atlaq.com/logo.png
104.21.64.58200 OK 117 kB IP 104.21.64.58:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerCloudflare, Inc.
Subjectatlaq.com
Fingerprint5E:AC:5A:49:0B:05:39:5A:D5:49:EF:4E:F8:76:94:B6:C0:A1:29:84
ValidityTue, 29 Aug 2023 00:00:00 GMT - Wed, 28 Aug 2024 23:59:59 GMT
File type PNG image data, 500 x 446, 8-bit/color RGBA, non-interlaced\012- data
Size 117 kB (117433 bytes)
Hash 792b74959e26cd37fd05dfcd0ef07770
c6e3ed2dd9771b077daf93eda5773cd10d621147
7ae2cb133588b7a2926b71630869d602c294840f6c1379666e82b25f3354623b
GET /logo.png HTTP/1.1
Host: atlaq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: image/png
content-length: 117433
cache-control: public, max-age=31536000
expires: Thu, 24 Oct 2024 05:27:08 GMT
last-modified: Wed, 29 Jan 2020 11:21:42 GMT
vary: User-Agent,Origin, Accept-Encoding
strict-transport-security: max-age=31536000;includeSubDomains
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 2176083
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t9cxQW5RhD%2FL5FKTmnN1LMfRPlSWH2qsBWIxO2yKluFktV6ZxRrjMGP%2FlFgys7LTe3Bu2NrBhACxsh7RN%2FsXjp%2Bn4W9TZthqnvR5rMSzehqA1P9NxCUJIk1yEME%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8287937a4d485689-OSL
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=UA-85346163-2
142.250.74.168200 OK 51 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=UA-85346163-2
IP 142.250.74.168:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (2213)
Hash ad8cc22fa68a8f2f2fbcfbe7e05fd14b
e6c8203796290a8333d4f00161af4d86ad8d65b5
4e805e0a998e83510674eb57b8217d9044213903f858ba13e4a9a62475d22b96
GET /gtag/js?id=UA-85346163-2 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 19 Nov 2023 09:55:11 GMT
expires: Sun, 19 Nov 2023 09:55:11 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 51440
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-FPZ0VEL1WQ&l=dataLayer&cx=c
142.250.74.168200 OK 90 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-FPZ0VEL1WQ&l=dataLayer&cx=c
IP 142.250.74.168:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash 4950c4c87d74a893588f91c271fc044c
2f32db4f914c974e9f751981b045ee570fb2ec15
b1f9f4e6ad4e44b2ad53dadb73aa349daaffe389cdbf66691fc01fdebe008f14
GET /gtag/js?id=G-FPZ0VEL1WQ&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 19 Nov 2023 09:55:11 GMT
expires: Sun, 19 Nov 2023 09:55:11 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 90055
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
itweepinbelltor.com/zone?pub=0&zone_id=5490114&is_mobile=false&domain=tujidao.com.atlaq.com&var=&ymid=&var_3=&tg=0&sw=3.1.471
139.45.197.250200 OK 888 B URL GET HTTP/2 itweepinbelltor.com/zone?pub=0&zone_id=5490114&is_mobile=false&domain=tujidao.com.atlaq.com&var=&ymid=&var_3=&tg=0&sw=3.1.471
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
File type JSON data\012- , ASCII text, with very long lines (887)
Hash 5800ebd5fac46023ee5ce159af185039
69130d428356b977ec0a5bb70fe95ce3bc947b85
b299942a863006c6c8227371cc765b6eaef53616b56613001feda66f9667444f
GET /zone?pub=0&zone_id=5490114&is_mobile=false&domain=tujidao.com.atlaq.com&var=&ymid=&var_3=&tg=0&sw=3.1.471 HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/json; charset=utf-8
content-length: 888
x-trace-id: 3b6952d6b6873f779e08767ca046763e
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ocsp.starfieldtech.com/
192.124.249.22 2.1 kB IP 192.124.249.22:0
Hash 36185e4e7d86dc90a97758cd6ab9a06e
fd13f5ba8778075c5e84d046c98cec6270fd92e1
bc33471634540388d85237d9c596df14fd95db57faaf375da9b4adeb4d29fdf2
POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 19 Nov 2023 09:55:11 GMT
Content-Type: application/ocsp-response
Content-Length: 2149
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 18 Nov 2023 22:55:51 GMT
Expires: Sun, 19 Nov 2023 22:55:51 GMT
ETag: "fd13f5ba8778075c5e84d046c98cec6270fd92e1"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
whulsaux.com/tag.min.js
139.45.197.244200 OK 26 kB IP 139.45.197.244:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectwhulsaux.com
Fingerprint29:C6:16:FB:8B:54:C5:1B:65:18:3D:96:39:33:73:B5:D3:8C:6D:48
ValidityFri, 01 Sep 2023 05:32:42 GMT - Thu, 30 Nov 2023 05:32:41 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash f2e2bbac9956f90deb8bb8620b4e6a34
92e196a6e8b21e835aeb47d0123fbad2c9c1bc2c
785e6fa651312a3f819529c5fa32cd529e74c771f73929ed85cdf424a462144f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /tag.min.js HTTP/1.1
Host: whulsaux.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/javascript; charset=utf-8
content-length: 25542
content-encoding: br
x-trace-id: 1af16f0a09b9243f48c53d61d275d574
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
accept-ranges: bytes
last-modified: Wed, 15 Nov 2023 11:44:01 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
preview.atlaq.com/41ab3aa935de1e9185cfcea9dcd0c335_tujidao.com.png
172.67.176.167200 OK 18 kB URL GET HTTP/2 preview.atlaq.com/41ab3aa935de1e9185cfcea9dcd0c335_tujidao.com.png
IP 172.67.176.167:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerCloudflare, Inc.
