staging.camersoftware.com/
301 Moved Permanently 162 B URL HTTP/1.1 staging.camersoftware.com/
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
Analyzer Verdict Alert fortinet Phishing
GET / HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 14 Mar 2023 10:14:57 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://staging.camersoftware.com/
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 234b80a5a27f3d377e322e680413479d
3da8ba535ec19898f5b83ece48cd4038ac2bf557
370104df5dd8f739601a4be42ae41bb92f365dcf585823a3c14733f7c394e926
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "370104DF5DD8F739601A4BE42AE41BB92F365DCF585823A3C14733F7C394E926"
Last-Modified: Sun, 12 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10615
Expires: Tue, 14 Mar 2023 13:11:52 GMT
Date: Tue, 14 Mar 2023 10:14:57 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e7a9cb518d929d10c471394adc89cdfa
d609cb0d94e645141ab1372f19c014c1b00b83af
200db48dd5e87cba8dc962e8981f72def9c12e21d5a417361c4f77425e55597a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "200DB48DD5E87CBA8DC962E8981F72DEF9C12E21D5A417361C4F77425E55597A"
Last-Modified: Sun, 12 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16287
Expires: Tue, 14 Mar 2023 14:46:24 GMT
Date: Tue, 14 Mar 2023 10:14:57 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 7f03faaba3392caae6dae54467bfdf6d
57ea1f14e8bfbcca8190c706d708c9fda12442c1
02ac551ba61fcbc6b04f244df065948b181a8a258db5c2e197aae66fdfcea8ee
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Backoff, Retry-After, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 14 Mar 2023 10:09:22 GMT
content-type: application/json
age: 335
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8b1778005daa3ea807573992adbd0452
4cf2aaf44073506371c1e21970a18b9eab00622f
5f74233b9cc53b0ba6149fce51f6b31c2edb892b0a95b48e66b15ee9f59525ad
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5F74233B9CC53B0BA6149FCE51F6B31C2EDB892B0A95B48E66B15EE9F59525AD"
Last-Modified: Sun, 12 Mar 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19370
Expires: Tue, 14 Mar 2023 15:37:47 GMT
Date: Tue, 14 Mar 2023 10:14:57 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash b5ba6334e73496995e3e3a9ecd0eb323
ad80d3b7718c28364e8c2004fb38a13a1747e462
aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: +UX1qlrFjxoApwNUGO2kLC4CMjUfJlY3SGMFYDerFNz/8Nzd4UJwLQzVL3eT1ehrv+izwSEOSfw=
x-amz-request-id: V8NV5TN70QM2C2YF
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 14 Mar 2023 09:46:45 GMT
age: 1692
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:57 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e310cb3fe9de5118111c14fecc3b087b
824638670908839ba3dca015e37c90e17a27feca
50d2b46d9400621c1ceaa3015cf948fb818badbe0c81814bac0f39a1b4490200
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "50D2B46D9400621C1CEAA3015CF948FB818BADBE0C81814BAC0F39A1B4490200"
Last-Modified: Sat, 11 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21576
Expires: Tue, 14 Mar 2023 16:14:33 GMT
Date: Tue, 14 Mar 2023 10:14:57 GMT
Connection: keep-alive
staging.camersoftware.com/wp-content/maintenance/assets/images/twitter.svg
200 OK 952 B URL HTTP/2 staging.camersoftware.com/wp-content/maintenance/assets/images/twitter.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (952), with no line terminators
Hash dd4f8165e570755b63fbdecbe8517310
63b8013008224f21328750709814a66bdd639c46
c4776245ed99e108e72b1ed13278bc87a90bbb9382cc28a581b08b3e1f580280
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/maintenance/assets/images/twitter.svg HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:57 GMT
content-type: image/svg+xml
content-length: 952
x-accel-version: 0.01
last-modified: Wed, 25 Jan 2023 23:00:59 GMT
etag: "3b8-5f31e9b10eb2b"
accept-ranges: bytes
x-powered-by: PleskLin
X-Firefox-Spdy: h2
staging.camersoftware.com/
503 Service Unavailable 5.8 kB URL HTTP/2 staging.camersoftware.com/
IP
Hash 5876aa38c357be25d30822553e15b563
c9bff3cbcdcc5505be9f4ee6611abd7ae0bf4818
a5b4c8116320dbb5fee5b0ba5e84dfdea822ae41127dfa75ccf2bda5dd18984a
Analyzer Verdict Alert fortinet Phishing
GET / HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 503 Service Unavailable
server: nginx
date: Tue, 14 Mar 2023 10:14:57 GMT
content-type: text/html; charset=utf-8
x-powered-by: PHP/7.3.33
retry-after: 600
X-Firefox-Spdy: h2
staging.camersoftware.com/wp-content/maintenance/assets/images/facebook.svg
200 OK 424 B URL HTTP/2 staging.camersoftware.com/wp-content/maintenance/assets/images/facebook.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (424), with no line terminators
Hash dc3714e15ee2485e02683e0bf0793907
138013642372d3647a473b9dc6b6742262264646
fd7d36f12699b359c97d46c3215c20acd013d32c46577d25a7e8370ac9d09137
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/maintenance/assets/images/facebook.svg HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:57 GMT
content-type: image/svg+xml
content-length: 424
x-accel-version: 0.01
last-modified: Wed, 25 Jan 2023 23:00:59 GMT
etag: "1a8-5f31e9b10eb2b"
accept-ranges: bytes
x-powered-by: PleskLin
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Length, Retry-After, Content-Type, Expires, Alert, Pragma, ETag, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 14 Mar 2023 10:12:32 GMT
age: 146
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b426c61dbf49129b0554669c6666e025
6b329663868aac72e296a4c594d46b542f7003e7
6349d43a437729d91c0739616283458cbc123bd6d056522f68cd48b89364ea95
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6349D43A437729D91C0739616283458CBC123BD6D056522F68CD48B89364EA95"
Last-Modified: Sun, 12 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19333
Expires: Tue, 14 Mar 2023 15:37:11 GMT
Date: Tue, 14 Mar 2023 10:14:58 GMT
Connection: keep-alive
new.weatherplllatform.com/pick.js?v=7.77.3
200 OK 689 B URL HTTP/2 new.weatherplllatform.com/pick.js?v=7.77.3
IP
ASN #2856 British Telecommunications PLC
File type ASCII text, with very long lines (1529), with no line terminators
Hash 4155ee2aeda036a7db96986ed8567463
3b9091b7fa1268ee548741e23539984adc44a47f
3db23fb0511f34e3654d3546626ff6659ffa7c312a30fb02efeb9d744cf77ea6
Analyzer Verdict Alert fortinet Malware
GET /pick.js?v=7.77.3 HTTP/1.1
Host: new.weatherplllatform.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:58 GMT
content-type: application/javascript; charset=utf-8
content-length: 689
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
staging.camersoftware.com/wp-content/maintenance/assets/fonts/open-sans-300.woff2
200 OK 63 kB URL HTTP/2 staging.camersoftware.com/wp-content/maintenance/assets/fonts/open-sans-300.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 63180, version 1.6554\012- data
Hash ea284cc760cad1896d4c917f1e546210
6c7717f61df483598f42fce74f4d743b282b008b
19edd2b018063320559188548b225aa63914bbc90fb756bc26872db1669e89f0
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/maintenance/assets/fonts/open-sans-300.woff2 HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://staging.camersoftware.com/wp-content/maintenance/assets/styles.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:58 GMT
content-type: font/woff2
content-length: 63180
last-modified: Wed, 25 Jan 2023 23:00:59 GMT
etag: "63d1b4ab-f6cc"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: PC4oZDBTIkXgzvxJOPgWKQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: NiBtoc9QCPlVDjmRh80WrmrtBSM=
