ka6m7841&sub_id=16122660 HTTP/1.1
Host: vvfal.rigelbetelgeuse.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conqueredallrightswell.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sun, 03 Dec 2023 21:45:38 GMT
content-length: 0
location: https://vvfal.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
set-cookie: zKByXHsQK0ydGD7DogbGyA=5; max-age=345600; path=/; samesite=lax
__pl=0fae961c-2c47-45b7-9352-55daa5f1886e; expires=Wed, 03 Dec 2025 21:45:38 GMT; path=/; samesite=lax
__cap=1; max-age=3600; path=/; samesite=lax
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zQSIUcIm6MEef5thTMv%2F%2Bs1PjSnVwFWJKHHcB1rpWKKf1MmUV4crYXxdCobLI1fIYxr0MTU3FjEo4CzfXEvSwcJ%2B2%2FHn2xrXDEA22M357ivYQRUHOBHk8DZh%2BCqgG3QZafwoiu1pPr%2F7b1v1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82feff6d6b69b4f1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
vvfal.stonecarv.top/eyes-robot/assets/2.png
172.67.154.38 1.1 kB URL vvfal.stonecarv.top/eyes-robot/assets/2.png
IP 172.67.154.38:0
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /eyes-robot/assets/2.png HTTP/1.1
Host: vvfal.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:38 GMT
content-type: image/png
content-length: 1061
last-modified: Fri, 01 Dec 2023 10:07:50 GMT
etag: "6569b076-425"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3729
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DxZndRf4XcQ%2BvGaH%2BcZaVpzZhVu2G4Xr7vnFiMtHDrrZV7ae8lsGzdtoQZ8ps%2BgQSKFY4U%2Ba7gBeS%2F%2FVL1EI0Y8MQWQWX3CjgrOZNxzt6bQR00MTcgSOGWNAWU9v1UEhyX7%2BP2rf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff6f5a12b524-OSL
alt-svc: h3=":443"; ma=86400
vvfal.stonecarv.top/eyes-robot/assets/1.png
172.67.154.38 11 kB URL vvfal.stonecarv.top/eyes-robot/assets/1.png
IP 172.67.154.38:0
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /eyes-robot/assets/1.png HTTP/1.1
Host: vvfal.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:38 GMT
content-type: image/png
content-length: 10591
last-modified: Fri, 01 Dec 2023 10:07:50 GMT
etag: "6569b076-295f"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3729
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P7BxWrpcFcVmi%2BYUVjwsUvIK4BN6cxBh8woKcig9paAbhlYY4pJpGdwIyS5UkXWUvIERK3VXYHwa9au9%2FwhQt%2F6HwiBynPm7cdXrpwkMcbh5wgHfVzo6WwHs%2BxqMcp2a%2BRn5NTz8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff6f5a0fb524-OSL
alt-svc: h3=":443"; ma=86400
vvfal.stonecarv.top/eyes-robot/assets/trls.js
172.67.154.38 13 kB URL vvfal.stonecarv.top/eyes-robot/assets/trls.js
IP 172.67.154.38:0
File type Unicode text, UTF-8 text, with very long lines (362), with CRLF line terminators
Hash 0cdacbfa8d68265ac3893b159a75682a
a85878b59036d00ac878739dc187305bc29df8c3
2fb2aad4f3b3426df4bb5633b627f529940bd06d0690f6b11cfcf42f0fea3e4b
GET /eyes-robot/assets/trls.js HTTP/1.1
Host: vvfal.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:38 GMT
content-type: application/javascript
last-modified: Fri, 01 Dec 2023 10:07:50 GMT
etag: W/"6569b076-2af6"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3729
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oSwGhums51Fmc14%2BJJ2lu5wHyBmutXn4Ipjvgg78TZIk4aITfGJwASdnTgSYjeP2hl7p3hwQeLX0wsRL12xgFMzB%2FTvY0GwDj1Mf5BFa90u3eq4MMyd0s%2F6iK8WZ8K6MBhLr59Dr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff6f5a08b524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