Subjectatlaq.com
Fingerprint1E:C6:84:53:3B:FF:CE:FF:8F:8C:9D:8B:3A:69:3F:E5:28:C8:F4:A5
ValidityWed, 26 Apr 2023 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT
File type PNG image data, 683 x 384, 8-bit/color RGBA, non-interlaced\012- data
Hash b001fc996cc4954d82e8ad3aebe0dfd4
85b4bdc8080415441a6bab5d74dfb6907e9363de
71f895f524b4d0ea20f6d37c6b89823604706de0f29b51c56d7662c0d55dd321
GET /41ab3aa935de1e9185cfcea9dcd0c335_tujidao.com.png HTTP/1.1
Host: preview.atlaq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: image/png
content-length: 18175
x-powered-by: Express
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2023 09:19:49 GMT
etag: W/"46ff-18b37c8d255"
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XDG6iZPwNVrtU2n0wrRZ6MXc2cCg4bVgXnjXN9PQFAbZBWdMBrvc66PYVoXAupkPJRlK8U7Ft4xfRE40%2B%2FswSgmThwQehBEIeGUkLetWWQy7WEfp4Uw1oW9QGW3JULGOqKoRDA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
cf-ray: 828793793c2f56c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
yotecuentocomofueblog.wordpress.com/favicon.ico
192.0.78.13301 Moved Permanently 0 B URL GET HTTP/2 yotecuentocomofueblog.wordpress.com/favicon.ico
IP 192.0.78.13:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerSectigo Limited
Subject*.wordpress.com
FingerprintA3:A5:D8:C8:1D:A5:FD:3E:95:A9:0C:25:E8:5A:C2:26:BD:14:73:44
ValidityWed, 23 Nov 2022 00:00:00 GMT - Sun, 24 Dec 2023 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: yotecuentocomofueblog.wordpress.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/html; charset=utf-8
location: https://secure.gravatar.com/blavatar/d4a773625bb5e4543004c4df4e7b4e014c172ea0a4083da2dba0f44d192e32ef?s=16
vary: Cookie
x-hacker: Want root? Visit join.a8c.com/hacker and mention this header.
host-header: WordPress.com
x-redirect-by: WordPress
x-nc: HIT dca 30
x-ac: 1.arn _dca MISS
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
tujidao.com.atlaq.com/badk.txt
188.114.96.1200 OK 14 kB URL GET HTTP/3 tujidao.com.atlaq.com/badk.txt
IP 188.114.96.1:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerCloudflare, Inc.
Subjectatlaq.com
Fingerprint76:15:CE:DE:39:63:81:C5:4E:4A:13:3D:70:6B:AE:85:FA:98:9A:38
ValidityFri, 25 Aug 2023 00:00:00 GMT - Sat, 24 Aug 2024 23:59:59 GMT
Hash f4245877e1f9b8764acbac7b475ebf2d
7471a9d7354637651fa5d0200febe7ab162fb69a
bd300473a295a173716b1b182aed7c14e3551f7400360dd5f694115683ccd41c
GET /badk.txt HTTP/1.1
Host: tujidao.com.atlaq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Authorization, Accept
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT
access-control-expose-headers: Content-Disposition
cache-control: public, max-age=2592000
cf-railgun: direct (starting new WAN connection)
expires: Tue, 19 Dec 2023 09:55:11 GMT
last-modified: Mon, 13 Apr 2020 08:00:16 GMT
strict-transport-security: max-age=31536000;includeSubDomains
vary: Accept-Encoding,User-Agent,Origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ETjX5EdXx0k2qEoczqQmvJ21w6wZ9JqgbBjnrmvPUazmX7pjtPSYHtMpg%2B9AhzMF2xHmBwhbti9oBAZC3tbG7VlNO5n8G7ntA2okSiu1NUuUVOtvboUwqqymBjd%2FeX5LbMUHTiv5%2BGE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8287937a58e6b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
itweepinbelltor.com/pfe/current/tag.min.js?z=5490114
139.45.197.250200 OK 5.8 kB URL GET HTTP/2 itweepinbelltor.com/pfe/current/tag.min.js?z=5490114
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash 3ed43f23ff137f946ca8a94b22220266
94db069b66e1076c2d179da0057f0b7bfa55eaaf
5bf96d1f51e92daf5182defbd9717bd326820411715cb628ea5f62ccf0167997
GET /pfe/current/tag.min.js?z=5490114 HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/javascript
last-modified: Fri, 10 Nov 2023 11:00:39 GMT
etag: W/"654e0d57-33f4"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
amunfezanttor.com/event
139.45.197.250200 OK 0 B IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectamunfezanttor.com
FingerprintD6:54:A1:23:39:A0:9A:41:5A:CC:0B:F2:C1:7C:6A:FA:F0:E8:C1:52
ValidityWed, 06 Sep 2023 01:33:39 GMT - Tue, 05 Dec 2023 01:33:38 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: amunfezanttor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
188.114.96.1200 OK 0 B URL User Request GET HTTP/2 IP 188.114.96.1:443
Certificate IssuerCloudflare, Inc.