staging.camersoftware.com/wp-content/maintenance/assets/images/Camer_Software_bg.jpeg
200 OK 187 kB URL HTTP/2 staging.camersoftware.com/wp-content/maintenance/assets/images/Camer_Software_bg.jpeg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x854, components 3\012- data
Size 187 kB (186747 bytes)
Hash 82a425afeb306c463cbd8e7befd0ea73
0d0a6531f4f107899f3fe04fdc4cf38ffbc946de
240f7dcbc6942d2bfc6df8b091293380cb11f3948eec5b5a32f3e58237592797
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/maintenance/assets/images/Camer_Software_bg.jpeg HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/wp-content/maintenance/assets/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:58 GMT
content-type: image/jpeg
content-length: 186747
last-modified: Wed, 25 Jan 2023 23:00:59 GMT
etag: "63d1b4ab-2d97b"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 38c17cac847e33e04191c9409b84c753
c545b49aaca27fb6408168f0bf9ea17824cf93af
c4cd62c0cf488f87d6957b79a6770390be293b1c4c467a0cdcce376544b80b72
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C4CD62C0CF488F87D6957B79A6770390BE293B1C4C467A0CDCCE376544B80B72"
Last-Modified: Mon, 13 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=385
Expires: Tue, 14 Mar 2023 10:21:23 GMT
Date: Tue, 14 Mar 2023 10:14:58 GMT
Connection: keep-alive
staging.camersoftware.com/wp-content/uploads/2016/09/cropped-Camer-Software-Icon-1-32x32.png
200 OK 1.1 kB URL HTTP/2 staging.camersoftware.com/wp-content/uploads/2016/09/cropped-Camer-Software-Icon-1-32x32.png
IP
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 2ee1744cff15b973568d9a9cdeb522b0
2dbc8bfc37ab6b803a638c4f2cf9d56fb1280683
35990b0e367d9c9a28b1b30726a5e5a08764a8a9a20d8fe7cc73016a1c571c44
GET /wp-content/uploads/2016/09/cropped-Camer-Software-Icon-1-32x32.png HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:58 GMT
content-type: image/png
content-length: 1093
last-modified: Wed, 25 Jan 2023 23:01:32 GMT
etag: "63d1b4cc-445"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
back.firstblackphase.com/mbRB96
200 OK 851 B URL HTTP/1.1 back.firstblackphase.com/mbRB96
IP
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (2003), with no line terminators
Hash 2615b36507259920be0c13ac25457013
ea1137c5b0deda5000d40c065cc413120ea8c73b
18e3958c974b7635664dd2ff8b91681eece2b157c7767b9dadc3e32bfe624cc9
GET /mbRB96 HTTP/1.1
Host: back.firstblackphase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 14 Mar 2023 10:14:58 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 851
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Expires: 0
Pragma: no-cache
Set-Cookie: _subid=s8hnpa3vn26; expires=Fri, 14 Apr 2023 10:14:58 GMT; path=/
381c9=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjFcIjoxNjc4Nzg4ODk4fSxcImNhbXBhaWduc1wiOntcIjFcIjoxNjc4Nzg4ODk4fSxcInRpbWVcIjoxNjc4Nzg4ODk4fSJ9.FsUBp3UpTthzKztqHQlUS5IIJH0NKr_HPeVQ4UMTiC8; expires=Mon, 25 May 2076 04:29:56 GMT; path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f6645fbe01760dceaf9ccc444150f107
002a281a5fe14c1769c413c93ea60547533dcb94
76fb14b226cec4ab66bac02227df42b3648c31e0e8f5cbfe942feeddb269a68e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "76FB14B226CEC4AB66BAC02227DF42B3648C31E0E8F5CBFE942FEEDDB269A68E"
Last-Modified: Mon, 13 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20160
Expires: Tue, 14 Mar 2023 15:50:59 GMT
Date: Tue, 14 Mar 2023 10:14:59 GMT
Connection: keep-alive
cdn.statisticline.com/scripts/swaynew.js
200 OK 1.5 kB URL HTTP/1.1 cdn.statisticline.com/scripts/swaynew.js
IP
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (4124), with no line terminators
Hash 87f7ce832f2a2bf25ce964b4e4e6167b
3147441a1d75afd4e46f1cd3daecaafe98946fb3
eeb0d5e3c973eff5bccbd9f938a49a0a209e4ceeefe92eec3af8c9ccf3e5afc9
GET /scripts/swaynew.js HTTP/1.1
Host: cdn.statisticline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 14 Mar 2023 10:14:59 GMT
Content-Type: application/javascript
Last-Modified: Sun, 12 Mar 2023 18:50:44 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"640e1f04-101c"
Expires: Fri, 24 Mar 2023 10:14:59 GMT
Cache-Control: max-age=864000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8bd8586a0a52f516ac521f2a3752b049
3cfd233164ae5350f2fb61250641b70e788cf58a
8783e071c3f60fbca2bba5260b55a41f1035e150ffd94a66ff6a102ff2bc6783
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8783E071C3F60FBCA2BBA5260B55A41F1035E150FFD94A66FF6A102FF2BC6783"
Last-Modified: Tue, 14 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12583
Expires: Tue, 14 Mar 2023 13:44:42 GMT
Date: Tue, 14 Mar 2023 10:14:59 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8bd8586a0a52f516ac521f2a3752b049
3cfd233164ae5350f2fb61250641b70e788cf58a
8783e071c3f60fbca2bba5260b55a41f1035e150ffd94a66ff6a102ff2bc6783
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8783E071C3F60FBCA2BBA5260B55A41F1035E150FFD94A66FF6A102FF2BC6783"
Last-Modified: Tue, 14 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12583
Expires: Tue, 14 Mar 2023 13:44:42 GMT
Date: Tue, 14 Mar 2023 10:14:59 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8bd8586a0a52f516ac521f2a3752b049
3cfd233164ae5350f2fb61250641b70e788cf58a
8783e071c3f60fbca2bba5260b55a41f1035e150ffd94a66ff6a102ff2bc6783
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8783E071C3F60FBCA2BBA5260B55A41F1035E150FFD94A66FF6A102FF2BC6783"
Last-Modified: Tue, 14 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12583
Expires: Tue, 14 Mar 2023 13:44:42 GMT
Date: Tue, 14 Mar 2023 10:14:59 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8bd8586a0a52f516ac521f2a3752b049
3cfd233164ae5350f2fb61250641b70e788cf58a
8783e071c3f60fbca2bba5260b55a41f1035e150ffd94a66ff6a102ff2bc6783
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8783E071C3F60FBCA2BBA5260B55A41F1035E150FFD94A66FF6A102FF2BC6783"
Last-Modified: Tue, 14 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12583
Expires: Tue, 14 Mar 2023 13:44:42 GMT
Date: Tue, 14 Mar 2023 10:14:59 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F07347a5f-4c35-4f53-a77d-4ca5883b42b1.jpeg
200 OK 8.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F07347a5f-4c35-4f53-a77d-4ca5883b42b1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d7576ea71a52cc84be114c4ca5c1a101
ba18fe39a596c12cafa2aaaa16c65061a4ecb55f
6d1171e21c14d5827c495ab63d2fd14f573aad8cfdfa45b81e646052cb8d819d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F07347a5f-4c35-4f53-a77d-4ca5883b42b1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8798
x-amzn-requestid: a76ce81a-fe2c-4fb5-89f5-8a466ee83256
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BvSwnG0sIAMFmFQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640f9803-2af4e3026224b91f556feec3;Sampled=0
x-amzn-remapped-date: Mon, 13 Mar 2023 21:39:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: UkD87MvAJrPqVef87nqeb9gRC5i1lsKB4A7qeYBFrK0QQnDFe3a-Vw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 6af3b573d8970d5db2a4d03354335b84.cloudfront.net (CloudFront), 1.1 google
date: Mon, 13 Mar 2023 21:48:59 GMT
age: 44760
etag: "ba18fe39a596c12cafa2aaaa16c65061a4ecb55f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F96e84919-82a6-462c-89aa-5dfd62b065b1.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F96e84919-82a6-462c-89aa-5dfd62b065b1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 60ae6be476f64653385ee775c2ba5460
4ebff6ea6c7104f16db08ac1e13af5c4d9ecab71
c3a75d6b8f755e734ecc6fcfb5229cb47f7a4d9a6bcdbae6693da0e94b03cafc