vvfal.stonecarv.top/favicon.ico
172.67.154.38 0 B URL vvfal.stonecarv.top/favicon.ico
IP 172.67.154.38:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: vvfal.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Sun, 03 Dec 2023 21:45:38 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 3729
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e2BzdQrsZ2iU28bsUC1LzcoJmhNweZcRw%2FiksecF7rFM8cNcy8WmVZA3yWeNrs4%2F%2F8cPWMU%2F9q92lrCjqQyTfX%2Bh5LbVejBHHUnfBhU%2F8VaQWK%2FqzWocoXGr8sIHcbrZGVzYbqul"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff708b1bb524-OSL
alt-svc: h3=":443"; ma=86400
www.gstatic.com/firebasejs/10.3.1/firebase-app-compat.js
142.250.74.35 9.3 kB URL www.gstatic.com/firebasejs/10.3.1/firebase-app-compat.js
IP 142.250.74.35:0
File type ASCII text, with very long lines (28368)
Hash 9900403b65514fad7df39a4e788a6e45
75f9ba061ef4e72bb23528c700f2a11c56d637e9
a202b2051ea9810cd9ba592b3f9418a89e2062f5c185e29e288080b28eb64fe5
GET /firebasejs/10.3.1/firebase-app-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9308
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 06:08:34 GMT
expires: Fri, 29 Nov 2024 06:08:34 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 31 Aug 2023 15:20:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 315424
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
142.250.74.35 9.9 kB URL www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
IP 142.250.74.35:0
File type ASCII text, with very long lines (38231)
Hash 0541b823dfaf39162ef84cf075c9951b
e0934726455558cc1a59823efada9651e33aafaa
21f1d62f222007068c793f0947d98f4ccb7c1595adb68efeb783390fdd8b5522
GET /firebasejs/10.3.1/firebase-messaging-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9934
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 05:05:32 GMT
expires: Fri, 29 Nov 2024 05:05:32 GMT
cache-control: public, max-age=31536000
age: 319206
last-modified: Thu, 31 Aug 2023 15:20:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
vvfal.stonecarv.top/shared-js/assets/static-pl.js?v=2
172.67.154.38 12 kB URL vvfal.stonecarv.top/shared-js/assets/static-pl.js?v=2
IP 172.67.154.38:0
File type ASCII text, with CRLF line terminators
Hash 7224243dd0b18bb2508a1d77d4b2a0b2
bd833c24aa241861316053fd8bd46a1bef3d343f
920aa94a10634fc23234b5e4f55c428f6311fc7811d3591792381678cb492659
GET /shared-js/assets/static-pl.js?v=2 HTTP/1.1
Host: vvfal.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vvfal.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:38 GMT
content-type: application/javascript
last-modified: Fri, 01 Dec 2023 10:07:50 GMT
etag: W/"6569b076-dee"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3729
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q00a2B8g9TERZqnRLDLMvz8D2UA9XsCMTezybi%2FXIwX9Bo6ah9gkqmME1t8mfLpyPVjc34CLm4mpV0LrXXyTm%2FcqcVC9U7CQAa7lU53noh%2FY5u8FYdg6AtmmoHSiaDx3x66E6Tge"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff6f5a15b524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
a.stonecarv.top/eyes-robot/assets/2.png