Subjectatlaq.com
Fingerprint76:15:CE:DE:39:63:81:C5:4E:4A:13:3D:70:6B:AE:85:FA:98:9A:38
ValidityFri, 25 Aug 2023 00:00:00 GMT - Sat, 24 Aug 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD / HTTP/1.1
Host: tujidao.com.atlaq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Authorization, Accept
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT
access-control-expose-headers: Content-Disposition
cache-control: public, max-age=2592000
cf-railgun: direct (waiting for pending WAN connection)
expires: Tue, 19 Dec 2023 05:29:25 GMT
strict-transport-security: max-age=31536000;includeSubDomains
vary: User-Agent,Origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-litespeed-cache: hit
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tfy1Yb68MFW6bOShNGc2DjautiUSmeG1H6RRKFmEEn2FFoOFNuFJKGQNgSLa4%2BvKvqQVIF7swuLOcjxInlmVv%2Bjq%2BqlnCbYhOlnZyMOpVL%2FTt8Z4nj4cZpwuSA50aytMvU1OpsoK6RY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8287937b2974b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
amunfezanttor.com/event
139.45.197.250200 OK 94 B IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectamunfezanttor.com
FingerprintD6:54:A1:23:39:A0:9A:41:5A:CC:0B:F2:C1:7C:6A:FA:F0:E8:C1:52
ValidityWed, 06 Sep 2023 01:33:39 GMT - Tue, 05 Dec 2023 01:33:38 GMT
File type JSON data\012- , ASCII text
Hash 5f0441365b68c382545184bfeda39fdf
09a5b0f3127f4e149075597890af3f9284cad6d0
2cbeead8eaac3a5fc49a9180efcffb007cf502a109477f96739470c8f61ac139
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: amunfezanttor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Content-Type: application/json
Content-Length: 506
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/json; charset=utf-8
content-length: 94
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
region1.analytics.google.com/g/collect?v=2&tid=G-FPZ0VEL1WQ>m=45je3b81v894672372&_p=1700387712510&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1272083154.1700387713&ul=en-us&sr=1280x1024&_eu=AAAI&_s=1&sid=1700387712&sct=1&seg=0&dl=https%3A%2F%2Ftujidao.com.atlaq.com%2F&dt=%E8%B6%85%E9%AB%98%E6%B8%85%E6%9E%81%E5%93%81%E5%9B%BE%E9%9B%86_%E5%9B%BE%E9%9B%86%E5%B2%9B&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1660
216.239.34.36204 No Content 0 B URL POST HTTP/2 region1.analytics.google.com/g/collect?v=2&tid=G-FPZ0VEL1WQ>m=45je3b81v894672372&_p=1700387712510&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1272083154.1700387713&ul=en-us&sr=1280x1024&_eu=AAAI&_s=1&sid=1700387712&sct=1&seg=0&dl=https%3A%2F%2Ftujidao.com.atlaq.com%2F&dt=%E8%B6%85%E9%AB%98%E6%B8%85%E6%9E%81%E5%93%81%E5%9B%BE%E9%9B%86_%E5%9B%BE%E9%9B%86%E5%B2%9B&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1660
IP 216.239.34.36:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-FPZ0VEL1WQ>m=45je3b81v894672372&_p=1700387712510&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1272083154.1700387713&ul=en-us&sr=1280x1024&_eu=AAAI&_s=1&sid=1700387712&sct=1&seg=0&dl=https%3A%2F%2Ftujidao.com.atlaq.com%2F&dt=%E8%B6%85%E9%AB%98%E6%B8%85%E6%9E%81%E5%93%81%E5%9B%BE%E9%9B%86_%E5%9B%BE%E9%9B%86%E5%B2%9B&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1660 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://tujidao.com.atlaq.com
date: Sun, 19 Nov 2023 09:55:12 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
itweepinbelltor.com/event
139.45.197.250200 OK 0 B URL OPTIONS HTTP/2 itweepinbelltor.com/event
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /event HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
zeppelinux.es/favicon.ico
91.199.120.62302 Found 0 B URL GET HTTP/2 zeppelinux.es/favicon.ico
IP 91.199.120.62:443
ASN #15954 Tecnocratica Centro de Datos, S.L.