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F96e84919-82a6-462c-89aa-5dfd62b065b1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6598
x-amzn-requestid: 0b194caa-137d-4f93-8a7b-26cb05bfa3a2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BvSpAEHZIAMFedA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640f97d2-2e4dd06a76e1184a2b39188f;Sampled=0
x-amzn-remapped-date: Mon, 13 Mar 2023 21:38:26 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: 1aOuS98SlIgqTJys-TCvzgzDhFobCcNpP9C_-QSI1Y_IwA1x13KpUA==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 548adcda884eed02304ba5d6a1d7f514.cloudfront.net (CloudFront), 1.1 google
date: Mon, 13 Mar 2023 21:48:49 GMT
etag: "4ebff6ea6c7104f16db08ac1e13af5c4d9ecab71"
content-type: image/jpeg
age: 44770
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F26521ff6-85cb-4f66-a570-c1c161a5b9f5.jpeg
200 OK 9.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F26521ff6-85cb-4f66-a570-c1c161a5b9f5.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 93e1b34f4dbbd7b8215af242107281df
91fd7a5a7a2e805cb355705e2fb1e0b91401db0b
e1bd756029248ccd01f1ac240a4a07a2f15e15d6624a6a660a9126767dd6056a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F26521ff6-85cb-4f66-a570-c1c161a5b9f5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9203
x-amzn-requestid: 53d1e94f-178f-449d-820e-20db4c52d766
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BvSgFE7foAMFdcA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640f9799-23789aa8567f8c661bea3fb4;Sampled=0
x-amzn-remapped-date: Mon, 13 Mar 2023 21:37:29 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: xSuHAVm51P01HQ6m14PMrGXKy79d1G6Q7rb0BKFox1Tk5SCcsF0v0w==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 1d000d0dfe9d69b4983f619fdc5499d6.cloudfront.net (CloudFront), 1.1 google
date: Mon, 13 Mar 2023 22:05:15 GMT
age: 43784
etag: "91fd7a5a7a2e805cb355705e2fb1e0b91401db0b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc20f2b31-8a32-4e66-bba7-e76e1c14f5ce.jpeg
200 OK 8.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc20f2b31-8a32-4e66-bba7-e76e1c14f5ce.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dd8a4e29260d209803408596cb286f8f
20f6796c0c7064542cc8eefe138076d16d66e8d8
54a328e054b23ddbf531b69a7c5bb817704c0dd98bc7625c9571df19df982a17
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc20f2b31-8a32-4e66-bba7-e76e1c14f5ce.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8091
x-amzn-requestid: 7e6e055a-de20-4f2f-8f76-2fe57747ed08
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BvSgDFEMoAMFXIg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640f9799-1e932e3a10bd39d630310c65;Sampled=0
x-amzn-remapped-date: Mon, 13 Mar 2023 21:37:29 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: 8PtI7M0lBQx0BzzkLgbxlRJU-tGNlPtAI-lv-8TLbh7XKMbMOAAw9Q==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 ea699166e6ec77aa410ff505b0a8ce18.cloudfront.net (CloudFront), 1.1 google
date: Mon, 13 Mar 2023 21:48:49 GMT
age: 44770
etag: "20f6796c0c7064542cc8eefe138076d16d66e8d8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F87df4bcd-c6cd-4a0c-a9f5-dffb7f36d2e4.jpeg
200 OK 8.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F87df4bcd-c6cd-4a0c-a9f5-dffb7f36d2e4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash be71491cee9b47dc3ffb23b4fdff25b3
79c7d22c8df6d305f46c5779ccb9f25169d4d111
e785896e5840fb901ddd0118bef3ccad6b59a96d8eef0e8ccd9c95a3c261ba45
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F87df4bcd-c6cd-4a0c-a9f5-dffb7f36d2e4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8487
x-amzn-requestid: 92381f1a-0140-47e9-a971-594a7de36c3c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BkEcBGizoAMFgOA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640b1ab3-1a54b65a5d7083e62dcb85ab;Sampled=0
x-amzn-remapped-date: Fri, 10 Mar 2023 11:55:31 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: w_13YsBBteASlPvTrgLhnI-QiuUjEcR9q-bADLbCRl6B-uwcPS3TQA==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 c5c7edc18be1805f007e0576da02e554.cloudfront.net (CloudFront), 1.1 google
date: Mon, 13 Mar 2023 22:59:58 GMT
age: 40501
etag: "79c7d22c8df6d305f46c5779ccb9f25169d4d111"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd84fda2e-81f7-4336-adf1-ea7c9e499a73.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd84fda2e-81f7-4336-adf1-ea7c9e499a73.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2fe07d17b76df5f6a86937338665de2c
d32dfeb309fcbbd04e13057ef3bcca577e9abf46
7b12520ec1d30e17e43edb9cb050c2492743907909faa4f2f5696288228d3054
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd84fda2e-81f7-4336-adf1-ea7c9e499a73.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11519
x-amzn-requestid: cb8f2b42-356c-417a-9562-10dc60b6d38e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BvSwdHReoAMFnHw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640f9802-356031197266d0f57441f22b;Sampled=0
x-amzn-remapped-date: Mon, 13 Mar 2023 21:39:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: 3_7QybUMHflcIawKkhWCoYG-cf8XmYfk539A1O3ShngfMdL2IjxBYg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 ae06b19943a6bad1c1b12b79f7339498.cloudfront.net (CloudFront), 1.1 google
date: Mon, 13 Mar 2023 22:04:18 GMT
age: 43841
etag: "d32dfeb309fcbbd04e13057ef3bcca577e9abf46"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 65f3c4ddb15f459c65aaf92c0440e351
6574ce8c9e5307bfaa417dca32bd0401c3cb8db3
2cabcc4734230fc2701910824815f29992679a04ee75256a7becfec8c2dadf15
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2CABCC4734230FC2701910824815F29992679A04EE75256A7BECFEC8C2DADF15"
Last-Modified: Mon, 13 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4807
Expires: Tue, 14 Mar 2023 11:35:06 GMT
Date: Tue, 14 Mar 2023 10:14:59 GMT
Connection: keep-alive
far.statisticline.com/away/go.php?id=64785e55-66-45776433
302 Found 0 B URL HTTP/1.1 far.statisticline.com/away/go.php?id=64785e55-66-45776433
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /away/go.php?id=64785e55-66-45776433 HTTP/1.1
Host: far.statisticline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx
Date: Tue, 14 Mar 2023 10:14:59 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://come.sortyellowapples.com/away/go.php?id=6436345-33-5734523&qid=8568&wid=76538&kid=863843534&suid=551
Access-Control-Allow-Origin: *
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 25828f23e1b308bf735b6a6c86cc58ca
701ed315704158ad4b44957bce760ed5b628ddac
95ebeddb06672924c2272edf3fc985016037551afbd2f98eccc6d245b3252e61
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "95EBEDDB06672924C2272EDF3FC985016037551AFBD2F98ECCC6D245B3252E61"
Last-Modified: Mon, 13 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4266
Expires: Tue, 14 Mar 2023 11:26:06 GMT
Date: Tue, 14 Mar 2023 10:15:00 GMT
Connection: keep-alive
come.sortyellowapples.com/away/go.php?id=6436345-33-5734523&qid=8568&wid=76538&kid=863843534&suid=551
200 OK 470 B URL HTTP/1.1 come.sortyellowapples.com/away/go.php?id=6436345-33-5734523&qid=8568&wid=76538&kid=863843534&suid=551
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash e3f7bff77ddf1989115f24d8fddfeed9
35fa135c85644d4bff34f5308e427f33e66b1e2e
86dd8d5b2c9ce662c34bee39e5e61cec3780d8e5091fa1c0b0bc2d9df49cb0de
Analyzer Verdict Alert quad9 Sinkholed
GET /away/go.php?id=6436345-33-5734523&qid=8568&wid=76538&kid=863843534&suid=551 HTTP/1.1