172.67.154.38 1.1 kB URL a.stonecarv.top/eyes-robot/assets/2.png
IP 172.67.154.38:0
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /eyes-robot/assets/2.png HTTP/1.1
Host: a.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:38 GMT
content-type: image/png
content-length: 1061
last-modified: Fri, 01 Dec 2023 10:07:50 GMT
etag: "6569b076-425"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3554
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dt1UQGxrGV7JLph%2BWMFbIyi6nGK4kqkxPztzl3YkH7ELaysTpMvVA9YdRmZxOlP4T%2Fs0csYYMXP3W%2FxxOn%2Bx7wcIzwjUHWfFc5bEEoBobAHPUFl2APSDuhAAwDnWIsaOA38%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff72ada4b524-OSL
alt-svc: h3=":443"; ma=86400
a.stonecarv.top/eyes-robot/assets/trls.js
172.67.154.38 13 kB URL a.stonecarv.top/eyes-robot/assets/trls.js
IP 172.67.154.38:0
File type Unicode text, UTF-8 text, with very long lines (362), with CRLF line terminators
Hash 0cdacbfa8d68265ac3893b159a75682a
a85878b59036d00ac878739dc187305bc29df8c3
2fb2aad4f3b3426df4bb5633b627f529940bd06d0690f6b11cfcf42f0fea3e4b
GET /eyes-robot/assets/trls.js HTTP/1.1
Host: a.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:38 GMT
content-type: application/javascript
last-modified: Fri, 01 Dec 2023 10:07:50 GMT
etag: W/"6569b076-2af6"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3554
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l0Ai7xlbA6FJm9I4WJOrjT%2F2EB42gcQxhVNi4EtPSepDg%2Fwuyews306b3857hh0CjH9ygYrgsdTCi5TAjMKS97ZkfjvyI2E0rIHCeN1SUGjWrfhyKqsT06E3kqy5%2B%2FaRXJM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff729d9db524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
a.stonecarv.top/favicon.ico
172.67.154.38 0 B URL a.stonecarv.top/favicon.ico
IP 172.67.154.38:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: a.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.stonecarv.top/eyes-robot/?pl=zKByXHsQK0ydGD7DogbGyA&sm=eyes-robot&click_id=fed7fh9ik4ka6m7841&sub_id=16122660&nrid=26bd5d92bbc944a484b961cb0e76ccad&hash=hE0uly8fUNlwB2pw_aO26Q&exp=1701640238
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Sun, 03 Dec 2023 21:45:39 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 4013
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6fdCUyExBZaNbEhdpAv%2FvN2Cto%2Bph%2BgI0PPGSHV%2Behn%2FI7fTsSsG9nyXb09iJOhsEO27NeufpUfpoXPmK4EOOU4spDM4h2EYIarIy6kYIFuNWLsTQQ5tSsa0ISIeKA%2BZ4nQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff732e3db524-OSL
alt-svc: h3=":443"; ma=86400
cdnstatic.stonecarv.top/ps/config.js?id=zKByXHsQK0ydGD7DogbGyA
172.67.154.38 9.5 kB URL cdnstatic.stonecarv.top/ps/config.js?id=zKByXHsQK0ydGD7DogbGyA
IP 172.67.154.38:0
File type ASCII text, with CRLF line terminators
Hash 512755a6a34075b4a23c875b7ae24013
f8cecb3663d1d20fcf19a10af2a47d8238636ed3
d9cc92407823fafcd54c6e83fb6b9a51fbf3a4d9c73b2f4da64243d24ce2f81a
GET /ps/config.js?id=zKByXHsQK0ydGD7DogbGyA HTTP/1.1
Host: cdnstatic.stonecarv.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.stonecarv.top/
Cookie: __psu=e8c691f9-0b2c-4cf9-b2db-a7ab3a1ebdf0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 21:45:39 GMT