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectzeppelinux.es
FingerprintFE:A6:F7:43:BF:62:0A:D3:35:E7:AA:E7:AD:2A:69:18:C2:92:97:C7
ValidityFri, 13 Oct 2023 03:23:06 GMT - Thu, 11 Jan 2024 03:23:05 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: zeppelinux.es
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx/1.17.0
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/7.4.6
set-cookie: gdpr[consent_types]=%5B%5D; expires=Mon, 18-Nov-2024 09:55:12 GMT; Max-Age=31536000; path=/
gdpr[allowed_cookies]=%5B%22%22%5D; expires=Mon, 18-Nov-2024 09:55:12 GMT; Max-Age=31536000; path=/
link: <https://www.zeppelinux.es/wp-json/>; rel="https://api.w.org/"
x-redirect-by: WordPress
location: https://www.zeppelinux.es/wp-content/uploads/2015/10/cropped-ze.png
X-Firefox-Spdy: h2
tujidao.com.atlaq.com/sw-5490114.js
188.114.96.1404 Not Found 1.9 kB URL GET HTTP/3 tujidao.com.atlaq.com/sw-5490114.js
IP 188.114.96.1:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerCloudflare, Inc.
Subjectatlaq.com
Fingerprint76:15:CE:DE:39:63:81:C5:4E:4A:13:3D:70:6B:AE:85:FA:98:9A:38
ValidityFri, 25 Aug 2023 00:00:00 GMT - Sat, 24 Aug 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (759)
Hash 4d657d6e65f504ad829ef64b13e3ce39
a7426d8f86e4c5c5a11fea86c504f1a621b59b99
18e942fe7d930851ee8cb5ddbd6d9af38b3c68b1c8a8ee3bb608096c81b13bcb
GET /sw-5490114.js HTTP/1.1
Host: tujidao.com.atlaq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
DNT: 1
Connection: keep-alive
Cookie: _ga_FPZ0VEL1WQ=GS1.1.1700387712.1.0.1700387712.60.0.0; _ga=GA1.1.1272083154.1700387713
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: text/html; charset=UTF-8
cache-control: public, max-age=31536000
expires: Tue, 19 Dec 2023 09:55:12 GMT
x-litespeed-cache: miss
vary: Accept-Encoding,User-Agent,Origin
strict-transport-security: max-age=31536000;includeSubDomains
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Authorization, Accept
access-control-expose-headers: Content-Disposition
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uFa%2BYfgDtGLxGBFnUH6oZtRvLaqutfyLblAViGU46i%2BdItFoC0ymgIdHW58SiCLSfme9kQCaDl%2FxD5lZE33003OC4kt9OE2rngVnzxpMVRpwHw0fb1BnSAMSyS5QAxUAcptEHHYP57o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8287937dcbbbb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
my.rtmark.net/gid.js?pub=0&userId=6b130f153eb7408fb6ab781ae3c86185&zoneId=5490114&checkDuplicate=true&ymid=&var=
139.45.195.8200 OK 65 B URL GET HTTP/2 my.rtmark.net/gid.js?pub=0&userId=6b130f153eb7408fb6ab781ae3c86185&zoneId=5490114&checkDuplicate=true&ymid=&var=
IP 139.45.195.8:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT
File type JSON data\012- , ASCII text
Hash dd1f393d3a67eb7813a6213e6e93d3a8
80ef84c3909869ed31e4176067203ada9d8d2d7b
707f600b2d93440c61eee294e52973588b70b6c1ca34ce46047b68cb8bf76544
GET /gid.js?pub=0&userId=6b130f153eb7408fb6ab781ae3c86185&zoneId=5490114&checkDuplicate=true&ymid=&var= HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Cookie: ID=4464f3f7fd7a4f43932a8ab6ed329308
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=4464f3f7fd7a4f43932a8ab6ed329308; expires=Mon, 18 Nov 2024 09:55:12 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
amunfezanttor.com/event
139.45.197.250200 OK 94 B IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectamunfezanttor.com
FingerprintD6:54:A1:23:39:A0:9A:41:5A:CC:0B:F2:C1:7C:6A:FA:F0:E8:C1:52
ValidityWed, 06 Sep 2023 01:33:39 GMT - Tue, 05 Dec 2023 01:33:38 GMT
File type JSON data\012- , ASCII text
Hash c5282ed185dd008e907978039ef7d58e
60e886d9dd46e0f4d41ddb5a0f1b012deb6d21b3
381fb81aa8f492eb378acc3938d2e1607e56885ad97ef43375cc2b39d498a208
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: amunfezanttor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Content-Type: application/json
Content-Length: 506
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: application/json; charset=utf-8
content-length: 94
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
www.zeppelinux.es/wp-content/uploads/2015/10/cropped-ze.png
91.199.120.62200 OK 2.9 kB URL GET HTTP/2 www.zeppelinux.es/wp-content/uploads/2015/10/cropped-ze.png
IP 91.199.120.62:443
ASN #15954 Tecnocratica Centro de Datos, S.L.