Host: come.sortyellowapples.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://staging.camersoftware.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 14 Mar 2023 10:15:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f6bca5d0a274f77a3df60fafac2d23ac
83de62ef72d9b1c67dfc26da460808f6c287280d
d14b1c10cddf092f384d56a3aa321c482e9e988a4ec241cebc8039ae8e2bea07
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D14B1C10CDDF092F384D56A3AA321C482E9E988A4EC241CEBC8039AE8E2BEA07"
Last-Modified: Sun, 12 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21518
Expires: Tue, 14 Mar 2023 16:13:38 GMT
Date: Tue, 14 Mar 2023 10:15:00 GMT
Connection: keep-alive
shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&si2=
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
l1i8r.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 l1i8r.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: l1i8r.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://l1i8r.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=1
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
l1i8r.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 l1i8r.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: l1i8r.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://l1i8r.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=1
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
l1i8r.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 l1i8r.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: l1i8r.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://l1i8r.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=1
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
azkcqs.com/rpe?a=1&s=1&act=17&src=2&p=1054030&st=1190911&wd=434354&d=shbzek.com&tpl=5&rnd=0.9208463403276589&sbid=dreans02&sbid2=
200 OK 0 B URL HTTP/2 azkcqs.com/rpe?a=1&s=1&act=17&src=2&p=1054030&st=1190911&wd=434354&d=shbzek.com&tpl=5&rnd=0.9208463403276589&sbid=dreans02&sbid2=
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /rpe?a=1&s=1&act=17&src=2&p=1054030&st=1190911&wd=434354&d=shbzek.com&tpl=5&rnd=0.9208463403276589&sbid=dreans02&sbid2= HTTP/1.1
Host: azkcqs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://l1i8r.shbzek.com
Connection: keep-alive
Referer: https://l1i8r.shbzek.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 14 Mar 2023 10:15:01 GMT
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2
ezrmu.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 ezrmu.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: ezrmu.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ezrmu.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=2
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
ezrmu.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 ezrmu.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: ezrmu.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ezrmu.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=2
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
ezrmu.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 ezrmu.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: ezrmu.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ezrmu.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=2
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
ezrmu.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=2
200 OK 12 kB URL HTTP/2 ezrmu.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=2
IP
ASN #39572 DataWeb Global Group B.V.
Hash d98ce5bc32123527fbdbba9dd757d206
f6370917e79346fb805ace8c5a68220f8344b567
554e4a7e7a37163e5ed5d9ac07b513122c94cf26b164def61911a2c3f509acde
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=2 HTTP/1.1
Host: ezrmu.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://l1i8r.shbzek.com/
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
lgj3e.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 lgj3e.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: lgj3e.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lgj3e.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=3
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
lgj3e.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 lgj3e.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: lgj3e.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lgj3e.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=3
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
t6ovb.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=4
200 OK 22 kB URL HTTP/2 t6ovb.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=4
IP
ASN #39572 DataWeb Global Group B.V.
Hash a5750fa4f0788db042982d9543b61b5b
70ebcb0945776ecc841c1643b5deb0f16a56e527
e57d6657fd217c6d8699e62e3d79bc60cde4220c6213881a575262ab26715025
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=4 HTTP/1.1
Host: t6ovb.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lgj3e.shbzek.com/
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu4
content-encoding: gzip
X-Firefox-Spdy: h2
t6ovb.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 t6ovb.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: t6ovb.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t6ovb.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=4
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
t6ovb.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 t6ovb.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: t6ovb.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t6ovb.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=4
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
fpvmy.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 fpvmy.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: fpvmy.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://fpvmy.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=5
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
lgj3e.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=3
200 OK 16 kB URL HTTP/2 lgj3e.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=3
IP
ASN #39572 DataWeb Global Group B.V.
Hash e7dbd97f468e5c47756fd1a33ece1150
745b855bea979d066ca3615dab6a23ac07ff7cf8
02395f2239910b7bf2fbccd096744e776a8ce7cc251a7beea891c4813d37704c
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=3 HTTP/1.1
Host: lgj3e.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ezrmu.shbzek.com/
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
fpvmy.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 fpvmy.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: fpvmy.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://fpvmy.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=5
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
dpj8l.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 dpj8l.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: dpj8l.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dpj8l.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=6
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
dpj8l.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 dpj8l.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: dpj8l.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dpj8l.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=6
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
dpj8l.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=6
200 OK 26 kB URL HTTP/2 dpj8l.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=6
IP
ASN #39572 DataWeb Global Group B.V.
