r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7c60904d097cde276e4e5632cef1b9f1
4f805026462589345d85e8df2d18eafba6237504
12af026999398f4976749e320667d43da3f99b7a2e8254aca7a410a964a106aa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "12AF026999398F4976749E320667D43DA3F99B7A2E8254ACA7A410A964A106AA"
Last-Modified: Thu, 24 Nov 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4853
Expires: Fri, 25 Nov 2022 05:05:08 GMT
Date: Fri, 25 Nov 2022 03:44:15 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash af40a2fcf8debb90c3608002da6c907a
3c75d6c0b557a3bd8d5db50155b8d896e852c145
555617a51ee3077552545a29a3baf0b43e8a82367e4c08110ee480ebedc8b523
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4908
Cache-Control: max-age=115724
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:15 GMT
Etag: "637f47ef-1d7"
Expires: Sat, 26 Nov 2022 11:52:59 GMT
Last-Modified: Thu, 24 Nov 2022 10:31:11 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8c63b226725ca6e92e3ef586ac19e603
d21ae42a1927501e5293ff3564f52b49f6b0decc
141ac47acc3800e5d35a82012fa4b044277abad3a95dc24415f66fb72c972ae6
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "141AC47ACC3800E5D35A82012FA4B044277ABAD3A95DC24415F66FB72C972AE6"
Last-Modified: Wed, 23 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3730
Expires: Fri, 25 Nov 2022 04:46:25 GMT
Date: Fri, 25 Nov 2022 03:44:15 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash d130218d0e2841f39c99610fe1a2ab90
29fbe1e177ee55c7a61ae0a206afff271cf5f945
6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 25 Nov 2022 03:17:24 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1611
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: FojPZJYaxcWy7aWW2Zzo2GhLheewgsHHpN55eyIN0iypZ/3RX5oOmseF1tvVmdzHAVf6RHb7zGQ=
x-amz-request-id: J3KJ3ARVZWVE4G1J
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 25 Nov 2022 03:43:41 GMT
age: 34
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:15 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.daphnefsbo.com/
200 OK 792 B IP
ASN #134548 DXTL Tseung Kwan O Service
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ISO-8859 text, with CRLF line terminators
Hash b5542752916b85b26643e8a36b893b7c
72b575ff85b9cc4110b2a0654bd7a9afd681a02b
4bb8cc69ad7fe9d79a4f47eebbf5143d0ac0f127014e937556fc0ef4312c8f47
GET / HTTP/1.1
Host: www.daphnefsbo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:15 GMT
Content-Type: text/html
Content-Length: 792
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Cache-Control, ETag, Pragma, Expires, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 25 Nov 2022 03:08:53 GMT
cache-control: public,max-age=3600
age: 2123
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
www.daphnefsbo.com/tj.js
200 OK 208 B IP
ASN #134548 DXTL Tseung Kwan O Service
File type HTML document, ASCII text, with CRLF line terminators
Hash 31233c488f0427e71b3c599b4d325445
53aa736b5c414fd65c8d0763d07aa66a1d51e530
4b7ffcda6da629fb1bc4c5cedfe88289d5cb4d27e6caffe7c7c2c421d3183009
GET /tj.js HTTP/1.1
Host: www.daphnefsbo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:16 GMT
Content-Type: application/x-javascript
Content-Length: 208
Connection: keep-alive
www.daphnefsbo.com/common.js
200 OK 697 B URL HTTP/1.1 www.daphnefsbo.com/common.js
IP
ASN #134548 DXTL Tseung Kwan O Service
File type HTML document text\012- HTML document, ASCII text, with very long lines (443), with CRLF line terminators
Hash 48a22f4fc151be3bff17bb70fcdcd571
eee3f6b16675436fa050f940e06f0e9a4933c35e
715736f49505bb6547a572e1aee061ead5cf60b15f9999a3dcebf22c25032af3
GET /common.js HTTP/1.1
Host: www.daphnefsbo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:16 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
ocsp.digicert.com/
200 OK 471 B IP
Hash fb6949e7abaa473393f7c604691de14f
599681bba3947709baa603bbae2dd7afd04059a4
36c5165526ea9d34de14d36655ed494d0cffaa11ca3271ee47824ac11246ba13
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4173
Cache-Control: max-age=109926
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:16 GMT
Etag: "637f3429-1d7"
Expires: Sat, 26 Nov 2022 10:16:22 GMT
Last-Modified: Thu, 24 Nov 2022 09:06:49 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471
push.zhanzhang.baidu.com/push.js
200 OK 227 B URL HTTP/1.1 push.zhanzhang.baidu.com/push.js
IP
ASN #38365 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with no line terminators
Hash e548b6ce15bb616c2bfba36e9cfbf307
a348285d9928a6548a57569f1fb9d62bdd747f33
7be3e4c53cc47ce5cfa40a5e79b42848a90acee0d7ff71f10ac31a49c81aead5
GET /push.js HTTP/1.1
Host: push.zhanzhang.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Encoding: gzip
Content-Length: 227
Content-Type: text/javascript
Date: Fri, 25 Nov 2022 03:44:16 GMT
Etag: "4078521116"
Expires: Sat, 25 Nov 2023 03:44:16 GMT
Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: apache
Set-Cookie: BAIDUID=9074C5B60134408B80CAB6C71168304F:FG=1; max-age=31536000; expires=Sat, 25-Nov-23 03:44:16 GMT; domain=.baidu.com; path=/; version=1
Vary: Accept-Encoding
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: uOVJVpNVUXoTzgop6rBsMw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: jNGmoA4dPZyT3I4/FfH6bUh+dVU=
api.share.baidu.com/s.gif?l=http://www.daphnefsbo.com/
200 OK 0 B URL HTTP/1.1 api.share.baidu.com/s.gif?l=http://www.daphnefsbo.com/
IP
ASN #134770 CHINANET Jiangsu province Suzhou taihu IDC network
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s.gif?l=http://www.daphnefsbo.com/ HTTP/1.1
Host: api.share.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Fri, 25 Nov 2022 03:44:17 GMT
ocsp.globalsign.com/gsgccr3dvtlsca2020
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsgccr3dvtlsca2020
IP
Hash 360b7c9b784abfb318cf57cd0ee6bee5
4e29505fd5ad7272d39c28055b85e93b9d5e8876
db6004f00fac7a48d991f9bd332f1d8517440bb2d731886eaf0c4f2a4397bcc7
POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:17 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Tue, 29 Nov 2022 01:52:30 GMT
ETag: "4e29505fd5ad7272d39c28055b85e93b9d5e8876"
Last-Modified: Fri, 25 Nov 2022 01:52:31 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76f7628c4b651bfe-OSL
ocsp.globalsign.com/gsgccr3dvtlsca2020
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsgccr3dvtlsca2020
IP
Hash 360b7c9b784abfb318cf57cd0ee6bee5
4e29505fd5ad7272d39c28055b85e93b9d5e8876
db6004f00fac7a48d991f9bd332f1d8517440bb2d731886eaf0c4f2a4397bcc7
POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:17 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Tue, 29 Nov 2022 01:52:30 GMT
ETag: "4e29505fd5ad7272d39c28055b85e93b9d5e8876"
Last-Modified: Fri, 25 Nov 2022 01:52:31 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76f7628c4b73b4ee-OSL
js.users.51.la/21467683.js
200 OK 2.3 kB URL HTTP/1.1 js.users.51.la/21467683.js
IP
ASN #4837 CHINA UNICOM China169 Backbone
File type ASCII text, with very long lines (4898)
Hash d28f3b5c7bbd40ed92f566e221c9257d
410793b4f11c8d0a6b40099c56542e6d165827be
843bee01db39e39fa209ebfe72b70b16df75d38f40b2c6a4d0c48c0fa75c4a11
GET /21467683.js HTTP/1.1
Host: js.users.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:17 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=918ab3887025104c325; path=/
HWWAFSESTIME=1669347854571; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
js.users.51.la/21418051.js
200 OK 2.3 kB URL HTTP/1.1 js.users.51.la/21418051.js
IP
ASN #4837 CHINA UNICOM China169 Backbone
File type ASCII text, with very long lines (4898)
Hash ee83aa63e6e5aec33cde80fbb33e02df
3f6beae89b19eb8714eeb8f123d7a6d6c797019f
a64075cc03850440e10b204bc5de921f85f946ae27fb5894a68685a5e19700dc
GET /21418051.js HTTP/1.1
Host: js.users.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:17 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=2a23223e3608fbeecfe; path=/
HWWAFSESTIME=1669347856718; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4561
Expires: Fri, 25 Nov 2022 05:00:19 GMT
Date: Fri, 25 Nov 2022 03:44:18 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4561
Expires: Fri, 25 Nov 2022 05:00:19 GMT
Date: Fri, 25 Nov 2022 03:44:18 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68dc3a7e-f975-440d-a07f-305243b24788.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68dc3a7e-f975-440d-a07f-305243b24788.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c71b83b77af9bb19b3845048a3008b43
050da47a42e16a83c1d59419055961fe9f1f4cc0
cb36e84116edbaa02347bc53611a8318ac8284ac71346006cb95688a6a08f662
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68dc3a7e-f975-440d-a07f-305243b24788.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 10531
x-amzn-requestid: aa926e70-4b20-40ba-849d-50e96cab8bea
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cICPAHoqoAMFXHA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe3f9-28cdb407069866236c99a0c7;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:36:57 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: vfNXShGI5ZxOg8GVHCvI-6hGwZ-Vh-iVmO9YoCneZU05m8f3fiIl0w==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:54:38 GMT
age: 20980
etag: "050da47a42e16a83c1d59419055961fe9f1f4cc0"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
200 OK 4.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 841a4b110022a99ddea6f7bf66df0fa1
126771b86638108050cf57c0d12faa27f80f0edb
240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4309
x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: blE0hGNioAMF_Tg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0
x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 07:14:07 GMT
age: 73811
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2302d358-ba65-4bf0-9d74-b5fb532a1d52.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2302d358-ba65-4bf0-9d74-b5fb532a1d52.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1adbf0cd373a4c06caa71eac14e1286c
236199a790f16dcf96dba80b9945836b37e3c2eb
767fd66cf0751dd80b2453588f9363fac7d9637da3dc9098d25fb65699ca8c5e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2302d358-ba65-4bf0-9d74-b5fb532a1d52.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 6590
x-amzn-requestid: 5d8b02c4-673a-4c77-8f24-498d9b8a28ff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cIB8zGeAIAMF4HA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe384-661ce3991caf87e8558158c3;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: zrf0qGRu_c3x7ZTku1R-I-z2a_AS1vyjO4tIqja0f9XgGxwv6lWviw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:35:01 GMT
etag: "236199a790f16dcf96dba80b9945836b37e3c2eb"
content-type: image/jpeg
age: 22157
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80e95b58-6cf9-4974-a4ce-f8515ca995ee.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80e95b58-6cf9-4974-a4ce-f8515ca995ee.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8784bb7a8b88736a6016f712e3183bf3
b0ddc1555d2506177adcdcea77864d75f1245d07
8e331713b0ad0b5670dd33dfdadde665e076a40ddb80905d4df89876d49803d8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80e95b58-6cf9-4974-a4ce-f8515ca995ee.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 11743
x-amzn-requestid: 9ab0aba7-5cd1-4f6c-8984-dc221e1cbf8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cICD-F7joAMFqmA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe3b2-152ba5f1495a44447356cdab;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oWSNdsrz59sJC2znLnFqa_Zm3T14_d6j-rjzDQe4yV22Dy2Qc4Swaw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:54:45 GMT
age: 20973
etag: "b0ddc1555d2506177adcdcea77864d75f1245d07"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d60bb22-4a30-4570-8561-eb3a2833a058.jpeg
200 OK 8.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d60bb22-4a30-4570-8561-eb3a2833a058.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f59a591b222397ff0f01c22a0786e660
6a8504212141af411a18ce58960c8bb52e8116ac
624847cfdfcd770d2dee8a2b85f3c7c480cda58ba2aef1135184f3dffc30d1f1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d60bb22-4a30-4570-8561-eb3a2833a058.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8277
x-amzn-requestid: e84a5668-cd91-42af-b6de-5eb694ea56e6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cIB-KFtmIAMF00Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe38d-64513fb257d83b9847c82929;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:09 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rIKW7gaK37mlbk_TUo63AH9-XDOoF3Z-5mGaeOkzmESFLJ3GHz60lA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:35:10 GMT