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IibzM19i1jJ%2Fz0wqdtCHSgfwqqD315rBXFecVXOlntYB0ZfiC8VPfs4zLmS9GqvhKYiNLIzltWbCRe%2BrtgGGmFzoxrkkI%2F7QE5OhoOhC6%2FQYR1soh6r5ZWGab%2FM%2BKtGRzQSf8Vww%2Fv6hAg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82feff732e4ab524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
142.250.74.35 9.9 kB URL www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
IP 142.250.74.35:0
File type ASCII text, with very long lines (38231)
Hash 0541b823dfaf39162ef84cf075c9951b
e0934726455558cc1a59823efada9651e33aafaa
21f1d62f222007068c793f0947d98f4ccb7c1595adb68efeb783390fdd8b5522
GET /firebasejs/10.3.1/firebase-messaging-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.stonecarv.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9934
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 05:05:32 GMT
expires: Fri, 29 Nov 2024 05:05:32 GMT
cache-control: public, max-age=31536000
age: 319207
last-modified: Thu, 31 Aug 2023 15:20:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.toprevenuegate.com/zj77nccnbs?key=7c1ef88f2943ca666bff02795f23060d
173.233.139.164 1.3 kB URL www.toprevenuegate.com/zj77nccnbs?key=7c1ef88f2943ca666bff02795f23060d
IP 173.233.139.164:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (416)
Hash ad32e304bfac72af9edaea0674851064
ad7b83049901d1301d656ecd152f5c9bac87733d
8fda3b5897f4be164b8b25480de72c1ef7bcb7788b92683f7267ca1125a68da5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /zj77nccnbs?key=7c1ef88f2943ca666bff02795f23060d HTTP/1.1
Host: www.toprevenuegate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:39 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=19854905; expires=Mon, 04 Dec 2023 21:45:39 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTg1NDkwNSwiayI6IjdjMWVmODhmMjk0M2NhNjY2YmZmMDI3OTVmMjMwNjBkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzIyNjE4LCJwaWQiOjI0MDE2MywiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOSwiYWlkIjoyOCwicHQiOjQsInBrIjoiemo3N25jY25icyIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiIiwiYXIiOltdfX0.2FQGO2YhCNPTmdlXXLBtr2hi4zXbhcFHRg0XwRi4mrk; expires=Sun, 03 Dec 2023 21:46:39 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9711ab32a4e07f384d0c68c475ef751e
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
www.toprevenuegate.com/api/users?token=L3pqNzduY2NuYnM_a2V5PTdjMWVmODhmMjk0M2NhNjY2YmZmMDI3OTVmMjMwNjBkJnBzdD0xNzAxNjM5OTk5JnJtdGM9dCZzaHU9MTc2Yzc0NDJhN2YzZTMxMDMxOGFjNzE2NGNiZjMyYzE4MTBmZGYyYzZiMmNhZTJjNjE2ZDU3OGExNzg5Njk0YmU4OGUzMmMzZTRiOWVjYTZmMmRhYzVjOTZhMTFlOTU2YWQ2MzAyN2RlNDRkZGM0YjJhYjgxYjRhYWY5ZmFiN2Y5NzVkMDUzZmVkMGY1YmVmYzk3ZDhhYTY4ZDkwY2U3NjU5NzQxNzg0YmI4ZjY5MjQ1ZWY0YTJjZDE1ZjY0Yzk3ZDY%3D&uuid=&pii=&in=false
173.233.137.60 0 B URL www.toprevenuegate.com/api/users?token=L3pqNzduY2NuYnM_a2V5PTdjMWVmODhmMjk0M2NhNjY2YmZmMDI3OTVmMjMwNjBkJnBzdD0xNzAxNjM5OTk5JnJtdGM9dCZzaHU9MTc2Yzc0NDJhN2YzZTMxMDMxOGFjNzE2NGNiZjMyYzE4MTBmZGYyYzZiMmNhZTJjNjE2ZDU3OGExNzg5Njk0YmU4OGUzMmMzZTRiOWVjYTZmMmRhYzVjOTZhMTFlOTU2YWQ2MzAyN2RlNDRkZGM0YjJhYjgxYjRhYWY5ZmFiN2Y5NzVkMDUzZmVkMGY1YmVmYzk3ZDhhYTY4ZDkwY2U3NjU5NzQxNzg0YmI4ZjY5MjQ1ZWY0YTJjZDE1ZjY0Yzk3ZDY%3D&uuid=&pii=&in=false