Hash 70c0eda076b7ebbf2b7d21cd4fd54989
9ef2063907c7db962236e913e45831793cfddd34
f93984da511a530c1a09d55985429ebed40970426449c9e8b0365759fb87664e
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=6 HTTP/1.1
Host: dpj8l.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://fpvmy.shbzek.com/
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
8e2m7.shbzek.com/images/bot-verification/man.png
200 OK 14 kB URL HTTP/2 8e2m7.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
Hash 98cba6be8ab9dfb99ae995c9344ae7ef
7752918e97591314cc810f830cae3357e311487d
61b559c7637b45f71e38b8c42b383c37de240def407412f0997473a31e538b46
GET /images/bot-verification/man.png HTTP/1.1
Host: 8e2m7.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://8e2m7.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=7
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
8e2m7.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 8e2m7.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: 8e2m7.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://8e2m7.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=7
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
ulmoyc.com/v1/sdk.js?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6MiwicG0iOjJ9eyJ&d=shbzek.com&tpl=5&pbd=iOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNpMSI6ImRyZWFuczAyIiwiaSI6IjEifQ==eyJwaWQ
200 OK 26 kB URL HTTP/2 ulmoyc.com/v1/sdk.js?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6MiwicG0iOjJ9eyJ&d=shbzek.com&tpl=5&pbd=iOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNpMSI6ImRyZWFuczAyIiwiaSI6IjEifQ==eyJwaWQ
IP
File type ASCII text, with very long lines (11288), with no line terminators
Hash 860dabac94f15a51002d683a3a63938c
bfc402962ce41f4c3188b97a8761d81ae2e43850
298ad27e1989bdd52dd83392d8e0866c2e2d7c6c6be956a85b670f40550eb6bc
GET /v1/sdk.js?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6MiwicG0iOjJ9eyJ&d=shbzek.com&tpl=5&pbd=iOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNpMSI6ImRyZWFuczAyIiwiaSI6IjEifQ==eyJwaWQ HTTP/1.1
Host: ulmoyc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://l1i8r.shbzek.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-origin: https://shbzek.com
etag: W/"RV4bq6FQBoa3IFGf8sFQEH1a1VQ"
x-zone: eu
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivdIG0BDWP7y4aqDztkc01U9ohqGWqB4JBpA1Ypw9yETXBI0tggm%2BFDg%2FgIZd6p9Kvpm1kxbfd%2FawagofFG0x40RRcRHf8gkNtlfUIZW52c7yt%2FR%2BhuymyqEyyDM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7a7bc0c6dffdb4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
y1h8d.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 y1h8d.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: y1h8d.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://y1h8d.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=8
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
y1h8d.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 y1h8d.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: y1h8d.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://y1h8d.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=8
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
y1h8d.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 y1h8d.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: y1h8d.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://y1h8d.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=8
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
g527i.shbzek.com/images/bot-verification/man.png
200 OK 11 kB URL HTTP/2 g527i.shbzek.com/images/bot-verification/man.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /images/bot-verification/man.png HTTP/1.1
Host: g527i.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://g527i.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=9
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:03 GMT
content-type: image/png
content-length: 10591
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-295f"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
g527i.shbzek.com/images/bot-verification/logo.png
200 OK 1.1 kB URL HTTP/2 g527i.shbzek.com/images/bot-verification/logo.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /images/bot-verification/logo.png HTTP/1.1
Host: g527i.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://g527i.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=9
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:03 GMT
content-type: image/png
content-length: 1061
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-425"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
g527i.shbzek.com/images/bot-verification/bot.png
200 OK 11 kB URL HTTP/2 g527i.shbzek.com/images/bot-verification/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /images/bot-verification/bot.png HTTP/1.1
Host: g527i.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://g527i.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=9
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:03 GMT
content-type: image/png
content-length: 11043
last-modified: Wed, 01 Mar 2023 08:11:24 GMT
etag: "63ff08ac-2b23"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
ecrwqu.com/phtbload?a=1&e=aeyJwaWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTR9
200 OK 12 kB URL HTTP/2 ecrwqu.com/phtbload?a=1&e=aeyJwaWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTR9
IP
ASN #39572 DataWeb Global Group B.V.
Hash 44732fd605a50226169b110728926ce4
32468e347b9f2bed640b1b6b5de866dd0017cf9b
01c94b4f9ca2f4756bf8c26a075255cc8e3cacd7e1ac07333b891dc3c1d35eb4
GET /phtbload?a=1&e=aeyJwaWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTR9 HTTP/1.1
Host: ecrwqu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://g527i.shbzek.com/
Origin: https://g527i.shbzek.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 14 Mar 2023 10:15:03 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f0dc87a58ba19a5b03fc01a55b1540cc
5fb25b00cb76a8bd99e90009c0f7fbd6255b834a
4fd3fc8058d7a9f5b81d78af97ca3c6c30eedb96960fd2d7fcf988f21ff5055c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4FD3FC8058D7A9F5B81D78AF97CA3C6C30EEDB96960FD2D7FCF988F21FF5055C"
Last-Modified: Sun, 12 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18678
Expires: Tue, 14 Mar 2023 15:26:21 GMT
Date: Tue, 14 Mar 2023 10:15:03 GMT
Connection: keep-alive
s.viisaqyw.com/h/1524/noixsxfjvjoxtgoc7vbed67m43nyrzvlgb7co63fnbubi3lqji4zlreo5nttqcgmkpgefqjttleuhukrudxvbaci5gznnt73utzo4vm2heqism24u5fnhdos7ri4qsg3576ooshbkku6rj63wklm3knqjlyve6x6ka5aojuckrtymyycybfg32clndbfitvtmnmlqv4pw3xm6meejrhgtphck5j6asvds6vyktubkpwvnor3jdutn4o5rlavnwsqjaex6xqkmf3xgwdajnswocd4ladge53slbueyztbbr45snsxw5hxdwd5kbal6s3bt3w3kslr7kdhesrznfawuxbpvvutrekt7i4z7gj24zhipz2ysbkyjscbsmzxklbfc5qeszdflewvabthpvzaeykpgbtvulkza4yhq7srgimwezk5pnoqfvsnjluvfvhpva5nc2zg5ngvzvubicivbopbsifigtk422aubjcq62jobpfzyxy2jldzwzi3osabiyrd64kop4ptwjsxm4ouanzmeaisgebthvgcmr2fh4qwiudfh4adixlwbjjtwp3wk5ruay3ebjxruwzcfj3fazcjmnsqc4k6bjxho7cxnbggo5c3faovomjahemg2slbmqeg6cs5eu5xmul6jbsggctpbrfcekrzb4yricz3lr2auxbap55fczyzgbvqy6c3bm2x47afmundayqnf5paozrnfjlwohlgmyefgwbylr6hgudfjzsggc3zlirnxifuwhe7rqup6jeedmucu6iwiah436o3strrwl6mnbtkgdq6xcvcjiatc5cjip4vysf5kuiewwmvyshowz3kkjofgie7te5hna6nnf6suhopqj6o54ieovzgcudycr4jcgwwooqgof4oeaqb43lqlu4sm===?u=