etag: "6a8504212141af411a18ce58960c8bb52e8116ac"
content-type: image/jpeg
age: 22148
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc72e29c5-d9d3-43d5-8c71-f66a22a3f112.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc72e29c5-d9d3-43d5-8c71-f66a22a3f112.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9bc7c4877bfa24d0c1bbb774cd906af1
75d9a14e98ffba5a71a6f710be721b593338ffdc
b0e1d9af095632e6d75bc7606bccfb0c1903f5173696cefb7e36c3d34a98358e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc72e29c5-d9d3-43d5-8c71-f66a22a3f112.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6560
x-amzn-requestid: e8956a92-d016-41a2-99b4-631a6db3b8db
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: byQzsFY3IAMF9iA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63772e7d-2337148b0a824d134aaab9d7;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 07:04:29 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: dU517RkLcsPSCY7GMmqqe4ommRFNpp6CVw4rYEm06u8i3e6_M3FfaQ==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 10:48:48 GMT
age: 60930
etag: "75d9a14e98ffba5a71a6f710be721b593338ffdc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
www.daphnefsbo.com/favicon.ico
200 OK 1.2 kB URL HTTP/1.1 www.daphnefsbo.com/favicon.ico
IP
ASN #134548 DXTL Tseung Kwan O Service
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 7ef1f0a0093460fe46bb691578c07c95
2da3ffbbf4737ce4dae9488359de34034d1ebfbd
4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c
GET /favicon.ico HTTP/1.1
Host: www.daphnefsbo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
Cookie: __tins__21467683=%7B%22sid%22%3A%201669347857411%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201669349657411%7D; __51cke__=; __51laig__=2; __tins__21418051=%7B%22sid%22%3A%201669347857437%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201669349657437%7D
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:18 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT
Connection: keep-alive
ETag: "4e0d81df-47e"
Expires: Wed, 30 Nov 2022 03:44:18 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes
38.239.196.126/nar/756.html
200 OK 687 B URL HTTP/1.1 38.239.196.126/nar/756.html
IP
File type HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 42136db4af05d6f9ea747ff6c496d412
95befc1a8c30abafddd8bc0a456d70f491b22355
f68907b3aab4ecf1de3006ad193a5409b279768b51f52518c1276536194a954e
Analyzer Verdict Alert quad9 Sinkholed
GET /nar/756.html HTTP/1.1
Host: 38.239.196.126
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:18 GMT
Content-Type: text/html
Content-Length: 687
Last-Modified: Thu, 24 Nov 2022 20:55:45 GMT
Connection: keep-alive
ETag: "637fda51-2af"
Accept-Ranges: bytes
38.239.194.4/0.12452881528696702
404 Not Found 146 B URL HTTP/1.1 38.239.194.4/0.12452881528696702
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert quad9 Sinkholed
GET /0.12452881528696702 HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.196.126/
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 25 Nov 2022 03:44:18 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
38.239.194.6/0.539495297421718
404 Not Found 146 B URL HTTP/1.1 38.239.194.6/0.539495297421718
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert quad9 Sinkholed
GET /0.539495297421718 HTTP/1.1
Host: 38.239.194.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.196.126/
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 25 Nov 2022 03:44:18 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
38.239.194.4/
200 OK 9.5 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (7286), with CRLF line terminators
Hash dd57ee5438684b2f5b773003734bbc6a
806539a31165c9badb08c823279de7db5276e112
430275cfdeb79886ddb0c468099e46daebc8c373bde568e3e425ca457f7684b8
Analyzer Verdict Alert quad9 Sinkholed
GET / HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.196.126/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: text/html;Charset=utf-8;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=5q24tqbed8cq5ec97dli4j0074; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 7d8efdd41b8040a8ac3fb7ae891d1d54
3eb9674f12bbfe098808b7011f6867a25e4f5885
85b45ec330e2f9aad9e5d67855495625c60bcc71cd94ff5759453e06fb1104ea
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "85B45EC330E2F9AAD9E5D67855495625C60BCC71CD94FF5759453E06FB1104EA"
Last-Modified: Wed, 23 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3180
Expires: Fri, 25 Nov 2022 04:37:19 GMT
Date: Fri, 25 Nov 2022 03:44:19 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 7d8efdd41b8040a8ac3fb7ae891d1d54
3eb9674f12bbfe098808b7011f6867a25e4f5885
85b45ec330e2f9aad9e5d67855495625c60bcc71cd94ff5759453e06fb1104ea
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "85B45EC330E2F9AAD9E5D67855495625C60BCC71CD94FF5759453E06FB1104EA"
Last-Modified: Wed, 23 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3180
Expires: Fri, 25 Nov 2022 04:37:19 GMT
Date: Fri, 25 Nov 2022 03:44:19 GMT
Connection: keep-alive
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/hviplus5zcy1730hviplus5zcy125140.jpg
200 OK 9.3 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/hviplus5zcy1730hviplus5zcy125140.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash c7e9ad2792e5812a811f1554dcbc0b47
0b8291d49705fd25f9a79f4b0ece6a16c5015f60
0e444921e38e4a94bba49430009803b450b6425ee7d19d73c5e447a3ebc3ab33
GET /upload/vod/2022/11-24/17/hviplus5zcy1730hviplus5zcy125140.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 9276
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=10018
content-disposition: inline; filename="hviplus5zcy1730hviplus5zcy125140.webp"
etag: "637f39a4-2722"
last-modified: Thu, 24 Nov 2022 09:30:12 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 2928
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fc3b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/udqy5husaln1730udqy5husaln135142.jpg
200 OK 7.5 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/udqy5husaln1730udqy5husaln135142.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash b7cbb3a5a7aa875e0ec5e04d09e06b7b
451d7d0e3a8929b6029c38acdc30a12adbb1fa05
452e88a310328abf6648527e0bb0888484859af496020ab2169cd144497da9c6
GET /upload/vod/2022/11-24/17/udqy5husaln1730udqy5husaln135142.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 7492
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=8129
content-disposition: inline; filename="udqy5husaln1730udqy5husaln135142.webp"
etag: "637f39a5-1fc1"
last-modified: Thu, 24 Nov 2022 09:30:13 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 3607
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fc2b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/0rur5rubhdo17300rur5rubhdo155146.jpg
200 OK 10 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/0rur5rubhdo17300rur5rubhdo155146.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 3x4, segment length 16, progressive, precision 8, 240x320, components 3\012- data
Hash 2184a18ed38cce5f44abc5bb33d31710
6984d5b2a2759b4a18624c3230a7f2098fc58da1
c2464f080c766dcbf2c24de7d6e39b872856538809eb2693f73d4a51d58f9d89
GET /upload/vod/2022/11-24/17/0rur5rubhdo17300rur5rubhdo155146.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/jpeg
content-length: 10467
cf-bgj: imgq:85,h2pri
cf-polished: origSize=11206, status=webp_bigger
etag: "637f39a7-2bc6"
last-modified: Thu, 24 Nov 2022 09:30:15 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 2928
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762993fc4b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/1el045t00pv17301el045t00pv145144.jpg
200 OK 9.7 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/1el045t00pv17301el045t00pv145144.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 3x4, segment length 16, progressive, precision 8, 240x320, components 3\012- data
Hash 97a079367349730dd3374b2250d89560
a3bf3c527e4e61c01193401cfb677abcfd9c971c
23c9c7cc617206a3b83068a8d88196d1c09530f22c84188475938d3501f8220f
GET /upload/vod/2022/11-24/17/1el045t00pv17301el045t00pv145144.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/jpeg
content-length: 9718
cf-bgj: imgq:85,h2pri
cf-polished: origSize=10270, status=webp_bigger
etag: "637f39a6-281e"
last-modified: Thu, 24 Nov 2022 09:30:14 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 3607
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762993fc7b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/sunqzepigob1730sunqzepigob195154.jpg
200 OK 7.8 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/sunqzepigob1730sunqzepigob195154.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 7a314f5595738bedb10b9086cc300500
958e1fab4f608a2e981198bdc7ee4964dd05124f
4a2ec5493e2e6c98e6c069ff425250a61322d1320ca2357cb4c8696ee85094f9
GET /upload/vod/2022/11-24/17/sunqzepigob1730sunqzepigob195154.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 7766
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=9211
content-disposition: inline; filename="sunqzepigob1730sunqzepigob195154.webp"
etag: "637f39ab-23fb"
last-modified: Thu, 24 Nov 2022 09:30:19 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 3607
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fc9b51b-OSL
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 7d8efdd41b8040a8ac3fb7ae891d1d54
3eb9674f12bbfe098808b7011f6867a25e4f5885
85b45ec330e2f9aad9e5d67855495625c60bcc71cd94ff5759453e06fb1104ea
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "85B45EC330E2F9AAD9E5D67855495625C60BCC71CD94FF5759453E06FB1104EA"
Last-Modified: Wed, 23 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3180
Expires: Fri, 25 Nov 2022 04:37:19 GMT
Date: Fri, 25 Nov 2022 03:44:19 GMT
Connection: keep-alive
lbfm.lbpictupian.com/upload/vod/2022/11-23/09/wlaouoilj2j0900wlaouoilj2j584802.jpg
200 OK 3.9 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-23/09/wlaouoilj2j0900wlaouoilj2j584802.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 240x320, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 5af06725625313aab0304db3476cfd34
aa7eb207c3be2bf001f02be76428fe33de239f84
b795566977ff2c4b086f7fc87411a4cccb8863001e766c009eec1f16ed20c020
GET /upload/vod/2022/11-23/09/wlaouoilj2j0900wlaouoilj2j584802.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 3870
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=5957
content-disposition: inline; filename="wlaouoilj2j0900wlaouoilj2j584802.webp"
etag: "637d70ca-1745"
last-modified: Wed, 23 Nov 2022 01:00:58 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4825
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fc0b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/o0kpydpwigp1730o0kpydpwigp105134.jpg
200 OK 8.5 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/o0kpydpwigp1730o0kpydpwigp105134.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 1a08b9ae07c2a93955ad8b80543a3793
5563920aff337e459779d6100a3f143ac0148508
0e484d86dd62950118ea6365707b35542e9985a7472041f8bfcfb87ddb1369d0
GET /upload/vod/2022/11-24/17/o0kpydpwigp1730o0kpydpwigp105134.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 8482
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=11388
content-disposition: inline; filename="o0kpydpwigp1730o0kpydpwigp105134.webp"
etag: "637f39a2-2c7c"
last-modified: Thu, 24 Nov 2022 09:30:10 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 2928
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fc6b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/30cfvwvgjak173030cfvwvgjak115138.jpg
200 OK 12 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/30cfvwvgjak173030cfvwvgjak115138.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash cd1a02d4532c85de5a1e06cd1564c54e
f6da14f362ddfd39c98e303d59ee90baadde593f
6e2057790947b4ec53238dfed15323049c39b8dd00fec609858011c780f867e6
GET /upload/vod/2022/11-24/17/30cfvwvgjak173030cfvwvgjak115138.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 12476
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=12724
content-disposition: inline; filename="30cfvwvgjak173030cfvwvgjak115138.webp"
etag: "637f39a3-31b4"
last-modified: Thu, 24 Nov 2022 09:30:11 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 2928
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fccb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/kr2311vbxw51730kr2311vbxw5105136.jpg