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectzeppelinux.es
FingerprintFE:A6:F7:43:BF:62:0A:D3:35:E7:AA:E7:AD:2A:69:18:C2:92:97:C7
ValidityFri, 13 Oct 2023 03:23:06 GMT - Thu, 11 Jan 2024 03:23:05 GMT
File type PNG image data, 512 x 512, 8-bit colormap, non-interlaced\012- data
Hash d73ca0c885d3f12e667b379458bd6ef4
7b7760ba7d5ba91d2e104cae8e8b04cf507a2f9a
bb753099bdd9368c0b14fad696c533813b4ce9a1d60150628d5e14f349f182e7
GET /wp-content/uploads/2015/10/cropped-ze.png HTTP/1.1
Host: www.zeppelinux.es
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.17.0
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: image/png
content-length: 2880
last-modified: Wed, 26 Oct 2016 20:13:06 GMT
etag: "15a3529-b40-53fca40d1b557"
accept-ranges: bytes
X-Firefox-Spdy: h2
t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://yosoyherbalifenutrition.com
142.250.74.36200 OK 2.0 kB URL GET HTTP/2 t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://yosoyherbalifenutrition.com
IP 142.250.74.36:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash 727d69db653c51300bcdc6d1cfa67ea9
e4318b6ef666100686adef35d0e8831bec01209d
88cca3e35b6f659d882ef523bcb07e01c9a481d54184c3bb36b554ca8e8b78eb
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://yosoyherbalifenutrition.com HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
content-location: https://yosoyherbalifenutrition.com/wp-content/uploads/2023/03/favicon.ico
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 1990
date: Sun, 19 Nov 2023 09:55:12 GMT
expires: Sun, 26 Nov 2023 09:55:12 GMT
cache-control: public, max-age=604800
last-modified: Tue, 18 Apr 2023 11:48:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
itweepinbelltor.com/custom
139.45.197.250200 OK 39 B URL POST HTTP/2 itweepinbelltor.com/custom
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
POST /custom HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Content-Type: application/json
Content-Length: 376
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 3e14560deea39e1b8f08328340ad7913
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://zoowomaniacos.org
142.250.74.36200 OK 881 B URL GET HTTP/2 t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://zoowomaniacos.org
IP 142.250.74.36:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash ab28f5ac3ca93a9e6fb6f98820ceaf04
d9a0ae0fba80db0f1982e409a1187e5537ac878c
0dff8d116b16499d33cafc6f2341a37fefb74d87cd9f91add7d86b56b3fdb7d6
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://zoowomaniacos.org HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
content-location: https://zoowomaniacos.org/home/img/favicon.png
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 881
date: Sun, 19 Nov 2023 09:55:12 GMT
expires: Sun, 26 Nov 2023 09:55:12 GMT
cache-control: public, max-age=604800
last-modified: Sun, 11 Apr 2021 04:29:37 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
itweepinbelltor.com/pfe/current/defaultSkin.min.js
139.45.197.250200 OK 20 kB URL GET HTTP/2 itweepinbelltor.com/pfe/current/defaultSkin.min.js
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash c69d204252abbbbd9825650ca11d9e34
b572b85396e0a37a1d85f7ef455c239e50180d97
0bd2e907afbce0d4911405b7d69e303ed224b8335c8e86b9a031bb956b0692f5
GET /pfe/current/defaultSkin.min.js HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: application/javascript
last-modified: Fri, 10 Nov 2023 11:00:39 GMT
etag: W/"654e0d57-df63"
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-FPZ0VEL1WQ&cid=1272083154.1700387713>m=45je3b81v894672372&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=356314002
142.250.74.163200 OK 42 B URL GET HTTP/2 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-FPZ0VEL1WQ&cid=1272083154.1700387713>m=45je3b81v894672372&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=356314002
IP 142.250.74.163:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.google.no
Fingerprint6E:E4:BC:4A:67:5E:46:6A:B3:E4:CA:61:A7:C0:97:AB:14:F0:34:32
ValidityMon, 23 Oct 2023 11:27:27 GMT - Mon, 15 Jan 2024 11:27:26 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-FPZ0VEL1WQ&cid=1272083154.1700387713>m=45je3b81v894672372&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=356314002 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 19 Nov 2023 09:55:12 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://tujidao.com
142.250.74.36404 Not Found 726 B URL GET HTTP/2 t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://tujidao.com
IP 142.250.74.36:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash b8a0bf372c762e966cc99ede8682bc71
2d7c9b60d1e2b4f4726141de2e4ab738110b9287
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://tujidao.com HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
cross-origin-resource-policy: cross-origin
content-type: image/png
x-content-type-options: nosniff