200 OK 20 kB URL HTTP/2 s.viisaqyw.com/h/1524/noixsxfjvjoxtgoc7vbed67m43nyrzvlgb7co63fnbubi3lqji4zlreo5nttqcgmkpgefqjttleuhukrudxvbaci5gznnt73utzo4vm2heqism24u5fnhdos7ri4qsg3576ooshbkku6rj63wklm3knqjlyve6x6ka5aojuckrtymyycybfg32clndbfitvtmnmlqv4pw3xm6meejrhgtphck5j6asvds6vyktubkpwvnor3jdutn4o5rlavnwsqjaex6xqkmf3xgwdajnswocd4ladge53slbueyztbbr45snsxw5hxdwd5kbal6s3bt3w3kslr7kdhesrznfawuxbpvvutrekt7i4z7gj24zhipz2ysbkyjscbsmzxklbfc5qeszdflewvabthpvzaeykpgbtvulkza4yhq7srgimwezk5pnoqfvsnjluvfvhpva5nc2zg5ngvzvubicivbopbsifigtk422aubjcq62jobpfzyxy2jldzwzi3osabiyrd64kop4ptwjsxm4ouanzmeaisgebthvgcmr2fh4qwiudfh4adixlwbjjtwp3wk5ruay3ebjxruwzcfj3fazcjmnsqc4k6bjxho7cxnbggo5c3faovomjahemg2slbmqeg6cs5eu5xmul6jbsggctpbrfcekrzb4yricz3lr2auxbap55fczyzgbvqy6c3bm2x47afmundayqnf5paozrnfjlwohlgmyefgwbylr6hgudfjzsggc3zlirnxifuwhe7rqup6jeedmucu6iwiah436o3strrwl6mnbtkgdq6xcvcjiatc5cjip4vysf5kuiewwmvyshowz3kkjofgie7te5hna6nnf6suhopqj6o54ieovzgcudycr4jcgwwooqgof4oeaqb43lqlu4sm===?u=
IP
ASN #39572 DataWeb Global Group B.V.
Hash 5a6c6578a2049ef18d3733c8e7f73722
567fdeb00d04d4bfebb13c2e9900b74997a9fd5d
3ce1059e066c66367205ddff55fdf4da35f6ab3816beb85a4dc6f0434835c8eb
GET /h/1524/noixsxfjvjoxtgoc7vbed67m43nyrzvlgb7co63fnbubi3lqji4zlreo5nttqcgmkpgefqjttleuhukrudxvbaci5gznnt73utzo4vm2heqism24u5fnhdos7ri4qsg3576ooshbkku6rj63wklm3knqjlyve6x6ka5aojuckrtymyycybfg32clndbfitvtmnmlqv4pw3xm6meejrhgtphck5j6asvds6vyktubkpwvnor3jdutn4o5rlavnwsqjaex6xqkmf3xgwdajnswocd4ladge53slbueyztbbr45snsxw5hxdwd5kbal6s3bt3w3kslr7kdhesrznfawuxbpvvutrekt7i4z7gj24zhipz2ysbkyjscbsmzxklbfc5qeszdflewvabthpvzaeykpgbtvulkza4yhq7srgimwezk5pnoqfvsnjluvfvhpva5nc2zg5ngvzvubicivbopbsifigtk422aubjcq62jobpfzyxy2jldzwzi3osabiyrd64kop4ptwjsxm4ouanzmeaisgebthvgcmr2fh4qwiudfh4adixlwbjjtwp3wk5ruay3ebjxruwzcfj3fazcjmnsqc4k6bjxho7cxnbggo5c3faovomjahemg2slbmqeg6cs5eu5xmul6jbsggctpbrfcekrzb4yricz3lr2auxbap55fczyzgbvqy6c3bm2x47afmundayqnf5paozrnfjlwohlgmyefgwbylr6hgudfjzsggc3zlirnxifuwhe7rqup6jeedmucu6iwiah436o3strrwl6mnbtkgdq6xcvcjiatc5cjip4vysf5kuiewwmvyshowz3kkjofgie7te5hna6nnf6suhopqj6o54ieovzgcudycr4jcgwwooqgof4oeaqb43lqlu4sm===?u= HTTP/1.1
Host: s.viisaqyw.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://g527i.shbzek.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.19.0
date: Tue, 14 Mar 2023 10:15:04 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
accept-ch: Width, Viewport-Width, DPR, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
content-encoding: gzip
X-Firefox-Spdy: h2
alvsx.cloudpsh.top/?pl=ilQCmFnYrkuT1vv7YSUY4Q&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843
302 Found 0 B URL HTTP/2 alvsx.cloudpsh.top/?pl=ilQCmFnYrkuT1vv7YSUY4Q&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?pl=ilQCmFnYrkuT1vv7YSUY4Q&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843 HTTP/1.1
Host: alvsx.cloudpsh.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Tue, 14 Mar 2023 10:15:04 GMT
content-length: 0
location: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
set-cookie: ilQCmFnYrkuT1vv7YSUY4Q=19; max-age=345600; path=/; samesite=lax
__pl=b04111f7-ac78-4bd3-a40d-c088c9c6ce11; expires=Fri, 14 Mar 2025 10:15:04 GMT; path=/; samesite=lax
__cap=1; max-age=3600; path=/; samesite=lax
cache-control: max-age=0, no-cache, no-store, must-revalidate
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/thumb-big.jpg
200 OK 83 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/thumb-big.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1237x691, components 3\012- data
Hash cb5cedbae6d67e62dc9fde274b7f7dbe
f31d7811c4b6e50ae053f315152366501a8b6002
deaddba93625d2c7610076927fcd37afadad9324ca3210a2bb12784d313dd788
GET /ph-new/assets/thumb-big.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 82623
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-142bf"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/favicon.ico
204 No Content 0 B URL HTTP/2 new.lightfoot.top/favicon.ico
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
strict-transport-security: max-age=63072000
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-1.jpg
200 OK 14 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-1.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash b2abcc52b7bf315893f6751d5fc7875e
5997c599c5e6c408b9019159f4608026a78223cf
098b2a4c2b05fc238c6eae8654ea2a3bc9d5fac7c59cb420242d405fcc83ed47
GET /ph-new/assets/rec-1.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 14404
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-3844"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-2.jpg
200 OK 11 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-2.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash dbe1dba764a2ef20cf6760ad30539988
e14dca406d4f5932a9a4683635bbdf87def79eba
b0fe8ace388ec8556bcdd46cd30a03ddaadcf80d124e9052f2a19a27061829f7
GET /ph-new/assets/rec-2.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 10890
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-2a8a"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-3.jpg
200 OK 15 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-3.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash 4d58cecaa4f40c979917c8e4d907033f
f0c6d616bcc3f4bd5a1dadbca8254d9f34f2921c
9ee7f1aecdeb64f4ce54c5d0b7ea3d92b2e9d06a7f9cb7b793e39262cda05996
GET /ph-new/assets/rec-3.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 15217
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-3b71"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-4.jpg
200 OK 8.9 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-4.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash 8375f2a1249ce00f118c5b616ab71492
4e2d3bc095c01632578b0b39afbfc03f43e3fa42
f71320d61eb339fdb7b5d20249d4f6aa6e37e22e618dc83e8459da1db3f79483
GET /ph-new/assets/rec-4.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 8900
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-22c4"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-5.jpg
200 OK 13 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-5.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash f9ec603fbe19b12e8a8c1874eea3e5f2
0e24410f618ffa17dc6a9380a5b9a4c06dfba4a9
a77b6918c2799981aa1a09fc5f787ff109883093f2efd28beaf79031f5a8ac02
GET /ph-new/assets/rec-5.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 13149
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-335d"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-6.jpg
200 OK 16 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-6.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash 4887925f773d2ba9caea39686f764c7f
98c9abb09854fee425dbd78ad623af053cec6721