200 OK 7.9 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/kr2311vbxw51730kr2311vbxw5105136.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 13db57111e466476e6663a55dfeaac51
d83c735da4bb38f5dbbc91fe6b7969f715f486b6
d3c76b6057a0fda40ea7393dcd28807c36ac64c92d3b09995f9560502b83d077
GET /upload/vod/2022/11-24/17/kr2311vbxw51730kr2311vbxw5105136.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 7874
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=9027
content-disposition: inline; filename="kr2311vbxw51730kr2311vbxw5105136.webp"
etag: "637f39a3-2343"
last-modified: Thu, 24 Nov 2022 09:30:11 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: HIT
age: 2928
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fcbb51b-OSL
X-Firefox-Spdy: h2
38.239.194.4/template/m1938/css/ate.css
200 OK 6.0 kB URL HTTP/1.1 38.239.194.4/template/m1938/css/ate.css
IP
File type ASCII text, with CRLF line terminators
Hash 251de3a6c1f48287067d6e9884f7888f
d0d01ad05609d705df6dc86c14d7911aab71b8f2
256f80b2d6f2d004ddba641a773690bae0c70094d68d2ea3fa5b3893ff4ecb94
Analyzer Verdict Alert quad9 Sinkholed
GET /template/m1938/css/ate.css HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: text/css
Last-Modified: Sun, 07 Mar 2021 04:24:42 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6044558a-126e5"
Expires: Fri, 25 Nov 2022 15:44:19 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
js.users.51.la/21285107.js
200 OK 2.3 kB URL HTTP/1.1 js.users.51.la/21285107.js
IP
ASN #4837 CHINA UNICOM China169 Backbone
File type ASCII text, with very long lines (4898)
Hash 2a62068128af7ac1e9295a6aa9288681
34e7db7d16d30ebe5b5aad07e667df21d9a2945a
4106736f2422718c5c5c49f1176be5432993ccce430a2445d6ec2839758dd35c
GET /21285107.js HTTP/1.1
Host: js.users.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=918ab57d7025104c325; path=/
HWWAFSESTIME=1669347854571; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/1kjb3ztu3a317301kjb3ztu3a3265170.jpg
200 OK 4.7 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/1kjb3ztu3a317301kjb3ztu3a3265170.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash ca06d5353270228cd993533ce47fea66
0cd4d4870b84184b1434823b0db7bf3becec3d0c
d893c8e380c59b4a1c8484f55ebd2f913e9c364d484be06dd3154d100c28db08
GET /upload/vod/2022/11-24/17/1kjb3ztu3a317301kjb3ztu3a3265170.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 4684
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=6979
content-disposition: inline; filename="1kjb3ztu3a317301kjb3ztu3a3265170.webp"
etag: "637f39b2-1b43"
last-modified: Thu, 24 Nov 2022 09:30:26 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fbfb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/aamqzw5pumv1730aamqzw5pumv255168.jpg
200 OK 3.7 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/aamqzw5pumv1730aamqzw5pumv255168.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 7d0a31c80e7bc1a02ebf1b790a97c6e7
3d74e64a82a768f47a83b1843b15ef8b007deec9
01e6409fdc0729495ccf5f2641c9897ebfaef30336cc4f389b0da6727c95c7bf
GET /upload/vod/2022/11-24/17/aamqzw5pumv1730aamqzw5pumv255168.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 3682
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=5671
content-disposition: inline; filename="aamqzw5pumv1730aamqzw5pumv255168.webp"
etag: "637f39b1-1627"
last-modified: Thu, 24 Nov 2022 09:30:25 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fbeb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/zo0cu4ncgin1730zo0cu4ncgin195156.jpg
200 OK 3.8 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/zo0cu4ncgin1730zo0cu4ncgin195156.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 68e4cdf8dd763758e678ffac2f3a4e3f
caf27432ba37cfbd3faa0468b576944d62acfcd2
a95f7d24b0cde73874e7dd3a2e9215fd943e1d1a66d313738278b39a65cde98e
GET /upload/vod/2022/11-24/17/zo0cu4ncgin1730zo0cu4ncgin195156.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 3826
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=6398
content-disposition: inline; filename="zo0cu4ncgin1730zo0cu4ncgin195156.webp"
etag: "637f39ac-18fe"
last-modified: Thu, 24 Nov 2022 09:30:20 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fc8b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/apdnmrxfrel1730apdnmrxfrel185152.jpg
200 OK 17 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/apdnmrxfrel1730apdnmrxfrel185152.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, progressive, precision 8, 320x240, components 3\012- data
Hash 59e9557523e7a7837a6781a14afbbc61
96fd7272b0eb0c3ea7ec545aeec702909d4fa217
5a3feb5fc60e0e9bc4074859234e170109a013fd6cf4900f4fc0ed9005558a51
GET /upload/vod/2022/11-24/17/apdnmrxfrel1730apdnmrxfrel185152.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/jpeg
content-length: 16823
cf-bgj: imgq:85,h2pri
cf-polished: origSize=17763, status=webp_bigger
etag: "637f39aa-4563"
last-modified: Thu, 24 Nov 2022 09:30:18 GMT
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762993fc5b51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/2g2feuszfwc17302g2feuszfwc175150.jpg
200 OK 12 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/2g2feuszfwc17302g2feuszfwc175150.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 823360a32f93f11714821ae293e1ad96
2ae4a2a5ad64ac245d972a481220798c3e4cfdbd
0d49ba9edbbf026753ee6439f489e9fcc1c0f3d244f602dc06fb1ac4986eec02
GET /upload/vod/2022/11-24/17/2g2feuszfwc17302g2feuszfwc175150.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 11872
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=12539
content-disposition: inline; filename="2g2feuszfwc17302g2feuszfwc175150.webp"
etag: "637f39a9-30fb"
last-modified: Thu, 24 Nov 2022 09:30:17 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fcab51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/o3yn2uqzidd1730o3yn2uqzidd165148.jpg
200 OK 18 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/o3yn2uqzidd1730o3yn2uqzidd165148.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x240, components 3\012- data
Hash 25a5583166b86e213eaaede1031422e4
fba42029f892d891991d1a21732f1d511d4c5901
c6ddcc50385259f60eefadc59abe19e08d5228bde940e308c45b8f1365207897
GET /upload/vod/2022/11-24/17/o3yn2uqzidd1730o3yn2uqzidd165148.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/jpeg
content-length: 17498
cf-bgj: imgq:85,h2pri
cf-polished: degrade=85, origSize=17811, status=webp_bigger
etag: "637f39a8-4593"
last-modified: Thu, 24 Nov 2022 09:30:16 GMT
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762993fcdb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/4voc45ycusw17304voc45ycusw235164.jpg
200 OK 5.1 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/4voc45ycusw17304voc45ycusw235164.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 320x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash dba2fe565422df57625e2c6d91d8aeea
c8e4352de353456f314334b73d1ef271af34ec93
6625673124bcc9e6a8cf58417111e2fbc4fd60053b0d84b835ef4063843ef389
GET /upload/vod/2022/11-24/17/4voc45ycusw17304voc45ycusw235164.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 5074
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=6381
content-disposition: inline; filename="4voc45ycusw17304voc45ycusw235164.webp"
etag: "637f39af-18ed"
last-modified: Thu, 24 Nov 2022 09:30:23 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fbcb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/2kvwuy1gj5y17302kvwuy1gj5y205158.jpg
200 OK 9.1 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/2kvwuy1gj5y17302kvwuy1gj5y205158.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 563x750, segment length 16, progressive, precision 8, 240x320, components 3\012- data
Hash 6e3a5997eaae28981fb688cac41c9b3f
d91ba2688b570a18728b892498a43af491780fe7
165e2d96c9c5474577520a68ba849500c72e345ac3313669a3cdf6fddce52431
GET /upload/vod/2022/11-24/17/2kvwuy1gj5y17302kvwuy1gj5y205158.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/jpeg
content-length: 9143
cf-bgj: imgq:85,h2pri
cf-polished: origSize=9582, status=webp_bigger
etag: "637f39ac-256e"
last-modified: Thu, 24 Nov 2022 09:30:20 GMT
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762993fcfb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/3f4ecaa3qvj17303f4ecaa3qvj245166.jpg
200 OK 13 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/3f4ecaa3qvj17303f4ecaa3qvj245166.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x240, components 3\012- data
Hash b6de591e807a508fc7e4276db14bc030
3665b42020b4391269cdd0ec5c9706714f80ca61
bf68f96828de4c78c441c45d3a8f5dfe4d8e8e857125b48aedcf730e51f57128
GET /upload/vod/2022/11-24/17/3f4ecaa3qvj17303f4ecaa3qvj245166.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/jpeg
content-length: 12764
cf-bgj: imgq:85,h2pri
cf-polished: degrade=85, origSize=15170, status=webp_bigger
etag: "637f39b0-3b42"
last-modified: Thu, 24 Nov 2022 09:30:24 GMT
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762993fbdb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/y3x1eidsvx11730y3x1eidsvx1225162.jpg
200 OK 8.1 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/y3x1eidsvx11730y3x1eidsvx1225162.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 240x320, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 28b3566436c7e47f1f856d5bc694d8da
913c560fbd4873020557c4f1439c974b57c82812
635d4873e59ecc756c0a9076570e9173c1f6298764036cdb200291723cd844a5
GET /upload/vod/2022/11-24/17/y3x1eidsvx11730y3x1eidsvx1225162.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 8072
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=9668
content-disposition: inline; filename="y3x1eidsvx11730y3x1eidsvx1225162.webp"
etag: "637f39ae-25c4"
last-modified: Thu, 24 Nov 2022 09:30:22 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fbbb51b-OSL
X-Firefox-Spdy: h2
lbfm.lbpictupian.com/upload/vod/2022/11-24/17/p0ftymwghrn1730p0ftymwghrn215160.jpg
200 OK 8.0 kB URL HTTP/2 lbfm.lbpictupian.com/upload/vod/2022/11-24/17/p0ftymwghrn1730p0ftymwghrn215160.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 240x320, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 7da2aa4483245cb49bfd3f8e6a948ae5
f619136118925b60d253a8d099f12b5440dc2b47
dc56fa08cb8ed40cab424df42779e5ec6331673e7fae0ad0d936ed2c1ea92dcc
GET /upload/vod/2022/11-24/17/p0ftymwghrn1730p0ftymwghrn215160.jpg HTTP/1.1
Host: lbfm.lbpictupian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:19 GMT
content-type: image/webp
content-length: 7990
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=9311
content-disposition: inline; filename="p0ftymwghrn1730p0ftymwghrn215160.webp"
etag: "637f39ad-245f"
last-modified: Thu, 24 Nov 2022 09:30:21 GMT
vary: Accept
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
server: cloudflare
cf-ray: 76f762993fceb51b-OSL
X-Firefox-Spdy: h2
38.239.194.4/template/m1938/css/zui.css
200 OK 22 kB URL HTTP/1.1 38.239.194.4/template/m1938/css/zui.css
IP
File type assembler source, Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Hash 989119441b99dc00d29481edf802fef3
c3141b9d2c5e3d82f2a3a2e6abd747b198cbc7ea
4d49f5f5cd38ba825d17e7d76c9592e824c495b3d1a01246454cfa72029598fd
Analyzer Verdict Alert quad9 Sinkholed
GET /template/m1938/css/zui.css HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: text/css
Last-Modified: Mon, 04 Apr 2022 16:48:10 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"624b214a-17838"
Expires: Fri, 25 Nov 2022 15:44:19 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
js.users.51.la/21481107.js
200 OK 2.3 kB URL HTTP/1.1 js.users.51.la/21481107.js
IP
ASN #4837 CHINA UNICOM China169 Backbone
File type ASCII text, with very long lines (4898)
Hash bf21d1c7769c2a14bd910ae21ae1d68e
205b103838a383a22ae4869b053d8d20546bbebd
f843ce4be057b27ca449aac019bafa3fa2d08100c97dee30f1703f8875565954
GET /21481107.js HTTP/1.1
Host: js.users.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200 OK
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=7ce6b5e3faccff129c4; path=/
HWWAFSESTIME=1669347856353; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6783a14dcf1e45bf85c21fb9c2633f8b
38a83dee1d62563e1f883f17bd051d5c1c50e6a5
68c5a150ea2d1e7ccd3fb32d84ee4dd4ef5f1efca80d3b02e953c9437da8dbc8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "68C5A150EA2D1E7CCD3FB32D84EE4DD4EF5F1EFCA80D3B02E953C9437DA8DBC8"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10812
Expires: Fri, 25 Nov 2022 06:44:32 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6783a14dcf1e45bf85c21fb9c2633f8b
