myeduwatch.com/
104.164.212.147301 Moved Permanently 0 B IP 104.164.212.147:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: myeduwatch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Location: http://www.myeduwatch.com/index.php
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash d27590a1d3cbe1e9632b8ae92aaae3f4
202b34e8a0c3b88c8826fd56c6227b34f2cd6f46
6bcfa518476658128c1fb4ea2435c4e58531454cf97138dce7ece9def589aead
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6BCFA518476658128C1FB4EA2435C4E58531454CF97138DCE7ECE9DEF589AEAD"
Last-Modified: Wed, 16 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6754
Expires: Fri, 18 Nov 2022 11:39:14 GMT
Date: Fri, 18 Nov 2022 09:46:40 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash be1be806b5dca7facbb45a6c3db44652
7ae9380a2f3eca959fe6ff6b3832a17cffd12cf4
1f3338058f8e9cae5c9fdd733c74564312726b01c6efdcd628d851d0c99876b0
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4091
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:40 GMT
Last-Modified: Fri, 18 Nov 2022 08:38:29 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 567df7db606cf5d0871aa5bc9311b6da
4263faac7cbab2fcaf6661911dcad5091c06be17
e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 18 Nov 2022 09:45:03 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 97
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 3a38b6dd8a4cc335c026aebf2ed348b6
8a386e0ccb0ca4dc502746c45b2ebc3aa3f83cf8
8b4040a645cec1841a00a22765eb3a74978559daf15c54bd4b41b6b48aab7f95
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8B4040A645CEC1841A00A22765EB3A74978559DAF15C54BD4B41B6B48AAB7F95"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4627
Expires: Fri, 18 Nov 2022 11:03:47 GMT
Date: Fri, 18 Nov 2022 09:46:40 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: Wtsei4UYq8e9G7E2SuimbNU5nZKxPTUS1PZijhzozVdJ3tlpDHVGB/iclBpGAZWXrQvMbB7UK/c=
x-amz-request-id: QWVM2PJAN4KJZ60K
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 18 Nov 2022 09:15:32 GMT
age: 1868
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 18 Nov 2022 09:46:40 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.myeduwatch.com/index.php
104.164.212.147200 OK 509 B URL HTTP/1.1 www.myeduwatch.com/index.php
IP 104.164.212.147:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ISO-8859 text, with very long lines (596), with CRLF line terminators
Hash 6240000d71f0d73eefbe44542931e1d9
353876a2990ebdec150fdaf755e63709cc440673
277daebee579ad17bafe6418ef4913dbac438e5dc6881345932e34b846386320
Analyzer Verdict Alert fortinet Phishing
GET /index.php HTTP/1.1
Host: www.myeduwatch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 18 Nov 2022 09:25:01 GMT
cache-control: public,max-age=3600
age: 1300
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
www.myeduwatch.com/common.js
104.164.212.147200 OK 1.0 kB URL HTTP/1.1 www.myeduwatch.com/common.js
IP 104.164.212.147:0
File type HTML document, ASCII text, with very long lines (389), with CRLF line terminators
Hash cdcb385fbfaf653bc3b0a437149af58a
721434917f151287a668b4f64cf8f7aca2b869ac
befa7bc1a6430a4cc6c2b73ad03e37cf5f9edfe92edb934d0426a21e140867bf
GET /common.js HTTP/1.1
Host: www.myeduwatch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.myeduwatch.com/index.php
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash c10055ce87434f700ff8b20e3be1f919
477b3c9f1da0c464282bb54572737e76b6e346da
4d78eb296876122e5ff40fcd7667adf1bf8a4b1ee4c8203c88a63ce8d7910a57
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3678
Cache-Control: max-age=87692
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:41 GMT
Etag: "6375f9af-1d7"
Expires: Sat, 19 Nov 2022 10:08:13 GMT
Last-Modified: Thu, 17 Nov 2022 09:06:55 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471