6e1e474a8fc326cd06593e0c1a55d0e73126ada3bf169713b847e82d28646773
GET /ph-new/assets/rec-6.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 15988
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-3e74"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-7.jpg
200 OK 14 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-7.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash f8af6bb4bdbbf2788da61a614e2f214e
d4a22a315356fcbc5f4a6af2d8a15e96721abddc
edb8c2bdc0f5612a5bf789af233ccaa63dd3751fbfaffb01be48e6e43e78b0bc
GET /ph-new/assets/rec-7.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 13963
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-368b"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/rec-8.jpg
200 OK 13 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/rec-8.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash eb826882457e1589d8a7d3b3499c4556
91284882dec199a9cc02ffa3ef3c86505159ce12
4fad6c5d1cd5bdb7eea1b216774e831a6e59a11ddcc8b0881747a4d278d86940
GET /ph-new/assets/rec-8.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 12992
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-32c0"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/1.jpg
200 OK 14 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/1.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash b2abcc52b7bf315893f6751d5fc7875e
5997c599c5e6c408b9019159f4608026a78223cf
098b2a4c2b05fc238c6eae8654ea2a3bc9d5fac7c59cb420242d405fcc83ed47
GET /ph-new/assets/1.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 14404
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-3844"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/2.jpg
200 OK 21 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/2.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash c3f3eb5d00c73ac19828309a4cde4e96
be66f4e10a00d90a0f8fdc0a5a4dbd19c143d97d
626b570f2ffdf83add77f51246ccb195fec4c15e4289173b8183cd47e7cfd763
GET /ph-new/assets/2.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 21253
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-5305"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/3.jpg
200 OK 11 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/3.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash 3f9b232e4a112a89dedcae34ff319dda
5c633886ceeaf3b1185e24253df6be39378c8e85
55fddecdb3ed8e536018523555d995f39f85304bbc00f65ab96472236b57a49a
GET /ph-new/assets/3.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 11094
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-2b56"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/4.jpg
200 OK 14 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/4.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash a4bef91e21afc13fed7f0bebcc6c4495
5dd2288d13e016a66fbe1f5605b2ed0fc3ad6326
44d3bf237a20f5d36a663aedd4a909a6118e6e35d6fe84971861f5638c070ecd
GET /ph-new/assets/4.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 13611
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-352b"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/5.jpg
200 OK 12 kB URL HTTP/2 new.lightfoot.top/ph-new/assets/5.jpg
IP
ASN #24940 Hetzner Online GmbH
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x180, components 3\012- data
Hash 113d196991f086fe21f82ee35286eddc
093b74a20c8902f13be1ee735f90a93e397227f9
34a3bc9a7aee67e35d57d4bb0bdccf08c3639da85d2421c58f6c4a92f5eee5e1
GET /ph-new/assets/5.jpg HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: image/jpeg
content-length: 11713
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
etag: "63b80e80-2dc1"
strict-transport-security: max-age=63072000
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1ab1166f7bff55b1cdb91995994a1bc5
ef8a50c62d70d195fcca8c3a4e2905b97a9b41c5
fc8701a961e1c852a157cdf72915c968d7768b8f4273839bec64d3265147b745
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 14 Mar 2023 10:15:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.gstatic.com/firebasejs/8.4.1/firebase-app.js
200 OK 6.8 kB URL HTTP/2 www.gstatic.com/firebasejs/8.4.1/firebase-app.js
IP
File type ASCII text, with very long lines (21158)
Hash cc9770d1cd023f5acf160f83840856fe
3b9c4a75943e3101e25a612ff975d03e9ef6f5ab
6b37f2d363f4b788f0b1473c7f51522bd85fe319ac39e7fb1c70aceaf35fe42e
GET /firebasejs/8.4.1/firebase-app.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 6763
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 10 Mar 2023 02:07:41 GMT
expires: Sat, 09 Mar 2024 02:07:41 GMT
cache-control: public, max-age=31536000
age: 374844
last-modified: Tue, 13 Apr 2021 06:56:11 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/firebasejs/8.4.1/firebase-messaging.js
200 OK 11 kB URL HTTP/2 www.gstatic.com/firebasejs/8.4.1/firebase-messaging.js
IP
File type ASCII text, with very long lines (40976)
Hash 65fc850cb32508517dcbc63b09aa7909
b6a0811a047ac43a061b326c424e57e3b125eaee
cb0497203016e7af18b3989110eaca26fed09c7c2e1ae0fda9a159b6784f69d5
GET /firebasejs/8.4.1/firebase-messaging.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 10908
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 10 Mar 2023 18:19:24 GMT
expires: Sat, 09 Mar 2024 18:19:24 GMT
cache-control: public, max-age=31536000
age: 316541
last-modified: Tue, 13 Apr 2021 06:56:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1ab1166f7bff55b1cdb91995994a1bc5
ef8a50c62d70d195fcca8c3a4e2905b97a9b41c5
fc8701a961e1c852a157cdf72915c968d7768b8f4273839bec64d3265147b745
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 14 Mar 2023 10:15:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
304 Not Modified 0 B URL HTTP/2 new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204 HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
If-Modified-Since: Mon, 13 Mar 2023 13:25:22 GMT
If-None-Match: W/"640f2442-f3ae"
TE: trailers
HTTP/2 304 Not Modified
server: nginx
date: Tue, 14 Mar 2023 10:15:06 GMT
last-modified: Mon, 13 Mar 2023 13:25:22 GMT
etag: "640f2442-f3ae"
strict-transport-security: max-age=63072000
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/assets/style.css
200 OK 0 B URL HTTP/2 new.lightfoot.top/ph-new/assets/style.css
IP
ASN #24940 Hetzner Online GmbH
GET /ph-new/assets/style.css HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: text/css
last-modified: Fri, 06 Jan 2023 12:05:20 GMT
vary: Accept-Encoding
etag: W/"63b80e80-5f33"
strict-transport-security: max-age=63072000
content-encoding: gzip
X-Firefox-Spdy: h2
js.pushssp.top/ps/pl.js
200 OK 0 B IP
ASN #24940 Hetzner Online GmbH
GET /ps/pl.js HTTP/1.1
Host: js.pushssp.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:05 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
X-Firefox-Spdy: h2
shbzek.com/gosl/InNpZCI6MTE5MDkxMSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=dreans02
302 Found 0 B URL HTTP/2 shbzek.com/gosl/InNpZCI6MTE5MDkxMSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=dreans02
IP
ASN #39572 DataWeb Global Group B.V.