38a83dee1d62563e1f883f17bd051d5c1c50e6a5
68c5a150ea2d1e7ccd3fb32d84ee4dd4ef5f1efca80d3b02e953c9437da8dbc8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "68C5A150EA2D1E7CCD3FB32D84EE4DD4EF5F1EFCA80D3B02E953C9437DA8DBC8"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10863
Expires: Fri, 25 Nov 2022 06:45:23 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6783a14dcf1e45bf85c21fb9c2633f8b
38a83dee1d62563e1f883f17bd051d5c1c50e6a5
68c5a150ea2d1e7ccd3fb32d84ee4dd4ef5f1efca80d3b02e953c9437da8dbc8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "68C5A150EA2D1E7CCD3FB32D84EE4DD4EF5F1EFCA80D3B02E953C9437DA8DBC8"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10863
Expires: Fri, 25 Nov 2022 06:45:23 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6783a14dcf1e45bf85c21fb9c2633f8b
38a83dee1d62563e1f883f17bd051d5c1c50e6a5
68c5a150ea2d1e7ccd3fb32d84ee4dd4ef5f1efca80d3b02e953c9437da8dbc8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "68C5A150EA2D1E7CCD3FB32D84EE4DD4EF5F1EFCA80D3B02E953C9437DA8DBC8"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10870
Expires: Fri, 25 Nov 2022 06:45:30 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6783a14dcf1e45bf85c21fb9c2633f8b
38a83dee1d62563e1f883f17bd051d5c1c50e6a5
68c5a150ea2d1e7ccd3fb32d84ee4dd4ef5f1efca80d3b02e953c9437da8dbc8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "68C5A150EA2D1E7CCD3FB32D84EE4DD4EF5F1EFCA80D3B02E953C9437DA8DBC8"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10853
Expires: Fri, 25 Nov 2022 06:45:13 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
38.239.194.4/template/m1938/images/1.gif
200 OK 254 B URL HTTP/1.1 38.239.194.4/template/m1938/images/1.gif
IP
File type GIF image data, version 89a, 16 x 17\012- data
Hash b013f8fa3ec997fe20dc80b82af0ad0a
e02ce6c30d5c0abfaa3e008d1a3ce7d11f299ed9
119bff063d1d402fdf6e48bc7e681d48aabfb9bc65378dfcf64a8845ec3fceef
Analyzer Verdict Alert quad9 Sinkholed
GET /template/m1938/images/1.gif HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: image/gif
Content-Length: 254
Last-Modified: Mon, 04 Apr 2022 14:58:52 GMT
Connection: keep-alive
ETag: "624b07ac-fe"
Expires: Sun, 25 Dec 2022 03:44:19 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
ia.51.la/go1?id=21418051&rt=1669347857437&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=2&ekc=&sid=1669347857437&tt=%25E9%2582%25AF%25E9%2583%25B8%25E5%2584%2587%25E7%25BA%25A7%25E5%25BB%25BA%25E6%259D%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=&cu=http%253A%252F%252Fwww.daphnefsbo.com%252F&pu=
200 0 B URL HTTP/1.1 ia.51.la/go1?id=21418051&rt=1669347857437&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=2&ekc=&sid=1669347857437&tt=%25E9%2582%25AF%25E9%2583%25B8%25E5%2584%2587%25E7%25BA%25A7%25E5%25BB%25BA%25E6%259D%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=&cu=http%253A%252F%252Fwww.daphnefsbo.com%252F&pu=
IP
ASN #4837 CHINA UNICOM China169 Backbone
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go1?id=21418051&rt=1669347857437&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=2&ekc=&sid=1669347857437&tt=%25E9%2582%25AF%25E9%2583%25B8%25E5%2584%2587%25E7%25BA%25A7%25E5%25BB%25BA%25E6%259D%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=&cu=http%253A%252F%252Fwww.daphnefsbo.com%252F&pu= HTTP/1.1
Host: ia.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
HTTP/1.1 200
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=682ad78a1c938265e3d; path=/
HWWAFSESTIME=1669347857602; path=/
ia.51.la/go1?id=21467683&rt=1669347857411&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1669347857411&tt=%25E9%2582%25AF%25E9%2583%25B8%25E5%2584%2587%25E7%25BA%25A7%25E5%25BB%25BA%25E6%259D%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=&cu=http%253A%252F%252Fwww.daphnefsbo.com%252F&pu=
200 0 B URL HTTP/1.1 ia.51.la/go1?id=21467683&rt=1669347857411&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1669347857411&tt=%25E9%2582%25AF%25E9%2583%25B8%25E5%2584%2587%25E7%25BA%25A7%25E5%25BB%25BA%25E6%259D%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=&cu=http%253A%252F%252Fwww.daphnefsbo.com%252F&pu=
IP
ASN #4837 CHINA UNICOM China169 Backbone
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go1?id=21467683&rt=1669347857411&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1669347857411&tt=%25E9%2582%25AF%25E9%2583%25B8%25E5%2584%2587%25E7%25BA%25A7%25E5%25BB%25BA%25E6%259D%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=&cu=http%253A%252F%252Fwww.daphnefsbo.com%252F&pu= HTTP/1.1
Host: ia.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.daphnefsbo.com/
HTTP/1.1 200
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=b0b1d6bb7fe1f3c80ba; path=/
HWWAFSESTIME=1669347857917; path=/
www.gfngus-fd5fsfr.cc/ssiq/dht.js
404 Not Found 146 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/dht.js
IP
ASN #134548 DXTL Tseung Kwan O Service
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
GET /ssiq/dht.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2
www.gfngus-fd5fsfr.cc/ssiq/tj.js
200 OK 0 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/tj.js
IP
ASN #134548 DXTL Tseung Kwan O Service
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ssiq/tj.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
content-length: 0
last-modified: Wed, 20 Jul 2022 03:19:47 GMT
etag: "62d77453-0"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
www.gfngus-fd5fsfr.cc/ssiq/dl.js
200 OK 0 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/dl.js
IP
ASN #134548 DXTL Tseung Kwan O Service
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ssiq/dl.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
content-length: 0
last-modified: Wed, 16 Mar 2022 16:11:12 GMT
etag: "62320c20-0"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
38.239.194.4/template/m1938//images/1.png
200 OK 43 kB URL HTTP/1.1 38.239.194.4/template/m1938//images/1.png
IP
File type PNG image data, 350 x 91, 8-bit/color RGBA, non-interlaced\012- data
Hash 00d985bcfda2fff5a222ca4f40d78f88
0ee6b80d0cd8c697c5692b231a9e1669aad183ce
55a9a5f94728aeabefe15240204b3210175e24a18df03aad3f4f2b8fdba89afd
Analyzer Verdict Alert quad9 Sinkholed
GET /template/m1938//images/1.png HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:19 GMT
Content-Type: image/png
Content-Length: 43176
Last-Modified: Sun, 10 Apr 2022 13:53:00 GMT
Connection: keep-alive
ETag: "6252e13c-a8a8"
Expires: Sun, 25 Dec 2022 03:44:19 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.gfngus-fd5fsfr.cc/ssiq/tz.js
200 OK 1.0 kB URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/tz.js
IP
ASN #134548 DXTL Tseung Kwan O Service
Hash a3fce99262b74e92043bbf8687fb8f5e
0335a5c09d9a8bd621c12bf9a070f0b7809601b9
0f64a9b2bef5f8709038d7f9667fe3952a1c5123566a910f6983ad546faff836
GET /ssiq/tz.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
last-modified: Thu, 10 Nov 2022 09:30:12 GMT
vary: Accept-Encoding
etag: W/"636cc4a4-86b"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
tupkku.top/logotp/hgsbtr01.gif
200 OK 1.6 MB URL HTTP/2 tupkku.top/logotp/hgsbtr01.gif
IP
File type GIF image data, version 89a, 500 x 281\012- data
Size 1.6 MB (1626999 bytes)
Hash 17244f3a8b60a0f7b291f5621c873713
c523f5d5b60d2eabc9084e9ba5803647ac08c2cd
4aed8c090aa7bff3de4c028efced6a87dd7645bc15d265cdddf106f3f5dd9435
GET /logotp/hgsbtr01.gif HTTP/1.1
Host: tupkku.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: image/gif
content-length: 1626999
last-modified: Sun, 31 Jul 2022 13:10:59 GMT
etag: "62e67f63-18d377"
expires: Tue, 06 Dec 2022 05:13:29 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1595884
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VczBsYlCrFBMwuEw278FWXgM9AhWoVsoQVaSnEaszQN2j5razGk0QsWLyoHNi9VHw5sRohLsn16ANhWTm8ZfcBzeVOkiNJdHHC5y00gZVI0JBWUlqb5Yfo%2FVohJR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762a18f521c0e-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 99b4009cb5b56adf8c87ed0c5df8ac38
afad21ac3bd44aa94ffccb9677eb9bcc412b035e
bd036fab8f4c95fcd29c80f8d7bf7f24d90b963e187d71b64175d72b0da25022
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "BD036FAB8F4C95FCD29C80F8D7BF7F24D90B963E187D71B64175D72B0DA25022"
Last-Modified: Wed, 23 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8856
Expires: Fri, 25 Nov 2022 06:11:56 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
38.239.194.4/template/m1938/images/video-play.png
200 OK 1.6 kB URL HTTP/1.1 38.239.194.4/template/m1938/images/video-play.png
IP
File type PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced\012- data
Hash be7ca0a4a7c0317398a11162b1e09b75
5dbe6a02524cfbf5f5111478a71f91a9259056b5
cbad06b58f97516faa5f745d4e09716b5db3f134d5b4644b159681aa24909dd4
Analyzer Verdict Alert quad9 Sinkholed
GET /template/m1938/images/video-play.png HTTP/1.1
Host: 38.239.194.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/template/m1938/css/zui.css
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:20 GMT
Content-Type: image/png
Content-Length: 1567
Last-Modified: Fri, 29 May 2020 05:44:40 GMT
Connection: keep-alive
ETag: "5ed0a148-61f"
Expires: Sun, 25 Dec 2022 03:44:20 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1883c8cf353eaae13b3e223d0939f124
c3bece9e26b02c39938c191ebbae6a7d4f049929
985817c04fd9bebd18bfae17e578b1acdd53b1bf168b26fa4c45ff0439b7b7cf
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "985817C04FD9BEBD18BFAE17E578B1ACDD53B1BF168B26FA4C45FF0439B7B7CF"
Last-Modified: Thu, 24 Nov 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15275
Expires: Fri, 25 Nov 2022 07:58:55 GMT
Date: Fri, 25 Nov 2022 03:44:20 GMT
Connection: keep-alive
ocsp.sectigo.com/
200 OK 472 B IP
Hash df4206844db9ff5e5c136fe2aa98e78c
1aacdd5ecb6d57432b6315133840b26396976514
09b9e91c2676a28fbc6f2f44a59812199ec56975d67312eda90a4e70637b0825
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:21 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 24 Nov 2022 05:28:47 GMT
Expires: Thu, 01 Dec 2022 05:28:46 GMT
Etag: "1aacdd5ecb6d57432b6315133840b26396976514"
Cache-Control: max-age=524064,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762a36c25fac4-OSL
678tktp.com/tp/225x150.gif
200 OK 34 kB URL HTTP/1.1 678tktp.com/tp/225x150.gif
IP
File type GIF image data, version 89a, 225 x 150\012- data
Hash 5b530d2ce692cec14d0ab68165562124
55ed9805398542b7a7b5e15a854d833e9cd22835
ade66d8efe4fca1daaae6761dd39bb0e735309193fd7db8ceba789c36e7410e4
GET /tp/225x150.gif HTTP/1.1
Host: 678tktp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: openresty
Date: Fri, 25 Nov 2022 03:44:13 GMT
Content-Type: image/gif
Content-Length: 34379
Connection: keep-alive
Last-Modified: Sun, 20 Nov 2022 08:07:12 GMT
ETag: "6379e030-864b"
Expires: Fri, 23 Dec 2022 08:46:32 GMT
Cache-Control: max-age=2592000
Via: 154.83.27.42
CDN-Cache: HIT
Accept-Ranges: bytes
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash d17c82b488fcd3680d767b88ad81e6bd
16cc0b79edae1e4ce91a5766057b677fa05a3094
3053f3741ae7c6b904636d228bed44a7166d1825186dfeedd1df124e05cd378a
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:21 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Tue, 29 Nov 2022 02:42:52 GMT
ETag: "16cc0b79edae1e4ce91a5766057b677fa05a3094"
Last-Modified: Fri, 25 Nov 2022 02:42:53 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 474
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76f762a6f8821c0e-OSL
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 968f6d6cab47f52c258262945670f166
ca6680deab56f259b8c8e1e0c9700baeb728e79c
b43ca7df197e51d6e83d79008cb5967426ed6b74ae0bd30e5f8d3ea313a0462c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "B43CA7DF197E51D6E83D79008CB5967426ED6B74AE0BD30E5F8D3EA313A0462C"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14177
Expires: Fri, 25 Nov 2022 07:40:38 GMT
Date: Fri, 25 Nov 2022 03:44:21 GMT
Connection: keep-alive
aooacctp.vip/logotp/xfb63.gif
200 OK 801 kB URL HTTP/2 aooacctp.vip/logotp/xfb63.gif
IP
File type GIF image data, version 89a, 200 x 200\012- data
Size 801 kB (800906 bytes)
Hash b67d8e3b2e6a17ef65cca5924479bcaf
170f0e54f86d9fe303bca99f7524cee878289a3f
2b6a9b53114e36c800d36b460001279b5b27d86ad0b0f79d71bd5157d7d2ba8c
GET /logotp/xfb63.gif HTTP/1.1
Host: aooacctp.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:21 GMT
content-type: image/gif
content-length: 800906
last-modified: Sun, 14 Aug 2022 07:55:32 GMT