IP 173.233.137.60:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /api/users?token=L3pqNzduY2NuYnM_a2V5PTdjMWVmODhmMjk0M2NhNjY2YmZmMDI3OTVmMjMwNjBkJnBzdD0xNzAxNjM5OTk5JnJtdGM9dCZzaHU9MTc2Yzc0NDJhN2YzZTMxMDMxOGFjNzE2NGNiZjMyYzE4MTBmZGYyYzZiMmNhZTJjNjE2ZDU3OGExNzg5Njk0YmU4OGUzMmMzZTRiOWVjYTZmMmRhYzVjOTZhMTFlOTU2YWQ2MzAyN2RlNDRkZGM0YjJhYjgxYjRhYWY5ZmFiN2Y5NzVkMDUzZmVkMGY1YmVmYzk3ZDhhYTY4ZDkwY2U3NjU5NzQxNzg0YmI4ZjY5MjQ1ZWY0YTJjZDE1ZjY0Yzk3ZDY%3D&uuid=&pii=&in=false HTTP/1.1
Host: www.toprevenuegate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.toprevenuegate.com/zj77nccnbs?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=19854905
Cookie: u_pl=19854905; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxOTg1NDkwNSwiayI6IjdjMWVmODhmMjk0M2NhNjY2YmZmMDI3OTVmMjMwNjBkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyNzIyNjE4LCJwaWQiOjI0MDE2MywiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOSwiYWlkIjoyOCwicHQiOjQsInBrIjoiemo3N25jY25icyIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiIiwiYXIiOltdfX0.2FQGO2YhCNPTmdlXXLBtr2hi4zXbhcFHRg0XwRi4mrk; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 21:45:40 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: https://shop.bigbasketshop.com/track?q=kghXWdDErq
Set-Cookie: iprc21fa87919d6146ff4dfaa778ab9c92ca=4591122; expires=Mon, 04 Dec 2023 21:45:40 GMT
pdhtkv=true; expires=Mon, 04 Dec 2023 21:45:40 GMT
uncs=1; expires=Mon, 04 Dec 2023 21:45:40 GMT
pdhtkv28=true; expires=Mon, 04 Dec 2023 21:45:40 GMT
uncs28=1; expires=Mon, 04 Dec 2023 21:45:40 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 76ceffa8665d8e6689b0fd4a274cb24f
Strict-Transport-Security: max-age=0; includeSubdomains
clk.tradedoubler.com/click?p=225780&a=3238748&epi=TerraD
52.57.204.60200 OK 3.6 kB URL User Request POST HTTP/2 clk.tradedoubler.com/click?p=225780&a=3238748&epi=TerraD
IP 52.57.204.60:443
Certificate IssuerAmazon
Subject*.tradedoubler.com
FingerprintE6:E6:D1:02:6C:9A:BE:00:C1:0E:B5:BC:61:D1:C1:FD:74:73:C4:9E
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (314)
Hash dffa9bac5be3f386079d2028d8264f59
e264575195c6ca302170a308b3da31f924b6d60c
43ffd816104a86bae1d1e75330e61c304463fcf25e6bdb5086c34a944b1e4c68
GET /click?p=225780&a=3238748&epi=TerraD HTTP/1.1
Host: clk.tradedoubler.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://shop.bigbasketshop.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 21:45:40 GMT
content-type: text/html; charset=ISO-8859-1
content-length: 3610
server: TXServerHttp
access-control-allow-origin: *
cache-control: private, max-age=0
pragma: no-cache
referrer-policy: origin
X-Firefox-Spdy: h2
vht.tradedoubler.com/fp/fpjs.js
52.85.242.38 7.7 kB URL vht.tradedoubler.com/fp/fpjs.js
IP 52.85.242.38:0
File type ASCII text, with very long lines (19960)
Hash e967d9e86ec8ff44db0e24766ced642f
bd488430b8b4283eb82afda802a075cf841c29d3
040dff2a9b3d08a4654dec367d93f2b994a8ea0e573950d5561c0022af4a3c3a
GET /fp/fpjs.js HTTP/1.1
Host: vht.tradedoubler.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clk.tradedoubler.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 7718
Connection: keep-alive
Server: Apache
Strict-Transport-Security: max-age=31536000
Last-Modified: Mon, 09 Oct 2023 08:54:59 GMT
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Thu, 30 Nov 2023 19:11:43 GMT