date: Sun, 19 Nov 2023 09:55:12 GMT
server: sffe
content-length: 726
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
secure.gravatar.com/blavatar/d4a773625bb5e4543004c4df4e7b4e014c172ea0a4083da2dba0f44d192e32ef?s=16
192.0.73.2200 OK 880 B URL GET HTTP/2 secure.gravatar.com/blavatar/d4a773625bb5e4543004c4df4e7b4e014c172ea0a4083da2dba0f44d192e32ef?s=16
IP 192.0.73.2:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerSectigo Limited
Subject*.gravatar.com
Fingerprint40:4E:21:9D:74:27:BC:64:DC:8B:81:06:B1:0E:76:4E:0D:AE:2B:C6
ValidityWed, 23 Nov 2022 00:00:00 GMT - Sun, 24 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 16x16, components 3\012- data
Hash 62dfc066729e62b52a9f1e8e680bcf84
44fba05b49f0f0e313d983749217f3aa335c0d31
aaada00b2c0e5b7a9455e5210b857b2b8b47671cb06a140708adbb1e8a288416
GET /blavatar/d4a773625bb5e4543004c4df4e7b4e014c172ea0a4083da2dba0f44d192e32ef?s=16 HTTP/1.1
Host: secure.gravatar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: image/jpeg
content-length: 880
last-modified: Wed, 16 Apr 2014 00:33:15 GMT
link: <https://gravatar.com/blavatar/d4a773625bb5e4543004c4df4e7b4e014c172ea0a4083da2dba0f44d192e32ef?s=16>; rel="canonical"
content-disposition: inline; filename="d4a773625bb5e4543004c4df4e7b4e014c172ea0a4083da2dba0f44d192e32ef.jpeg"
access-control-allow-origin: *
expires: Sun, 19 Nov 2023 10:00:12 GMT
cache-control: max-age=300
x-nc: MISS arn 4
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
X-Firefox-Spdy: h2
itweepinbelltor.com/custom
139.45.197.250200 OK 39 B URL POST HTTP/2 itweepinbelltor.com/custom
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
POST /custom HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Content-Type: application/json
Content-Length: 736
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:12 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: b288e6a82bc710dfb9a1cee1ab01964e
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
whulsaux.com/?rb=Q-8v7PznxJ-Jzyv2JUvVIRoK8HBgkcRdgkY571t3KEcZuM4Lqn5-_C1PbWcc9VwpYspQvkBUcAczdz6y-6NWimwjUIEzV31kGFGnWngrM8xWhQRlL4WtmwDdl_Ak33tFWh5LHdyLJGmZueniFXKxidDOwp2Bfor3x8Ax3HJndCvQWHxfR4otHkEUN9iBb88dKWBcy0ATdnFdLY-jalKUdp0nddrL27yl5ZY5mQ%3D%3D&request_ab2=0&zoneid=6577958&js_build=iclick-1.629.0&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=1024&wiw=1280&wfc=1&pl=https%3A%2F%2Ftujidao.com.atlaq.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&wgl=&js_build=iclick-1.629.0&bs=fedbc8ba-8823-42e9-b011-e670d79713e0&userId=4464f3f7fd7a4f43932a8ab6ed329308&m=link
139.45.197.244200 OK 1.8 kB URL GET HTTP/2 whulsaux.com/?rb=Q-8v7PznxJ-Jzyv2JUvVIRoK8HBgkcRdgkY571t3KEcZuM4Lqn5-_C1PbWcc9VwpYspQvkBUcAczdz6y-6NWimwjUIEzV31kGFGnWngrM8xWhQRlL4WtmwDdl_Ak33tFWh5LHdyLJGmZueniFXKxidDOwp2Bfor3x8Ax3HJndCvQWHxfR4otHkEUN9iBb88dKWBcy0ATdnFdLY-jalKUdp0nddrL27yl5ZY5mQ%3D%3D&request_ab2=0&zoneid=6577958&js_build=iclick-1.629.0&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=1024&wiw=1280&wfc=1&pl=https%3A%2F%2Ftujidao.com.atlaq.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&wgl=&js_build=iclick-1.629.0&bs=fedbc8ba-8823-42e9-b011-e670d79713e0&userId=4464f3f7fd7a4f43932a8ab6ed329308&m=link
IP 139.45.197.244:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectwhulsaux.com
Fingerprint29:C6:16:FB:8B:54:C5:1B:65:18:3D:96:39:33:73:B5:D3:8C:6D:48
ValidityFri, 01 Sep 2023 05:32:42 GMT - Thu, 30 Nov 2023 05:32:41 GMT
File type troff or preprocessor input, ASCII text, with very long lines (1866), with no line terminators
Hash 0c0e2724767ec8a7b05babd5235d24fd
5834f53ff246175e50b915d376e89e605acc8816
3b6e3712cbcd7c808d44e82b8de58b475b49911522a2d5c784e564f07a9c5471
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /?rb=Q-8v7PznxJ-Jzyv2JUvVIRoK8HBgkcRdgkY571t3KEcZuM4Lqn5-_C1PbWcc9VwpYspQvkBUcAczdz6y-6NWimwjUIEzV31kGFGnWngrM8xWhQRlL4WtmwDdl_Ak33tFWh5LHdyLJGmZueniFXKxidDOwp2Bfor3x8Ax3HJndCvQWHxfR4otHkEUN9iBb88dKWBcy0ATdnFdLY-jalKUdp0nddrL27yl5ZY5mQ%3D%3D&request_ab2=0&zoneid=6577958&js_build=iclick-1.629.0&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=1024&wiw=1280&wfc=1&pl=https%3A%2F%2Ftujidao.com.atlaq.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&wgl=&js_build=iclick-1.629.0&bs=fedbc8ba-8823-42e9-b011-e670d79713e0&userId=4464f3f7fd7a4f43932a8ab6ed329308&m=link HTTP/1.1
Host: whulsaux.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Cookie: OAID=4464f3f7fd7a4f43932a8ab6ed329308; oaidts=1700387711
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/json
x-trace-id: 8446ee877541b04224f93e43b1238065
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=4464f3f7fd7a4f43932a8ab6ed329308; expires=Mon, 18 Nov 2024 09:55:11 GMT; path=/; secure; SameSite=None
oaidts=1700387711; expires=Mon, 18 Nov 2024 09:55:11 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Sun, 26 Nov 2023 09:55:11 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