etag: "62f8aa74-c388a"
expires: Sun, 18 Dec 2022 16:07:02 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 519838
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0%2F81vKjR%2Boqn%2BDFXE9NzNvBr9T6bdIq5xFwdEMzI8eVcGghwhdEqvi0XJXI7o3%2BW0hOyBhw4MfqS%2BMNEysG5UCT5nxgkOwpl%2FUMNPystHEhiqijlNMTGGMnVzw4p9J4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762a74e6cb50c-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.gfngus-fd5fsfr.cc/ssiq/qq3.js
200 OK 1.1 kB URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/qq3.js
IP
ASN #134548 DXTL Tseung Kwan O Service
File type HTML document, Unicode text, UTF-8 text, with very long lines (388), with CRLF line terminators
Hash 2b881577e66d4a966c4756a02661daba
ffb2b4262e669034afbb93c44de7a0a8a1891706
28603c270a66b1b3b788faeb7202293fa10a86b49191006e2e23bcb61af42115
GET /ssiq/qq3.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
last-modified: Wed, 16 Nov 2022 11:06:08 GMT
vary: Accept-Encoding
etag: W/"6374c420-20ac"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
ak-d.tripcdn.com/images/0Z03x223496bn1tjl1F95.gif
200 OK 576 kB URL HTTP/2 ak-d.tripcdn.com/images/0Z03x223496bn1tjl1F95.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 576 kB (576269 bytes)
Hash d18a583c2d2ea700e268b1e2749139de
489359e1381aeb2806af0896d5a36b2fc932c125
09060e9dac6e8a5f191258114d32bce1865a47da1ddc0eb47a70e8aa8bfc0d59
GET /images/0Z03x223496bn1tjl1F95.gif HTTP/1.1
Host: ak-d.tripcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 576269
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
x-edgeconnect-midmile-rtt: 21
x-edgeconnect-origin-mex-latency: 59
cache-control: max-age=7019309
expires: Tue, 14 Feb 2023 09:32:50 GMT
date: Fri, 25 Nov 2022 03:44:21 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
ak-d.tripcdn.com/images/0Z0292215cyp9qgrk7748.gif
200 OK 1.4 MB URL HTTP/2 ak-d.tripcdn.com/images/0Z0292215cyp9qgrk7748.gif
IP
File type GIF image data, version 89a, 960 x 100\012- data
Size 1.4 MB (1448406 bytes)
Hash 005a9ab21c34732aead0e3343700e682
175e856610e8f086806124faac5ed66354f46682
9df8d48adea8f822668643b1f0d2b0f025f92e3cd7249b04061a654b7dbdb466
GET /images/0Z0292215cyp9qgrk7748.gif HTTP/1.1
Host: ak-d.tripcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/gif
content-length: 1448406
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=7290035
expires: Fri, 17 Feb 2023 12:44:56 GMT
date: Fri, 25 Nov 2022 03:44:21 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
ia.51.la/go1?id=21481107&rt=1669347860931&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=0&cd=24&ds=%25E5%25A6%2582%25E6%2582%25A8%25E6%259C%25AA%25E6%25BB%25BF%25E5%258D%2581%25E5%2585%25AB%25E6%25AD%25B2%25E6%2588%2596%25E7%2595%25B6%25E5%259C%25B0%25E6%25B3%2595%25E5%25BE%258B%25E8%25A8%25B1%25E5%258F%25AF%25E4%25B9%258B%25E5%25B9%25B4%25E9%25BD%25A1%25E3%2580%2581%25E4%25BA%25A6%25E6%2588%2596%25E8%2580%2585%25E6%2582%25A8%25E5%25B0%258D%25E6%259C%25AC%25E7%25AB%2599%25E5%2586%2585%25E5%25AE%25B9%25E5%258F%258D%25E6%2584%259F%25EF%25BC%258C&ing=1&ekc=&sid=1669347860931&tt=756AV%25E5%25BD%25B1%25E8%25A7%2586&kw=756AV%25E5%25BD%25B1%25E8%25A7%2586&cu=http%253A%252F%252F38.239.194.4%252F&pu=http%253A%252F%252F38.239.196.126%252F
200 0 B URL HTTP/1.1 ia.51.la/go1?id=21481107&rt=1669347860931&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=0&cd=24&ds=%25E5%25A6%2582%25E6%2582%25A8%25E6%259C%25AA%25E6%25BB%25BF%25E5%258D%2581%25E5%2585%25AB%25E6%25AD%25B2%25E6%2588%2596%25E7%2595%25B6%25E5%259C%25B0%25E6%25B3%2595%25E5%25BE%258B%25E8%25A8%25B1%25E5%258F%25AF%25E4%25B9%258B%25E5%25B9%25B4%25E9%25BD%25A1%25E3%2580%2581%25E4%25BA%25A6%25E6%2588%2596%25E8%2580%2585%25E6%2582%25A8%25E5%25B0%258D%25E6%259C%25AC%25E7%25AB%2599%25E5%2586%2585%25E5%25AE%25B9%25E5%258F%258D%25E6%2584%259F%25EF%25BC%258C&ing=1&ekc=&sid=1669347860931&tt=756AV%25E5%25BD%25B1%25E8%25A7%2586&kw=756AV%25E5%25BD%25B1%25E8%25A7%2586&cu=http%253A%252F%252F38.239.194.4%252F&pu=http%253A%252F%252F38.239.196.126%252F
IP
ASN #4837 CHINA UNICOM China169 Backbone
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go1?id=21481107&rt=1669347860931&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=0&cd=24&ds=%25E5%25A6%2582%25E6%2582%25A8%25E6%259C%25AA%25E6%25BB%25BF%25E5%258D%2581%25E5%2585%25AB%25E6%25AD%25B2%25E6%2588%2596%25E7%2595%25B6%25E5%259C%25B0%25E6%25B3%2595%25E5%25BE%258B%25E8%25A8%25B1%25E5%258F%25AF%25E4%25B9%258B%25E5%25B9%25B4%25E9%25BD%25A1%25E3%2580%2581%25E4%25BA%25A6%25E6%2588%2596%25E8%2580%2585%25E6%2582%25A8%25E5%25B0%258D%25E6%259C%25AC%25E7%25AB%2599%25E5%2586%2585%25E5%25AE%25B9%25E5%258F%258D%25E6%2584%259F%25EF%25BC%258C&ing=1&ekc=&sid=1669347860931&tt=756AV%25E5%25BD%25B1%25E8%25A7%2586&kw=756AV%25E5%25BD%25B1%25E8%25A7%2586&cu=http%253A%252F%252F38.239.194.4%252F&pu=http%253A%252F%252F38.239.196.126%252F HTTP/1.1
Host: ia.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200
Server: CloudWAF
Date: Fri, 25 Nov 2022 03:44:21 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=f50861995c119b89b68; path=/
HWWAFSESTIME=1669347861116; path=/
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash 57c2339af4be62cf0bdc905ff8a88627
28a9a0433a6b99262339ec2de626985574a0d14e
217979335ae6af1d9f9af167d075a809cfd39749a1e14d561c9ebdaa156b773c
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:21 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Tue, 29 Nov 2022 01:08:20 GMT
ETag: "28a9a0433a6b99262339ec2de626985574a0d14e"
Last-Modified: Fri, 25 Nov 2022 01:08:21 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76f762a62808b509-OSL
nkiun.xyz/guanggao/5678.jpg
200 OK 16 kB URL HTTP/1.1 nkiun.xyz/guanggao/5678.jpg
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 352x198, components 3\012- data
Hash 61cdbfab0213705019d0f0359a69334c
687637f6ef3219935e2c7a1f2ec30d52383bd789
3011f4fab001f3af1c122c6e03b73e2dd60da42ee7e1f692dc917cd254e65045
GET /guanggao/5678.jpg HTTP/1.1
Host: nkiun.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://38.239.194.4/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Nov 2022 03:44:21 GMT
Content-Type: image/jpeg
Content-Length: 15532
Last-Modified: Tue, 20 Sep 2022 14:00:47 GMT
Connection: keep-alive
ETag: "6329c78f-3cac"
Expires: Sun, 25 Dec 2022 03:44:21 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.gfngus-fd5fsfr.cc/ssiq/qq2.js
200 OK 19 kB URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/qq2.js
IP
ASN #134548 DXTL Tseung Kwan O Service
Hash cd422041bbcce1db7d466130b0164f81
1ca8ffb277119b430e9abad8b6bd2d77d9b51d2e
894d1c1f3ba0b7313fcc08d7c4a7466081b245afbeb82be33a93dac7e0e143f0
GET /ssiq/qq2.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
last-modified: Fri, 18 Nov 2022 13:51:13 GMT
vary: Accept-Encoding
etag: W/"63778dd1-273b"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 968f6d6cab47f52c258262945670f166
ca6680deab56f259b8c8e1e0c9700baeb728e79c
b43ca7df197e51d6e83d79008cb5967426ed6b74ae0bd30e5f8d3ea313a0462c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "B43CA7DF197E51D6E83D79008CB5967426ED6B74AE0BD30E5F8D3EA313A0462C"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14177
Expires: Fri, 25 Nov 2022 07:40:38 GMT
Date: Fri, 25 Nov 2022 03:44:21 GMT
Connection: keep-alive
www.gfngus-fd5fsfr.cc/ssiq/dht.js
404 Not Found 146 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/dht.js
IP
ASN #134548 DXTL Tseung Kwan O Service
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
GET /ssiq/dht.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Fri, 25 Nov 2022 03:44:21 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash 57c2339af4be62cf0bdc905ff8a88627
28a9a0433a6b99262339ec2de626985574a0d14e
217979335ae6af1d9f9af167d075a809cfd39749a1e14d561c9ebdaa156b773c
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:21 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Tue, 29 Nov 2022 01:08:20 GMT
ETag: "28a9a0433a6b99262339ec2de626985574a0d14e"
Last-Modified: Fri, 25 Nov 2022 01:08:21 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 0
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76f762a948f91c0e-OSL
678tktp.com/tp/960x60.gif
200 OK 42 kB URL HTTP/1.1 678tktp.com/tp/960x60.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Hash 4fd9de737ce6698fb5c3a0eb52ed3cdf
da1fc841a82ddbfcee0dde9dd50b34acad24ce50
03cae438deedf1f1eb905ac79daef3fa63b8a45c51c9fbbe8164e7df0ac4a58c
GET /tp/960x60.gif HTTP/1.1
Host: 678tktp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: openresty
Date: Fri, 25 Nov 2022 03:44:14 GMT
Content-Type: image/gif
Content-Length: 41618
Connection: keep-alive
Last-Modified: Mon, 07 Nov 2022 04:31:47 GMT
ETag: "63688a33-a292"
Expires: Fri, 23 Dec 2022 08:46:32 GMT
Cache-Control: max-age=2592000
Via: 154.83.27.42
CDN-Cache: HIT
Accept-Ranges: bytes
ocsp.digicert.com/
200 OK 279 B IP
Hash 2aee78ed2e3d7de1b2a7a2b23d097360
782463d3db74bbe0439feaf7c1fe18aa6f20aef7
72337b48ac80604e2338c6889fc2ffd9560062931e228fe1abc422e3312d9be9
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=125896
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:22 GMT
Etag: "637f82de-117"
Expires: Sat, 26 Nov 2022 14:42:38 GMT
Last-Modified: Thu, 24 Nov 2022 14:42:38 GMT
Server: nginx
Content-Length: 279
nvhbbb.top/f0e76a5c8312a00241ad726bac0f2d0f.gif
200 OK 159 kB URL HTTP/2 nvhbbb.top/f0e76a5c8312a00241ad726bac0f2d0f.gif
IP
File type GIF image data, version 89a, 960 x 80\012- data
Size 159 kB (158847 bytes)
Hash a497c1ae73df54fe08463b3342b8d1d0
73ce4da38e2826e033444992cff2a827eb474c97
e9f7f7dc820dc334c1cf0e7ccb151c7483c7a64cc7c28f50de03fa2f65c34957
GET /f0e76a5c8312a00241ad726bac0f2d0f.gif HTTP/1.1
Host: nvhbbb.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:22 GMT
content-type: image/gif
content-length: 158847
last-modified: Wed, 10 Aug 2022 09:44:15 GMT
etag: "62f37def-26c7f"
expires: Fri, 23 Dec 2022 11:35:04 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 144558
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cae7yGIcGNYDIQD8q4P7jvfAhiT%2FdjGK7Nms2aK636EUl%2FQ638AEZY%2BceKoqKwUlvgUDyKkioT2mFzVehnDoS4VEjqRkLKaFzyOesvvCPaPqZH33b8DVYX5%2BVBY9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762ab2d3b0b51-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash 2aee78ed2e3d7de1b2a7a2b23d097360
782463d3db74bbe0439feaf7c1fe18aa6f20aef7
72337b48ac80604e2338c6889fc2ffd9560062931e228fe1abc422e3312d9be9
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1
Cache-Control: max-age=125896
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:22 GMT
Etag: "637f82de-117"
Expires: Sat, 26 Nov 2022 14:42:38 GMT
Last-Modified: Thu, 24 Nov 2022 14:42:38 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 279
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b5d96f0e4cf5e6d53af1c983b4d3a30f
27a6f8554923a400ff95870b2c7636fc6dd4ecc8
645c117d27b04eb5b7b40e8f37d146b2e461542f0e625b937b6a8d697c4e5440
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "645C117D27B04EB5B7B40E8F37D146B2E461542F0E625B937B6A8D697C4E5440"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16083
Expires: Fri, 25 Nov 2022 08:12:25 GMT
Date: Fri, 25 Nov 2022 03:44:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 4e0bf2eba20ecd37a22c849e08a8d2c6
87279bcf79e894aa1f5d3167f896958308a290d1
2f0c6e68762615c3d208453349458006655a7f2bc7983c2f776e6119db6f812d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2F0C6E68762615C3D208453349458006655A7F2BC7983C2F776E6119DB6F812D"
Last-Modified: Wed, 23 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1570
Expires: Fri, 25 Nov 2022 04:10:32 GMT
Date: Fri, 25 Nov 2022 03:44:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f1031dcd5959571008400be96c44bb14
3ef227bc7dfcd797124e34c9a96db7ba1ea57e9d
c3e5581ef9b10564243d1167ae0ec9c52e1efae77878e294f332903ed8c7f1d7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C3E5581EF9B10564243D1167AE0EC9C52E1EFAE77878E294F332903ED8C7F1D7"
Last-Modified: Wed, 23 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4806
Expires: Fri, 25 Nov 2022 05:04:28 GMT
Date: Fri, 25 Nov 2022 03:44:22 GMT
Connection: keep-alive
kvkaa.com/d816a0142aeb37814a5d77cfd510e67b.gif
301 Moved Permanently 162 B URL HTTP/2 kvkaa.com/d816a0142aeb37814a5d77cfd510e67b.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /d816a0142aeb37814a5d77cfd510e67b.gif HTTP/1.1
Host: kvkaa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Fri, 25 Nov 2022 03:44:22 GMT
content-type: text/html
content-length: 162