GET /gosl/InNpZCI6MTE5MDkxMSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=dreans02 HTTP/1.1
Host: shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://come.sortyellowapples.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache
max-age: 0
location: https://shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&si2=
x-zone: eu4
X-Firefox-Spdy: h2
new.lightfoot.top/sw-806140cd3df78ab37111b9e7461888c3.js
200 OK 0 B URL HTTP/2 new.lightfoot.top/sw-806140cd3df78ab37111b9e7461888c3.js
IP
ASN #24940 Hetzner Online GmbH
GET /sw-806140cd3df78ab37111b9e7461888c3.js HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:06 GMT
content-type: application/javascript
last-modified: Thu, 17 Feb 2022 13:24:13 GMT
vary: Accept-Encoding
etag: W/"620e4c7d-954"
strict-transport-security: max-age=63072000
content-encoding: gzip
X-Firefox-Spdy: h2
js.pushssp.top/ps/pl.js
200 OK 0 B IP
ASN #24940 Hetzner Online GmbH
GET /ps/pl.js HTTP/1.1
Host: js.pushssp.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://new.lightfoot.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:06 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
X-Firefox-Spdy: h2
l1i8r.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=1
200 OK 0 B URL HTTP/2 l1i8r.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=1
IP
ASN #39572 DataWeb Global Group B.V.
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=1 HTTP/1.1
Host: l1i8r.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://shbzek.com/
Cookie: truniq=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:00 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
s.viisaqyw.com/cnt/api/index
200 OK 0 B URL HTTP/2 s.viisaqyw.com/cnt/api/index
IP
ASN #39572 DataWeb Global Group B.V.
POST /cnt/api/index HTTP/1.1
Host: s.viisaqyw.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 3052
Origin: https://s.viisaqyw.com
Connection: keep-alive
Referer: https://s.viisaqyw.com/h/1524/noixsxfjvjoxtgoc7vbed67m43nyrzvlgb7co63fnbubi3lqji4zlreo5nttqcgmkpgefqjttleuhukrudxvbaci5gznnt73utzo4vm2heqism24u5fnhdos7ri4qsg3576ooshbkku6rj63wklm3knqjlyve6x6ka5aojuckrtymyycybfg32clndbfitvtmnmlqv4pw3xm6meejrhgtphck5j6asvds6vyktubkpwvnor3jdutn4o5rlavnwsqjaex6xqkmf3xgwdajnswocd4ladge53slbueyztbbr45snsxw5hxdwd5kbal6s3bt3w3kslr7kdhesrznfawuxbpvvutrekt7i4z7gj24zhipz2ysbkyjscbsmzxklbfc5qeszdflewvabthpvzaeykpgbtvulkza4yhq7srgimwezk5pnoqfvsnjluvfvhpva5nc2zg5ngvzvubicivbopbsifigtk422aubjcq62jobpfzyxy2jldzwzi3osabiyrd64kop4ptwjsxm4ouanzmeaisgebthvgcmr2fh4qwiudfh4adixlwbjjtwp3wk5ruay3ebjxruwzcfj3fazcjmnsqc4k6bjxho7cxnbggo5c3faovomjahemg2slbmqeg6cs5eu5xmul6jbsggctpbrfcekrzb4yricz3lr2auxbap55fczyzgbvqy6c3bm2x47afmundayqnf5paozrnfjlwohlgmyefgwbylr6hgudfjzsggc3zlirnxifuwhe7rqup6jeedmucu6iwiah436o3strrwl6mnbtkgdq6xcvcjiatc5cjip4vysf5kuiewwmvyshowz3kkjofgie7te5hna6nnf6suhopqj6o54ieovzgcudycr4jcgwwooqgof4oeaqb43lqlu4sm===?u=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.19.0
date: Tue, 14 Mar 2023 10:15:04 GMT
content-type: application/json
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Cache-Control, Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-credentials: true
access-control-allow-origin: https://s.viisaqyw.com
content-encoding: gzip
X-Firefox-Spdy: h2
g527i.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=9
200 OK 0 B URL HTTP/2 g527i.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=9
IP
ASN #39572 DataWeb Global Group B.V.
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=9 HTTP/1.1
Host: g527i.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://y1h8d.shbzek.com/
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:03 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
fpvmy.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=5
200 OK 0 B URL HTTP/2 fpvmy.shbzek.com/bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=5
IP
ASN #39572 DataWeb Global Group B.V.
GET /bot-check-3?h=waWQiOjEwNTQwMzAsInNpZCI6MTE5MDkxMSwid2lkIjo0MzQzNTQsInNyYyI6Mn0=eyJ&si1=dreans02&i=5 HTTP/1.1
Host: fpvmy.shbzek.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t6ovb.shbzek.com/
Cookie: truniq=1; prompt=1; ufp2=23ebf14a4a15d73a28401d0ecfdbfd3d5b251a23
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Tue, 14 Mar 2023 10:15:02 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu4
content-encoding: gzip
X-Firefox-Spdy: h2
new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
200 OK 0 B URL HTTP/2 new.lightfoot.top/ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204
IP
ASN #24940 Hetzner Online GmbH
GET /ph-new/?pl=ilQCmFnYrkuT1vv7YSUY4Q&sm=ph-new&click_id=c5707fa53f01ad2d925dc7b1f94ebeff-42510-0314&sub_id=1417798788876843&hash=8A0y67d-hLytSOAGlDqliQ&exp=1678789204 HTTP/1.1
Host: new.lightfoot.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:15:04 GMT
content-type: text/html
last-modified: Mon, 13 Mar 2023 13:25:22 GMT
vary: Accept-Encoding
etag: W/"640f2442-f3ae"
strict-transport-security: max-age=63072000
content-encoding: gzip
X-Firefox-Spdy: h2
staging.camersoftware.com/wp-content/maintenance/assets/timer.js
200 OK 0 B URL HTTP/2 staging.camersoftware.com/wp-content/maintenance/assets/timer.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/maintenance/assets/timer.js HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:57 GMT
content-type: application/javascript
last-modified: Wed, 25 Jan 2023 23:00:59 GMT
etag: W/"63d1b4ab-502"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
staging.camersoftware.com/wp-content/maintenance/assets/styles.css
200 OK 0 B URL HTTP/2 staging.camersoftware.com/wp-content/maintenance/assets/styles.css
IP
GET /wp-content/maintenance/assets/styles.css HTTP/1.1
Host: staging.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://staging.camersoftware.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 14 Mar 2023 10:14:57 GMT
content-type: text/css
last-modified: Wed, 25 Jan 2023 23:00:59 GMT
etag: W/"63d1b4ab-b54"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
82.165.73.164
185.56.234.205
194.135.30.42
172.67.200.90
185.162.85.3
23.36.76.226
0.0.0.0