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 350f2b5d7e6ee985da330b123098fd88.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN1-C1
X-Amz-Cf-Id: 2giH57lB9cQWGXF1TNdosb7R6wWebEAHFy0E0-OoAIoIxYgB62aEFg==
Age: 268439
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
clk.tradedoubler.com/favicon.ico
52.57.204.60404 Not Found 193 B URL GET HTTP/2 clk.tradedoubler.com/favicon.ico
IP 52.57.204.60:443
Requested by https://clk.tradedoubler.com/click?p=225780&a=3238748&epi=TerraD
Certificate IssuerAmazon
Subject*.tradedoubler.com
FingerprintE6:E6:D1:02:6C:9A:BE:00:C1:0E:B5:BC:61:D1:C1:FD:74:73:C4:9E
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Hash 523cbcb278f348bbe64563fe4cc9f435
5a436481b66ccb6dff53c5e1a14c08ef0b4a8e4b
37b6ca25983f4126bd10c135684bc8f421c8b48a5bdb75b5ad69c849035a84f4
GET /favicon.ico HTTP/1.1
Host: clk.tradedoubler.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clk.tradedoubler.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
date: Sun, 03 Dec 2023 21:45:41 GMT
content-type: text/html; charset=ISO-8859-1
content-length: 193
X-Firefox-Spdy: h2
clk.tradedoubler.com/click?p=225780&a=3238748&epi=TerraD
52.57.204.60200 OK 150 B URL User Request POST HTTP/2 clk.tradedoubler.com/click?p=225780&a=3238748&epi=TerraD
IP 52.57.204.60:443
Certificate IssuerAmazon
Subject*.tradedoubler.com
FingerprintE6:E6:D1:02:6C:9A:BE:00:C1:0E:B5:BC:61:D1:C1:FD:74:73:C4:9E
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document, ASCII text, with no line terminators
Hash dc03e2e45f5c0d5e02f319e7f1e957cf
47725bedccb4c387bfc904021658cc7b343927ab
f064d039c1745fafca89f95ad9748a95b6ed51a78270b7feee25e968faef36b7
POST /click?p=225780&a=3238748&epi=TerraD HTTP/1.1
Host: clk.tradedoubler.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clk.tradedoubler.com/
Content-Type: application/x-www-form-urlencoded
Content-Length: 90
Origin: https://clk.tradedoubler.com
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 03 Dec 2023 21:45:41 GMT
content-type: text/html; charset=ISO-8859-1
content-length: 150
set-cookie: GUID=1z11zz14Nz209Ed6z1d4dac1af0a4b88668cb59c153079657;expires=Mon, 02-Dec-2024 21:45:41 GMT;path=/;domain=.tradedoubler.com
server: TXServerHttp
access-control-allow-origin: *
cache-control: private, max-age=0
pragma: no-cache
referrer-policy: origin
X-Firefox-Spdy: h2
clk.tradedoubler.com/favicon.ico
52.57.204.60404 Not Found 193 B URL GET HTTP/2 clk.tradedoubler.com/favicon.ico
IP 52.57.204.60:443
Requested by https://clk.tradedoubler.com/click?p=225780&a=3238748&epi=TerraD
Certificate IssuerAmazon
Subject*.tradedoubler.com
FingerprintE6:E6:D1:02:6C:9A:BE:00:C1:0E:B5:BC:61:D1:C1:FD:74:73:C4:9E
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Hash 523cbcb278f348bbe64563fe4cc9f435
5a436481b66ccb6dff53c5e1a14c08ef0b4a8e4b
37b6ca25983f4126bd10c135684bc8f421c8b48a5bdb75b5ad69c849035a84f4
GET /favicon.ico HTTP/1.1
Host: clk.tradedoubler.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clk.tradedoubler.com/
DNT: 1
Connection: keep-alive
Cookie: GUID=1z11zz14Nz209Ed6z1d4dac1af0a4b88668cb59c153079657
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
date: Sun, 03 Dec 2023 21:45:41 GMT
content-type: text/html; charset=ISO-8859-1
content-length: 193
X-Firefox-Spdy: h2