location: https://kvtaaa.top/d816a0142aeb37814a5d77cfd510e67b.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvemm.com/ec9fcd758df74f805f29f72e8545d13b.gif
301 Moved Permanently 162 B URL HTTP/2 kvemm.com/ec9fcd758df74f805f29f72e8545d13b.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /ec9fcd758df74f805f29f72e8545d13b.gif HTTP/1.1
Host: kvemm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Fri, 25 Nov 2022 03:44:22 GMT
content-type: text/html
content-length: 162
location: https://kvkddd.top/ec9fcd758df74f805f29f72e8545d13b.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
dimg04.c-ctrip.com/images/0Z06r12000a1q59pc5E63.gif
200 OK 494 kB URL HTTP/2 dimg04.c-ctrip.com/images/0Z06r12000a1q59pc5E63.gif
IP
File type GIF image data, version 89a, 960 x 100\012- data
Size 494 kB (494073 bytes)
Hash a4b5924a4f837fc68184b2c9734497ba
8cf1875d4dd8385719ce447cf8a769b746601e39
311758228e255024dc721b038305a62d40349b817ac26f272cf6e9fa044bf39b
GET /images/0Z06r12000a1q59pc5E63.gif HTTP/1.1
Host: dimg04.c-ctrip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 494073
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=11176807
expires: Mon, 03 Apr 2023 12:24:29 GMT
date: Fri, 25 Nov 2022 03:44:22 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
dimg04.c-ctrip.com/images/03913120009rs7n3a8C45.gif
200 OK 1.2 MB URL HTTP/2 dimg04.c-ctrip.com/images/03913120009rs7n3a8C45.gif
IP
File type GIF image data, version 89a, 960 x 80\012- data
Size 1.2 MB (1186991 bytes)
Hash b7ff6b584c23b3c247d43c4dd73a9063
7430c81b9edcef194c4165a31f1293b489f9c53e
7bec7d626dc2ca81a95ebae691c949068aaa3bb3060662887f613882b3b3afc5
GET /images/03913120009rs7n3a8C45.gif HTTP/1.1
Host: dimg04.c-ctrip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 1186991
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=10561590
expires: Mon, 27 Mar 2023 09:30:52 GMT
date: Fri, 25 Nov 2022 03:44:22 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash da71cb9245282574079d7ad854ebf4e1
8455fdf748d6824d5c54da005fbd8288e00392af
3d8992f613119538bbb18628168e08fa95947acd855cb6c66d3dc5dde2e0efc6
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 24 Nov 2022 08:23:24 GMT
Expires: Thu, 01 Dec 2022 08:23:23 GMT
Etag: "8455fdf748d6824d5c54da005fbd8288e00392af"
Cache-Control: max-age=534540,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762ad7da7fac4-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 63add92414da3c7a6c6c80da09a52b3b
02f05fd6c6d0435d02119cc6040ef8b583697f09
6b669228c50af0eb33dd89682464071c62c509ccc83f604346de463841ce9424
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6B669228C50AF0EB33DD89682464071C62C509CCC83F604346DE463841CE9424"
Last-Modified: Thu, 24 Nov 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3222
Expires: Fri, 25 Nov 2022 04:38:04 GMT
Date: Fri, 25 Nov 2022 03:44:22 GMT
Connection: keep-alive
zerossl.ocsp.sectigo.com/
200 OK 727 B URL HTTP/1.1 zerossl.ocsp.sectigo.com/
IP
Hash 67eed27f698bd136fe6cfe806d51cdfa
80669e908acf14c79dad289ace7c49c29079a450
23b3843113628f6553ea4114a18c7b9d1ca58057f3d1693558f48d3fc777d624
POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: application/ocsp-response
Content-Length: 727
Connection: keep-alive
Last-Modified: Mon, 21 Nov 2022 19:09:55 GMT
Expires: Mon, 28 Nov 2022 19:09:54 GMT
Etag: "80669e908acf14c79dad289ace7c49c29079a450"
Cache-Control: max-age=314131,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762ae2ccd0b06-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash da71cb9245282574079d7ad854ebf4e1
8455fdf748d6824d5c54da005fbd8288e00392af
3d8992f613119538bbb18628168e08fa95947acd855cb6c66d3dc5dde2e0efc6
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 24 Nov 2022 08:23:24 GMT
Expires: Thu, 01 Dec 2022 08:23:23 GMT
Etag: "8455fdf748d6824d5c54da005fbd8288e00392af"
Cache-Control: max-age=534540,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762ad7800b50b-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash da71cb9245282574079d7ad854ebf4e1
8455fdf748d6824d5c54da005fbd8288e00392af
3d8992f613119538bbb18628168e08fa95947acd855cb6c66d3dc5dde2e0efc6
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 24 Nov 2022 08:23:24 GMT
Expires: Thu, 01 Dec 2022 08:23:23 GMT
Etag: "8455fdf748d6824d5c54da005fbd8288e00392af"
Cache-Control: max-age=534540,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762ad9893b503-OSL
ocsp.digicert.com/
200 OK 279 B IP
Hash ca07d4a6cb15ddf3471e3ad3a0df9f3a
ee444dbba986b80e30b116d57ee1544cb184949f
8c49abbe066ef732bacf572daf7714b0af7c3a1d83954d6ad022512416164d96
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=159726
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:22 GMT
Etag: "63800704-117"
Expires: Sun, 27 Nov 2022 00:06:28 GMT
Last-Modified: Fri, 25 Nov 2022 00:06:28 GMT
Server: nginx
Content-Length: 279
kvtaaa.top/d816a0142aeb37814a5d77cfd510e67b.gif
200 OK 186 kB URL HTTP/2 kvtaaa.top/d816a0142aeb37814a5d77cfd510e67b.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 186 kB (185463 bytes)
Hash 07d436db9009e187330d91ffc5c77745
a7944de8f44192fe6bee6e6584d03966d0ffe8b8
75e2ad510799f05ddf20510e09f538233254217314fc7b301370407112eab0e2
GET /d816a0142aeb37814a5d77cfd510e67b.gif HTTP/1.1
Host: kvtaaa.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://38.239.194.4/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:22 GMT
content-type: image/gif
content-length: 185463
last-modified: Mon, 13 Jun 2022 10:10:31 GMT
etag: "62a70d17-2d477"
expires: Sun, 11 Dec 2022 15:25:39 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1167523
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BbyM0TaIlRqNZAVCiNhg%2BgB%2B%2Fk2w6ry2yLNeKqEcimN2quE4RrkJM2MqQ%2FsfMNVgug%2BaIwKeFP0H%2Bxg2tDjSxckD0FRqfbgI5v%2BW2nzIoVi2j1JlHzyGvhfeQ4t7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762af3b3fb505-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash ca07d4a6cb15ddf3471e3ad3a0df9f3a
ee444dbba986b80e30b116d57ee1544cb184949f
8c49abbe066ef732bacf572daf7714b0af7c3a1d83954d6ad022512416164d96
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=159726
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:22 GMT
Etag: "63800704-117"
Expires: Sun, 27 Nov 2022 00:06:28 GMT
Last-Modified: Fri, 25 Nov 2022 00:06:28 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash 0714b9a676d09dd2021e666ab096724f
33f83694159bc845de9f14236e3ecb93518389bd
2ea0b3fa8b3bda181f3b50777e3e451f34337598fbe7a8121b4d8a07733b085a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=91004
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:22 GMT
Etag: "637efa92-117"
Expires: Sat, 26 Nov 2022 05:01:06 GMT
Last-Modified: Thu, 24 Nov 2022 05:01:06 GMT
Server: nginx
Content-Length: 279
kvkddd.top/ec9fcd758df74f805f29f72e8545d13b.gif
200 OK 902 kB URL HTTP/2 kvkddd.top/ec9fcd758df74f805f29f72e8545d13b.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 902 kB (902313 bytes)
Hash 8b4a95ea7cfbb7fb4d2b18efca5145f3
d2966ecbeb7369620cce5dbcd15d0fe591d79648
dd5ff25f4d6931bd3d2ef86c1a8901853ee2503fd2d6edb264a61abb37c2b002
GET /ec9fcd758df74f805f29f72e8545d13b.gif HTTP/1.1
Host: kvkddd.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://38.239.194.4/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 25 Nov 2022 03:44:22 GMT
content-type: image/gif
content-length: 902313
last-modified: Sat, 12 Mar 2022 15:17:28 GMT
etag: "622cb988-dc4a9"
expires: Fri, 23 Dec 2022 04:34:15 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 169807
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VPuQlPhcxdvL2VnTzKzC47KDpdUhO5Ri6xY1V8G6XyFca%2FOEE8zeKM4ieiN96uor4dpNNd3qdtMw6N0Hykx%2BXop01eY1aDizj2Gpuw1lsDpwWkYkFgL0CnQvvxn3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f762af9913dc7f-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash 26cdc4d5c4b3f817596514e92d820a95
fabf794fd1f13daf7f162a6ad3932f09827ef1ff
893530c74b173b7b748a5d9b7d46a765a1f9209b1296d04a6138021ce999ac0e
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Mon, 21 Nov 2022 21:52:05 GMT
Expires: Mon, 28 Nov 2022 21:52:04 GMT
Etag: "fabf794fd1f13daf7f162a6ad3932f09827ef1ff"
Cache-Control: max-age=323860,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762b03e3dfac4-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash 345d5c98dc03b290c7bda10d8b448b20
bb604f288579d31c276519450c0036f131c96683
6a289474c710c34f4d6ecbcd96637671906b4c58c8505a8ec0e5c6b80603552f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Tue, 22 Nov 2022 00:14:21 GMT
Expires: Tue, 29 Nov 2022 00:14:20 GMT
Etag: "bb604f288579d31c276519450c0036f131c96683"
Cache-Control: max-age=332396,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762b0796cb503-OSL
ocsp.sectigo.com/
200 OK 472 B IP
Hash 59b02c1c948cef8ac39cb280b2422d4d
31b11d0550d45edc800a0f7e17838abbbb1498c8
66d52879030be45f297ae1d7fd40cee0700712dc87456efd19a6886506aa064f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Tue, 22 Nov 2022 23:21:49 GMT
Expires: Tue, 29 Nov 2022 23:21:48 GMT
Etag: "31b11d0550d45edc800a0f7e17838abbbb1498c8"
Cache-Control: max-age=415644,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762b08ad2b506-OSL
ocsp.digicert.com/
200 OK 727 B IP
Hash 3c802933cbcc9e541e2f677ea7d32465
189b12dcbf7a957d0808bed1b7738abe5fdcf31a
b48a53359186928285167549c54fbcf2033d0971441aa57de3f59561626dae95
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3345
Cache-Control: max-age=155185
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:23 GMT
Etag: "637fe837-2d7"
Expires: Sat, 26 Nov 2022 22:50:48 GMT
Last-Modified: Thu, 24 Nov 2022 21:55:03 GMT
Server: ECS (amb/6BC1)
X-Cache: HIT
Content-Length: 727
p3.douyinpic.com/obj/tos-cn-i-dy/4cc6e027ff07440b86b4c8f810e13446
200 OK 420 kB URL HTTP/2 p3.douyinpic.com/obj/tos-cn-i-dy/4cc6e027ff07440b86b4c8f810e13446
IP
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type GIF image data, version 89a, 960 x 60\012- data
Size 420 kB (420442 bytes)
Hash 7020ecb5ebdf5d2d41668f76d36f5982
30c768ceb1463fffc0145f1e73c808f8f6d2bb51
3a55db6e5e4fa541729efffaa932549e491e07af768e1c3c3d1dad65ae53a8bb
GET /obj/tos-cn-i-dy/4cc6e027ff07440b86b4c8f810e13446 HTTP/1.1
Host: p3.douyinpic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: image/gif
content-length: 420442
date: Thu, 17 Nov 2022 10:44:41 GMT
cache-control: max-age=31536000
imagex-fmt: gif2gif
last-modified: Thu, 17 Nov 2022 10:43:05 GMT
nw-session-id: 2022111718430501020909506614B08F3Clqbnq02dy
nw-session-trace: 2022-11-17T18:43:05.564818541+08:00 195
x-bdcdn-cache-status: TCP_HIT
x-length: 420442
x-powered-by: ImageX
x-response-date: Thu, 17 Nov 2022 18:43:05 GMT
x-tt-logid: 2022111718430501020909506614B08F3C
via: n150-057-105, cache26.l2de2[0,23,206-0,H], cache3.l2de2[26,0], cache3.l2de2[27,0], cache2.se1[0,0,200-0,H], cache2.se1[2,0]
x-request-ip: fdbd:dc02:19:485::47
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
x-response-cinfo: 91.90.42.154
x-response-cache: edge_hit
server-timing: cdn-cache;desc=HIT,edge;dur=2
x-tt-trace-host: 01cd9ebcbab541bdda5cbcefeefd3a5fb040e592f966e0cfcd4470f84a8f17ff26b6d3a886b1ab9aafa65f58774e3d1c8250dafd765d519ebb500b706905601594e0f53416cca5e0cdc27c37dfbec470a4088b978fac19a2f476c3ee53560955b6
x-response-lb: image
ali-swift-global-savetime: 1668681881
age: 665982
x-cache: HIT TCP_MEM_HIT dirn:6:91436273
x-swift-savetime: Thu, 17 Nov 2022 10:56:06 GMT
x-swift-cachetime: 31535315
timing-allow-origin: *, *
access-control-allow-origin: *
eagleid: 2ff62c9616693478632323700e
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 155a3e2a2a788f4ff7a5f6f731f46073
4d023dfeca1f8c7a2d21366f1e0812bd9f8eaafa
2456703a9ea0b31ab7c7eb790f2097441981aa148046457d675b790df18418fa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2456703A9EA0B31AB7C7EB790F2097441981AA148046457D675B790DF18418FA"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6926
Expires: Fri, 25 Nov 2022 05:39:49 GMT
Date: Fri, 25 Nov 2022 03:44:23 GMT
Connection: keep-alive
ocsp.sectigo.com/
200 OK 471 B IP
Hash 77b1ac6fcb8a2f322305213b2d8ad256
09688400cad5bd7613942ff730a405e70c4efdbe
d490db1b76558b75898370ce1ba6d8883b495c0d95cad29246a01e8b5d7f236b
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 24 Nov 2022 05:12:51 GMT
Expires: Thu, 01 Dec 2022 05:12:50 GMT
Etag: "09688400cad5bd7613942ff730a405e70c4efdbe"
Cache-Control: max-age=523106,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76f762b078e8b50b-OSL
ocsp.digicert.com/
200 OK 279 B IP
Hash 0714b9a676d09dd2021e666ab096724f