atlaq.com/style.css
172.67.176.167200 OK 44 kB IP 172.67.176.167:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerCloudflare, Inc.
Subjectatlaq.com
Fingerprint1E:C6:84:53:3B:FF:CE:FF:8F:8C:9D:8B:3A:69:3F:E5:28:C8:F4:A5
ValidityWed, 26 Apr 2023 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (6732)
Hash 611e414a545a0c84fe6c111b9a4c3722
7fe2addc3373777aeb6de31caaf66f800049dd59
b5fc73fd3ef4ac8eda80826c1f684294f136c3d03c4afed7e7cd59a3f6a5a146
GET /style.css HTTP/1.1
Host: atlaq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 19 Nov 2023 09:55:10 GMT
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000
expires: Fri, 24 Nov 2023 06:07:01 GMT
last-modified: Tue, 25 Oct 2022 04:42:27 GMT
vary: Accept-Encoding,User-Agent,Origin
strict-transport-security: max-age=31536000;includeSubDomains
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 2173689
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IJOEGEkIJgE4ghImLw4QsKYrHZqpPvGRt%2BoxVmyt7LOPW7VoRIbb227LiyzBra5Z9rxB6nO3KVfbYKKLy%2B22u0geqqHmzmyyDOc2QSSV0NV5WQCKj3AN1QjKw38%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 828793793c3256c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://chicservices.ae
142.250.74.36404 Not Found 726 B URL GET HTTP/2 t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://chicservices.ae
IP 142.250.74.36:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash b8a0bf372c762e966cc99ede8682bc71
2d7c9b60d1e2b4f4726141de2e4ab738110b9287
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=https://chicservices.ae HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
cross-origin-resource-policy: cross-origin
content-type: image/png
x-content-type-options: nosniff
date: Sun, 19 Nov 2023 09:55:12 GMT
server: sffe
content-length: 726
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
zoowomaniacos.org/favicon.ico
172.67.199.155404 Not Found 0 B URL GET HTTP/2 zoowomaniacos.org/favicon.ico
IP 172.67.199.155:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerGoogle Trust Services LLC
Subjectzoowomaniacos.org
Fingerprint67:BF:69:0F:29:B0:46:3B:E8:F6:F1:EF:26:0E:45:22:F0:80:8F:1F
ValidityMon, 02 Oct 2023 17:10:54 GMT - Sun, 31 Dec 2023 17:10:53 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: zoowomaniacos.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y37%2BOP0INBi%2FHDO%2BOTRWh6Bplw14cErfFsZQDPcjMc5qVaGA%2FDKQxiG3TXjVH4hDFrWCKX5RLStO7o1iBzSaUML%2BAb1wxVkdcd7lExEQybNpMb7nXCdFAUPhY4OlB9n1NRAQeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8287937b798f5695-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
chicservices.ae/favicon.ico
0.0.0.0 0 B URL GET chicservices.ae/favicon.ico
IP 0.0.0.0:0
Requested by https://tujidao.com.atlaq.com/
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: chicservices.ae
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
traffic.alexa.com/graph?w=260&h=190&o=f&c=1&y=q&b=f5f5f5&n=666666&r=2y&u=tujidao.com
0.0.0.0 0 B URL GET traffic.alexa.com/graph?w=260&h=190&o=f&c=1&y=q&b=f5f5f5&n=666666&r=2y&u=tujidao.com
IP 0.0.0.0:0
Requested by https://tujidao.com.atlaq.com/
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /graph?w=260&h=190&o=f&c=1&y=q&b=f5f5f5&n=666666&r=2y&u=tujidao.com HTTP/1.1
Host: traffic.alexa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
my.rtmark.net/gid.js?userId=4464f3f7fd7a4f43932a8ab6ed329308
139.45.195.8200 OK 65 B URL GET HTTP/2 my.rtmark.net/gid.js?userId=4464f3f7fd7a4f43932a8ab6ed329308
IP 139.45.195.8:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash ef24a7f545fd6d06bfc801b2950a7a2e
de6aa0255d027b5a0912363bf8b35f3c15325d71
560165d49177da16abb2a3d5d24b69320189e6660233baa26c7bf824c07767cb
GET /gid.js?userId=4464f3f7fd7a4f43932a8ab6ed329308 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=4464f3f7fd7a4f43932a8ab6ed329308; expires=Mon, 18 Nov 2024 09:55:11 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