33f83694159bc845de9f14236e3ecb93518389bd
2ea0b3fa8b3bda181f3b50777e3e451f34337598fbe7a8121b4d8a07733b085a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=91003
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 03:44:23 GMT
Etag: "637efa92-117"
Expires: Sat, 26 Nov 2022 05:01:06 GMT
Last-Modified: Thu, 24 Nov 2022 05:01:06 GMT
Server: nginx
Content-Length: 279
d.wyqaafplm.live/ty/FAA6AAAC-4775-18522-33-6E8DF2D94015.alpha
200 OK 86 kB URL HTTP/2 d.wyqaafplm.live/ty/FAA6AAAC-4775-18522-33-6E8DF2D94015.alpha
IP
Hash 75bc3bdb03b42b39a361fe11e7e8424a
6ab43506a92fa28cf81e2b943833266499017c05
9b80dfdeabbdb45511efdfa71f9a5a5e4952816c6058059b8b8943fd2a1ee0f4
Analyzer Verdict Alert quad9 Sinkholed
GET /ty/FAA6AAAC-4775-18522-33-6E8DF2D94015.alpha HTTP/1.1
Host: d.wyqaafplm.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:21 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
last-modified: Fri, 25 Nov 2022 03:44:21 GMT
expires: Fri, 25 Nov 2022 03:59:21 GMT
cache-control: max-age=900
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
398375178.com/fa3e0ddb2ff640acbd0ad3863036c189.gif
200 OK 31 kB URL HTTP/1.1 398375178.com/fa3e0ddb2ff640acbd0ad3863036c189.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 180 x 180\012- data
Hash df8680f8a205a27ffa3a908100aae066
f1089fd39ae9c1dc935392fcf8a24f69e7e2084b
6afaf2d4840f8151e6b21f67272185a25ad2fe99b4e01cc98822a62aee6c1b6e
GET /fa3e0ddb2ff640acbd0ad3863036c189.gif HTTP/1.1
Host: 398375178.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: image/gif
Content-Length: 30842
Connection: keep-alive
x-oss-request-id: 63803A178A23F738332008D0
Accept-Ranges: bytes
ETag: "DF8680F8A205A27FFA3A908100AAE066"
Last-Modified: Thu, 10 Nov 2022 09:23:18 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 12168794102283187344
x-oss-storage-class: Standard
Content-MD5: 34aA+KIFon/6OpCBAKrgZg==
x-oss-server-time: 2
gg72a1.com/gg/960x60-2.gif
200 OK 567 kB URL HTTP/2 gg72a1.com/gg/960x60-2.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 567 kB (566629 bytes)
Hash c9fa1542af8b7e568dc7b3a56522b833
1449fff789834cb44c300d12d770eeb251a4bbd5
7db19a9e96ed52f61b3b4c76bf6cac9259ae0b3e9d18eb597320c30a0e4e1e90
GET /gg/960x60-2.gif HTTP/1.1
Host: gg72a1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:46:40 GMT
content-type: image/gif
content-length: 566629
last-modified: Tue, 01 Nov 2022 07:49:47 GMT
etag: "6360cf9b-8a565"
expires: Sun, 25 Dec 2022 03:46:40 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894256451036.gif
200 OK 259 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894256451036.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 259 kB (258804 bytes)
Hash 70649fd49138ca6897fe0c9365470117
f0cbcec39497ab084adb72c03a6225c2144c6866
48f51d425b1ad9363336bc2edf9009cbfd17d0c24f817fe60fec9e6ed258e5b0
GET /static/uploads/image/x22/20221004/1664894256451036.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 14:40:37 GMT
ETag: "1667486439"
Expires: Sat, 03 Dec 2022 14:40:37 GMT
Last-Modified: Thu, 03 Nov 2022 14:40:39 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894322248517.gif
200 OK 258 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894322248517.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 258 kB (257993 bytes)
Hash 038ba2e11d90524678f7762f4628513f
a41054637ff263d13570f7eec83a3286957edc80
51d5f69d306345589b0c376bcff99c50c48bda07e3d61a5d3c1a96181acefa71
GET /static/uploads/image/x22/20221004/1664894322248517.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 16:53:19 GMT
ETag: "1667494399"
Expires: Sat, 03 Dec 2022 16:53:19 GMT
Last-Modified: Thu, 03 Nov 2022 16:53:19 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
sysupload.csiteadmin.com/static/uploads/image/x26/20221004/1664894189710457.gif
200 OK 261 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x26/20221004/1664894189710457.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 261 kB (261015 bytes)
Hash 68ca80e6c19384277e66f07f304b6ed7
680dea475bf73401cd981b5d64f81a23c5536fed
cdbf4e9a6e9fd6b14415c2039f70aef83ec4067c4d82510246096432cd8b93a8
GET /static/uploads/image/x26/20221004/1664894189710457.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 14:36:31 GMT
ETag: "1667486191"
Expires: Sat, 03 Dec 2022 14:36:31 GMT
Last-Modified: Thu, 03 Nov 2022 14:36:31 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894380503898.gif
200 OK 245 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894380503898.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 245 kB (245365 bytes)
Hash 15b01b59267acae7726f30675e79d8bf
7449390411869cdc7b1b4ae6bee7e4fb7e893675
3c17fb36844b4fc9ead50ffc421dba8367ff08b4e307195f72323a2d9edec46d
GET /static/uploads/image/x22/20221004/1664894380503898.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 16:53:19 GMT
ETag: "1667494399"
Expires: Sat, 03 Dec 2022 16:53:19 GMT
Last-Modified: Thu, 03 Nov 2022 16:53:19 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894518194257.gif
200 OK 279 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894518194257.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 279 kB (278909 bytes)
Hash cbbb3d8ff70b59b11fd1182f7e5d77e9
06af5df2b2aeaa07b578979ee331b52e1f298323
f62a633b62c1dea5bca396206d4956bf14db30141e6e524bf3a00e3588c1c893
GET /static/uploads/image/x22/20221004/1664894518194257.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 14:42:08 GMT
ETag: "1667486534"
Expires: Sat, 03 Dec 2022 14:42:08 GMT
Last-Modified: Thu, 03 Nov 2022 14:42:14 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894599409102.gif
200 OK 252 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894599409102.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 252 kB (251962 bytes)
Hash feb5419ef22c0a10470f6cfe2b0f1517
412e6b8e6f4244071851549b9d5ba5fdf9a5b631
d889e702650ec0543cef9a6d281f576366872f31463f3b707498aac5cef2ae07
GET /static/uploads/image/x22/20221004/1664894599409102.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 14:43:27 GMT
ETag: "1667486607"
Expires: Sat, 03 Dec 2022 14:43:27 GMT
Last-Modified: Thu, 03 Nov 2022 14:43:27 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
986338dsd.com/33c3cc8978d241dc99eb1c2fed141d7d.gif
200 OK 359 kB URL HTTP/1.1 986338dsd.com/33c3cc8978d241dc99eb1c2fed141d7d.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 60\012- data
Size 359 kB (358672 bytes)
Hash 668143938c3bb811847d83330decd423
f86300da5d773b84bc65d3c901a4767fd8566c48
a06c47f458fdbd01ba8ba0202fb615e94e2353d65098b480ede52a13a645f859
Analyzer Verdict Alert quad9 Sinkholed
GET /33c3cc8978d241dc99eb1c2fed141d7d.gif HTTP/1.1
Host: 986338dsd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "636cc2ea-57910"
Date: Wed, 23 Nov 2022 14:25:27 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Thu, 10 Nov 2022 09:22:50 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-07
Content-Length: 358672
sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894417817771.gif
200 OK 212 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x22/20221004/1664894417817771.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 212 kB (212163 bytes)
Hash 14c76e87c5da9f7226cf412026035c9d
a6cbebd6fd70a1975c7900dbacea379c7722bf94
b1cd2e21b685362b7688cc2444535ff135de009483da19cb9b5de4a0624eb9a4
GET /static/uploads/image/x22/20221004/1664894417817771.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 16:53:19 GMT
ETag: "1667494399"
Expires: Sat, 03 Dec 2022 16:53:19 GMT
Last-Modified: Thu, 03 Nov 2022 16:53:19 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/4a/fba97a5491e68fcca4cdee4b87d629.gif?attname=0103d120009h1026r1BFC.gif
200 OK 873 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/4a/fba97a5491e68fcca4cdee4b87d629.gif?attname=0103d120009h1026r1BFC.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 200 x 200\012- data
Size 873 kB (873044 bytes)
Hash 4afba97a5491e68fcca4cdee4b87d629
09e1dddabf60e12cbd368c2df9d6474f703d7a2f
23861d601f540f738c33eebd6821fef3a74e1f6d5540d939d8a07c08f40bcd19
GET /4a/fba97a5491e68fcca4cdee4b87d629.gif?attname=0103d120009h1026r1BFC.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: image/gif
Content-Length: 873044
Connection: keep-alive
x-oss-request-id: 63803A16DA8A7932358F26AF
Accept-Ranges: bytes
ETag: "4AFBA97A5491E68FCCA4CDEE4B87D629"
Last-Modified: Mon, 18 Jul 2022 12:32:30 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 7891666003124264077
x-oss-storage-class: Standard
Content-Disposition: inline;filename=0103d120009h1026r1BFC.gif
Content-MD5: SvupelSR5o/MpM3uS4fWKQ==
x-oss-server-time: 2
sysupload.csiteadmin.com/static/uploads/image/x26/20221004/1664894243920576.gif
200 OK 133 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x26/20221004/1664894243920576.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 133 kB (133073 bytes)
Hash f44f18314d520e89498d1f67557c2697
bbdd1041f6be7316f0a565d525761a902959b6e6
303b74f93a5d4a4d3232e66f67e7e0f3f7a034495afdb766585e1aef792bded8
GET /static/uploads/image/x26/20221004/1664894243920576.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 14:37:28 GMT
ETag: "1667486248"
Expires: Sat, 03 Dec 2022 14:37:28 GMT
Last-Modified: Thu, 03 Nov 2022 14:37:28 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/7d/aa17e173a4c65df1ec1b23879a2d31.gif?attname=571.gif
200 OK 463 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/7d/aa17e173a4c65df1ec1b23879a2d31.gif?attname=571.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 304 x 304\012- data
Size 463 kB (463098 bytes)
Hash 7daa17e173a4c65df1ec1b23879a2d31
57565f705f9bd44e3cdb9d34c521afa795c54bfa
0a97201d67942d5d2c0fb696207560e3e04597593c2ca9e9ccc655aeabf69083
GET /7d/aa17e173a4c65df1ec1b23879a2d31.gif?attname=571.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: image/gif
Content-Length: 463098
Connection: keep-alive
x-oss-request-id: 63803A167E084E353723A2E9
Accept-Ranges: bytes
ETag: "7DAA17E173A4C65DF1EC1B23879A2D31"
Last-Modified: Fri, 13 May 2022 15:18:43 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 235009922681292474
x-oss-storage-class: Standard
Content-Disposition: inline;filename=571.gif
Content-MD5: faoX4XOkxl3x7Bsjh5otMQ==
x-oss-server-time: 2
sysupload.csiteadmin.com/static/uploads/image/x26/20221004/1664894286620122.gif
200 OK 132 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x26/20221004/1664894286620122.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 132 kB (131724 bytes)
Hash 6815a174b1da262bb85e17910991d3ed
cbf03ab57a46f9301dac7cd0f7cf99c777b686c7
d0089533769022907251b9dd2fbd0c51fbd14b1326dda3cc2d990c1931fabc01
GET /static/uploads/image/x26/20221004/1664894286620122.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Thu, 03 Nov 2022 14:38:11 GMT
ETag: "1667486291"
Expires: Sat, 03 Dec 2022 14:38:11 GMT
Last-Modified: Thu, 03 Nov 2022 14:38:11 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
sysupload.csiteadmin.com/static/uploads/image/x51/20221111/1668166428315380.gif
200 OK 212 kB URL HTTP/1.1 sysupload.csiteadmin.com/static/uploads/image/x51/20221111/1668166428315380.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 960 x 60\012- data
Size 212 kB (211695 bytes)
Hash 0b39ec7c3e074e11a5629819f3aa4700
df59dbbb9d99b72d01f518d9c8484cd188440f0f
f89a04cd56e853388cad8b34084879771c6f49885033bb0a5c51402e60d468c8
GET /static/uploads/image/x51/20221111/1668166428315380.gif HTTP/1.1
Host: sysupload.csiteadmin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: image/gif
Date: Fri, 11 Nov 2022 11:38:16 GMT
ETag: "1668166696"
Expires: Sun, 11 Dec 2022 11:38:16 GMT
Last-Modified: Fri, 11 Nov 2022 11:38:16 GMT
Server: nginx
Vary: Accept-Encoding
X-Cache: HIT, server, disk
Transfer-Encoding: chunked
638236rpn.com/da4fca5f2b554096b6d3d4c2c2ea7828.gif
200 OK 581 kB URL HTTP/1.1 638236rpn.com/da4fca5f2b554096b6d3d4c2c2ea7828.gif
IP
File type GIF image data, version 89a, 750 x 100\012- data
Size 581 kB (581233 bytes)
Hash b5d963f9872462dec11edaafecf3f31b
a5e2d29783771cd8cb1b8cc4881733813147ceda
934310664e769574317024d8a83aaa6d0d73ef2b243dcc9dd7ace18efe84baea
Analyzer Verdict Alert quad9 Sinkholed
GET /da4fca5f2b554096b6d3d4c2c2ea7828.gif HTTP/1.1
Host: 638236rpn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "63773c5c-8de71"
Date: Sat, 19 Nov 2022 07:10:14 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 18 Nov 2022 08:03:40 GMT
Accept-Ranges: bytes
X-Cache: HIT from cloud-us3-cdnb-27
Content-Length: 581233
287335kmu.com/d408cd44ac6b4add92fe94f78d7f66e5.gif
200 OK 1.0 MB URL HTTP/1.1 287335kmu.com/d408cd44ac6b4add92fe94f78d7f66e5.gif
IP
File type GIF image data, version 89a, 960 x 120\012- data
Size 1.0 MB (1020091 bytes)
Hash b3aedc862671b2fa2e2922fadaa38add
8134113e40aa47b7b0508e81c447ccea8c10e7c0
d60a38f60cbd8cc782d6ecaf7c076dea16bf5eddfdc064d0aa4c03a440d236aa
Analyzer Verdict Alert quad9 Sinkholed
GET /d408cd44ac6b4add92fe94f78d7f66e5.gif HTTP/1.1
Host: 287335kmu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635ba188-f90bb"
Date: Fri, 25 Nov 2022 02:05:47 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 09:31:52 GMT
Accept-Ranges: bytes
X-Cache: HIT from cloud-us3-cdnb-17
Content-Length: 1020091
img.shifangshike.com/gif22.gif
200 OK 52 kB URL HTTP/1.1 img.shifangshike.com/gif22.gif
IP
File type GIF image data, version 89a, 100 x 100\012- data
Hash 1f7893d58efcf5b8c822202cc0d5c652
a8979ed9efeaa9fec04c387f321bffacf127b941
9f896727915f20bcbd163f833b3a7f90ebbae39483805897b86a4c18d9bb28ac
GET /gif22.gif HTTP/1.1
Host: img.shifangshike.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: image/gif
Content-Length: 51613
Connection: keep-alive
Last-Modified: Thu, 25 Aug 2022 14:19:12 GMT
ETag: "630784e0-c99d"
Expires: Mon, 05 Dec 2022 14:42:11 GMT
Cache-Control: max-age=2592000
Server: cdn
X-Cache-Status: HIT
Accept-Ranges: bytes
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/14/2da2f849b5ba3ca1a2a94c96d636f0.gif?attname=960X60%E6%A3%8B%E7%89%8C.gif
200 OK 125 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/14/2da2f849b5ba3ca1a2a94c96d636f0.gif?attname=960X60%E6%A3%8B%E7%89%8C.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 960 x 60\012- data
Size 125 kB (125054 bytes)
Hash 142da2f849b5ba3ca1a2a94c96d636f0
492dac8e992176d2730de24e664e32e0c85c52d8
cf4df6bb83e588dbfb3eca95776f69bf68a2bb05f9c1fbfd2cc208c549f10e41
GET /14/2da2f849b5ba3ca1a2a94c96d636f0.gif?attname=960X60%E6%A3%8B%E7%89%8C.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: image/gif
Content-Length: 125054
Connection: keep-alive
x-oss-request-id: 63803A161F85633831EB41E6
Accept-Ranges: bytes
ETag: "142DA2F849B5BA3CA1A2A94C96D636F0"
Last-Modified: Mon, 17 Oct 2022 13:06:10 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 12564824308862032824
x-oss-storage-class: Standard
Content-Disposition: inline;filename=960X60%E6%A3%8B%E7%89%8C.gif
Content-MD5: FC2i+Em1ujyhoqlMltY28A==
x-oss-server-time: 3
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/c4/aec2fc715ed9100d40a15aa4b82c28.gif?attname=290299ed48d84c7b99d8fbd8a96a254c.gif
200 OK 186 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/c4/aec2fc715ed9100d40a15aa4b82c28.gif?attname=290299ed48d84c7b99d8fbd8a96a254c.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 150 x 150\012- data
Size 186 kB (186342 bytes)
Hash c4aec2fc715ed9100d40a15aa4b82c28
c147669e2e7bffdbff992edf4b8ab2b146040dce
b349c187657aac001daafe636bf8c97f2c81c13f526886cb3fc9bafc0b8cb6df
GET /c4/aec2fc715ed9100d40a15aa4b82c28.gif?attname=290299ed48d84c7b99d8fbd8a96a254c.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: image/gif
Content-Length: 186342
Connection: keep-alive
x-oss-request-id: 63803A16051F6839352FB129
Accept-Ranges: bytes
ETag: "C4AEC2FC715ED9100D40A15AA4B82C28"
Last-Modified: Mon, 18 Jul 2022 12:33:24 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 17557702505599265099
x-oss-storage-class: Standard
Content-Disposition: inline;filename=290299ed48d84c7b99d8fbd8a96a254c.gif
Content-MD5: xK7C/HFe2RANQKFapLgsKA==
x-oss-server-time: 1
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/ed/0edcd2a1e03138d9f20969b680923c.gif?attname=960x60.gif
200 OK 278 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/ed/0edcd2a1e03138d9f20969b680923c.gif?attname=960x60.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 960 x 60\012- data
Size 278 kB (278301 bytes)
Hash ed0edcd2a1e03138d9f20969b680923c
40ea0aba14129eb9aadf04654f779222715839ce
f1f3d88033542602b1078babd25124c307039fcbe0987031a4b34b7fea443aa4
GET /ed/0edcd2a1e03138d9f20969b680923c.gif?attname=960x60.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:22 GMT
Content-Type: image/gif
Content-Length: 278301
Connection: keep-alive
x-oss-request-id: 63803A16DA8A793230D22BAF
Accept-Ranges: bytes
ETag: "ED0EDCD2A1E03138D9F20969B680923C"
Last-Modified: Sat, 03 Sep 2022 08:26:32 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 13760466319862843894
x-oss-storage-class: Standard
Content-Disposition: inline;filename=960x60.gif
Content-MD5: 7Q7c0qHgMTjZ8glptoCSPA==
x-oss-server-time: 2
267827wnc.com/a455af4f310f4cb78c567eafc6d017a5.gif
200 OK 792 kB URL HTTP/1.1 267827wnc.com/a455af4f310f4cb78c567eafc6d017a5.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 120\012- data
Size 792 kB (792073 bytes)
Hash 2816c79b455d9e6a7422c4672783bfc2
5a25b2bffd6319852ae2519dd26067bcd5d2406d
10316406e8574d5f3152aad8a4f60c2f87e1b0154ac2c5049cc2f9f5dce416fb
Analyzer Verdict Alert quad9 Sinkholed
GET /a455af4f310f4cb78c567eafc6d017a5.gif HTTP/1.1
Host: 267827wnc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635b91cb-c1609"
Date: Wed, 23 Nov 2022 13:50:19 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 08:24:43 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-12
Content-Length: 792073
p.qlogo.cn/qqmail_head/ajNVdqHZLLBTqF8e2kN78G9Zt8uAv6By0U3zmELvuZSJJkZNBPXDBGibpXqaicajKqyibnCUUUEomk/0
200 OK 1.4 MB URL HTTP/2 p.qlogo.cn/qqmail_head/ajNVdqHZLLBTqF8e2kN78G9Zt8uAv6By0U3zmELvuZSJJkZNBPXDBGibpXqaicajKqyibnCUUUEomk/0
IP
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type GIF image data, version 89a, 640 x 200\012- data
Size 1.4 MB (1362871 bytes)
Hash b43c54ced7fcd33ebd9405eb26d533b7
05e5eb23ef5a79364bc8f8fd778d54a9fa335174
7db80c626560b0016fd427d864bb6116a44a858eb7968728cd872814939a24b2
GET /qqmail_head/ajNVdqHZLLBTqF8e2kN78G9Zt8uAv6By0U3zmELvuZSJJkZNBPXDBGibpXqaicajKqyibnCUUUEomk/0 HTTP/1.1
Host: p.qlogo.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Qnginx/1.4.4
date: Fri, 25 Nov 2022 03:44:22 GMT
content-type: image/gif
content-length: 1362871
vary: Accept,Origin
last-modified: Sat, 10 Jul 2021 16:21:47 GMT
cache-control: max-age=2592000
x-delay: 705 us
x-info: real data
x-bcheck: 0_1
x-cpt: filename=0
user-returncode: 0
x-datasrc: 2
x-reqgue: 0
size: 1362871
chid: 0
fid: 0
x-nws-log-uuid: 504f94d8-3fe1-4014-b339-51892645ab65
X-Firefox-Spdy: h2
701.oss-cn-hongkong.aliyuncs.com/gg/150X150-2.gif
200 OK 303 kB URL HTTP/1.1 701.oss-cn-hongkong.aliyuncs.com/gg/150X150-2.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 204 x 204\012- data
Size 303 kB (302941 bytes)
Hash 849d3b77a87512fb8e63de7fe770a145
7257e8ddd72330f7a2f47b86f479e1afca446948
dae2cf0264685acac5a0568c4ff2f4ad162158e367a78542e41255539c2365aa
GET /gg/150X150-2.gif HTTP/1.1
Host: 701.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: image/gif
Content-Length: 302941
Connection: keep-alive
x-oss-request-id: 63803A17DD75B7383533E5A5
Accept-Ranges: bytes
ETag: "849D3B77A87512FB8E63DE7FE770A145"
Last-Modified: Tue, 21 Jun 2022 08:13:57 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 12517348424964693894
x-oss-storage-class: Standard
Content-MD5: hJ07d6h1EvuOY95/53ChRQ==
x-oss-server-time: 2
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/1e/71c933aabc1e9f07e769996c8ab221.gif?attname=05.gif
200 OK 233 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/1e/71c933aabc1e9f07e769996c8ab221.gif?attname=05.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 1020 x 125\012- data
Size 233 kB (232787 bytes)
Hash 1e71c933aabc1e9f07e769996c8ab221
f0df93d47a997f8aa64e56fa832d286f299a5df0
e11479d6bae9bbff9d46d57f78aae64acd3ee2f13597e3235938f190efdef3b9
GET /1e/71c933aabc1e9f07e769996c8ab221.gif?attname=05.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: image/gif
Content-Length: 232787
Connection: keep-alive
x-oss-request-id: 63803A1723C05430310BC353
Accept-Ranges: bytes
ETag: "1E71C933AABC1E9F07E769996C8AB221"
Last-Modified: Sat, 03 Sep 2022 08:18:37 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 6712043708322284217
x-oss-storage-class: Standard
Content-Disposition: inline;filename=05.gif
Content-MD5: HnHJM6q8Hp8H52mZbIqyIQ==
x-oss-server-time: 2
aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/04/4bef20fb6191fd19a6279928fe0dbf.gif?attname=960x120px+.gif
200 OK 541 kB URL HTTP/1.1 aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com/04/4bef20fb6191fd19a6279928fe0dbf.gif?attname=960x120px+.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 960 x 120\012- data
Size 541 kB (540956 bytes)
Hash 044bef20fb6191fd19a6279928fe0dbf
aeeb6dd90a0149b9d38a2bf7b1e8dca57b1f3453
fa91c2a4b7f532dd5db907a7143ef3d5e5d5cbd631f59c5339e28cdcf092ce1a
GET /04/4bef20fb6191fd19a6279928fe0dbf.gif?attname=960x120px+.gif HTTP/1.1
Host: aliyun-static-bucket.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:24 GMT
Content-Type: image/gif
Content-Length: 540956
Connection: keep-alive
x-oss-request-id: 63803A18DA8A7932352733AF
Accept-Ranges: bytes
ETag: "044BEF20FB6191FD19A6279928FE0DBF"
Last-Modified: Fri, 02 Sep 2022 10:56:22 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 1695515477309922558
x-oss-storage-class: Standard
Content-Disposition: inline;filename=960x120px%20.gif
Content-MD5: BEvvIPthkf0ZpieZKP4Nvw==
x-oss-server-time: 2
www.gfngus-fd5fsfr.cc/ssiq/dh.js
200 OK 0 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/dh.js
IP
ASN #134548 DXTL Tseung Kwan O Service
GET /ssiq/dh.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
last-modified: Tue, 22 Nov 2022 11:06:34 GMT
vary: Accept-Encoding
etag: W/"637cad3a-2c2c"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
www.gfngus-fd5fsfr.cc/ssiq/qq1.js
200 OK 0 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/qq1.js
IP
ASN #134548 DXTL Tseung Kwan O Service
GET /ssiq/qq1.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
last-modified: Wed, 23 Nov 2022 14:48:08 GMT
vary: Accept-Encoding
etag: W/"637e32a8-3061"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
img.1203555.com/images/63760e067d37113108afb906.gif
302 Found 0 B URL HTTP/2 img.1203555.com/images/63760e067d37113108afb906.gif
IP
GET /images/63760e067d37113108afb906.gif HTTP/1.1
Host: img.1203555.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
referrer-policy: no-referrer
location: https://p3.douyinpic.com/obj/tos-cn-i-dy/4cc6e027ff07440b86b4c8f810e13446
cache-control: max-age=3600
X-Firefox-Spdy: h2
398375178.com/f6bc409c34864843ac2d579851def759.gif
200 OK 0 B URL HTTP/1.1 398375178.com/f6bc409c34864843ac2d579851def759.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
GET /f6bc409c34864843ac2d579851def759.gif HTTP/1.1
Host: 398375178.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: image/gif
Content-Length: 161611
Connection: keep-alive
x-oss-request-id: 63803A179DB5783337F5A7A4
Accept-Ranges: bytes
ETag: "4666EA4F8137600EF53345C02188DD19"
Last-Modified: Wed, 16 Nov 2022 15:29:10 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 1732053763189643994
x-oss-storage-class: Standard
Content-MD5: RmbqT4E3YA71M0XAIYjdGQ==
x-oss-server-time: 2
398375178.com/c310ce984d314cde8c4c930fd85d15a4.gif
200 OK 0 B URL HTTP/1.1 398375178.com/c310ce984d314cde8c4c930fd85d15a4.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
GET /c310ce984d314cde8c4c930fd85d15a4.gif HTTP/1.1
Host: 398375178.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 25 Nov 2022 03:44:23 GMT
Content-Type: image/gif
Content-Length: 584025
Connection: keep-alive
x-oss-request-id: 63803A1722C82A3835318E5C
Accept-Ranges: bytes
ETag: "EBF4EE75BBD43B703E1B1B861BA166E2"
Last-Modified: Wed, 16 Nov 2022 15:34:08 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 9573701292697531384
x-oss-storage-class: Standard
Content-MD5: 6/TudbvUO3A+GxuGG6Fm4g==
x-oss-server-time: 2
www.gfngus-fd5fsfr.cc/ssiq/sq.js
200 OK 0 B URL HTTP/2 www.gfngus-fd5fsfr.cc/ssiq/sq.js
IP
ASN #134548 DXTL Tseung Kwan O Service
GET /ssiq/sq.js HTTP/1.1
Host: www.gfngus-fd5fsfr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://38.239.194.4/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 03:44:20 GMT
content-type: application/javascript
last-modified: Sun, 20 Nov 2022 08:52:40 GMT
vary: Accept-Encoding
etag: W/"6379ead8-f81"
expires: Fri, 25 Nov 2022 15:44:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
154.214.155.176
103.143.19.103
23.36.77.32
104.18.21.226
172.67.161.53
47.246.44.225
103.170.15.77
43.154.254.32
91.199.87.220
93.184.220.29