itweepinbelltor.com/pfe/current/universal.min.js?v=3.1.471
139.45.197.250200 OK 88 kB URL GET HTTP/2 itweepinbelltor.com/pfe/current/universal.min.js?v=3.1.471
IP 139.45.197.250:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectitweepinbelltor.com
Fingerprint02:3B:3D:FF:9B:86:67:A5:C6:4C:6C:1F:CB:D0:95:6B:BE:08:B2:DF
ValidityFri, 20 Oct 2023 05:44:18 GMT - Thu, 18 Jan 2024 05:44:17 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash d46d2997ab218d1dba1ab614422ed53f
3f1f6b9847c8ad209835db366c62fcb209b83a67
09e8ce2dfeac0ad09cd24788931b38ea7e7592f2c28eecc324b2dd1cd69d1b42
GET /pfe/current/universal.min.js?v=3.1.471 HTTP/1.1
Host: itweepinbelltor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tujidao.com.atlaq.com/
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/javascript
last-modified: Fri, 10 Nov 2023 11:00:39 GMT
etag: W/"654e0d57-1572c"
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
traffic.alexa.com/graph?w=260&h=190&o=f&c=1&y=t&b=f5f5f5&n=666666&r=2y&u=tujidao.com
0.0.0.0 0 B URL GET traffic.alexa.com/graph?w=260&h=190&o=f&c=1&y=t&b=f5f5f5&n=666666&r=2y&u=tujidao.com
IP 0.0.0.0:0
Requested by https://tujidao.com.atlaq.com/
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /graph?w=260&h=190&o=f&c=1&y=t&b=f5f5f5&n=666666&r=2y&u=tujidao.com HTTP/1.1
Host: traffic.alexa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
yosoyherbalifenutrition.com/favicon.ico
192.124.249.7404 Not Found 0 B URL GET HTTP/2 yosoyherbalifenutrition.com/favicon.ico
IP 192.124.249.7:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerStarfield Technologies, Inc.
Subjectyosoyherbalifenutrition.com
Fingerprint57:4F:BC:A1:4A:1B:F0:83:56:B3:A6:DB:1E:95:43:1C:DD:2B:59:56
ValidityMon, 24 Apr 2023 08:23:48 GMT - Wed, 24 Apr 2024 08:23:48 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: yosoyherbalifenutrition.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: text/html; charset=UTF-8
x-sucuri-id: 19007
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
referrer-policy: no-referrer-when-downgrade
cf-ray: 8287937cab036648-AMS
cf-cache-status: DYNAMIC
ki-cache-type: None
ki-cf-cache-status: BYPASS
ki-edge: v=20.2.5;mv=3.0.1
ki-origin: g1p
x-content-type-options: nosniff, nosniff
x-edge-location-klb: 1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m2E1sAFp8vMAuVI6sEsgkk5qSBtFzpDl1kqtzPhTibuPs9Rwvn1gCWMVu4yFRVs9iUbav7M0eairpkHqqh6NrwRIVFh0vkbza6Rbsav2sCxcX4pprwy5Q5t4pBRpubmeRBTBfw%2FRCP7SvhIs8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-sucuri-cache: MISS
X-Firefox-Spdy: h2
whulsaux.com/5/6577958/?oo=1&aab=1
139.45.197.244200 OK 2.8 kB URL GET HTTP/2 whulsaux.com/5/6577958/?oo=1&aab=1
IP 139.45.197.244:443
Requested by https://tujidao.com.atlaq.com/
Certificate IssuerLet's Encrypt
Subjectwhulsaux.com
Fingerprint29:C6:16:FB:8B:54:C5:1B:65:18:3D:96:39:33:73:B5:D3:8C:6D:48
ValidityFri, 01 Sep 2023 05:32:42 GMT - Thu, 30 Nov 2023 05:32:41 GMT
File type troff or preprocessor input, ASCII text, with very long lines (3009), with no line terminators
Hash 7b533359fd111f4cde94f886160e1f28
b7efcc8e41bbd1a45c281c9b4b1be7c404711d7d
520abbd0d99a5b4fe95d42965befa794a02d1a5b9900db1653075a3dc365c1fe
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /5/6577958/?oo=1&aab=1 HTTP/1.1
Host: whulsaux.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://tujidao.com.atlaq.com
DNT: 1
Connection: keep-alive
Referer: https://tujidao.com.atlaq.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 19 Nov 2023 09:55:11 GMT
content-type: application/json
x-trace-id: dc0ab19be19ea136651214d44d1a2a72
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: https://tujidao.com.atlaq.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=4464f3f7fd7a4f43932a8ab6ed329308; expires=Mon, 18 Nov 2024 09:55:11 GMT; path=/; secure; SameSite=None
oaidts=1700387711; expires=Mon, 18 Nov 2024 09:55:11 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2