www.myeduwatch.com/tj.js
104.164.212.147200 OK 2.4 kB IP 104.164.212.147:0
File type HTML document, ASCII text, with very long lines (5068), with no line terminators
Hash b44b121544644439feedc23c4567466b
1a4dea1b99c82b685363da3904a498d81874ae53
18c35773d6fab4dab0d6b14ea7cb11ac0c3a23a783c1e31d04b53016320f9b22
GET /tj.js HTTP/1.1
Host: www.myeduwatch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.myeduwatch.com/index.php
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
push.services.mozilla.com/
35.161.6.128101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.161.6.128:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: YuhbcZCeR1EaYGhsuhDIgQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 3I0A8PMcyhOAjzT2S7+c77+tfs4=
www.myeduwatch.com/favicon.ico
104.164.212.147200 OK 1.2 kB URL HTTP/1.1 www.myeduwatch.com/favicon.ico
IP 104.164.212.147:0
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 7ef1f0a0093460fe46bb691578c07c95
2da3ffbbf4737ce4dae9488359de34034d1ebfbd
4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c
GET /favicon.ico HTTP/1.1
Host: www.myeduwatch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.myeduwatch.com/index.php
Cookie: __tins__21384351=%7B%22sid%22%3A%201668764799825%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201668766599825%7D; __51cke__=; __51laig__=1
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT
Connection: keep-alive
ETag: "4e0d81df-47e"
Expires: Wed, 23 Nov 2022 09:46:43 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes
www.znsndnng2rf4f4e.com/
154.212.145.14200 OK 4.1 kB IP 154.212.145.14:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text
Hash 52278c7202f6ba31fb39b86199b7c2de
d9ff2c60e8616d6d5c736fe375455ff6436caded
16b3787147627b7c9ba2b6ba4e68630ae62596ee38a70b506df48b95eddef334
Analyzer Verdict Alert quad9 Sinkholed
GET / HTTP/1.1
Host: www.znsndnng2rf4f4e.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.myeduwatch.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:41 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
www.znsndnng2rf4f4e.com/template/16/css/comment.css
154.212.145.14200 OK 3.0 kB URL HTTP/1.1 www.znsndnng2rf4f4e.com/template/16/css/comment.css
IP 154.212.145.14:0
Hash bdff844e926724b6d6cbaf5b4dad010d
c7a24dcf782db894c7bb2c77263262b152c64244
4dc1f8dc97d8a1a3fd3dd7853ec81239d676cdf6a7daf28a22e2935dac3e7df8
Analyzer Verdict Alert quad9 Sinkholed
GET /template/16/css/comment.css HTTP/1.1
Host: www.znsndnng2rf4f4e.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Type: text/css
Last-Modified: Mon, 07 Nov 2022 16:33:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63693350-2e22"
Expires: Fri, 18 Nov 2022 21:46:42 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
fmtu.netfhtu.com/upload/vod/2022/09/pxtrnzsevyn.jpg
104.21.235.63200 OK 7.6 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/pxtrnzsevyn.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 681e4851c9f18008e8c579c0b821a33e
cc75db4b5e2c4ccfb2ee7b8cd9652c16ef017a42
6e9c834079ad292424f8430618f2212e9c22625ce2dfe3daaaedebb15d0c8d9b
GET /upload/vod/2022/09/pxtrnzsevyn.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 7565
cf-bgj: h2pri
etag: "6311a419-1d8d"
last-modified: Fri, 02 Sep 2022 06:35:05 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7hCHFd5SU2FVJSbSr8%2BeTzXadkxC0f8NdBTJ%2FZhzS7ZUK7NSZBt3ilMVcoBMXXOUsepnTHiOcYkq9B4iTJgHEDMXuJQMNVcPiAT9auEsxzmdjc4ARpL1fumkfDwMdKSgJgB0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a047713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/0iggrhw1wzk.jpg
104.21.235.63200 OK 9.2 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/0iggrhw1wzk.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 6a7534b8d306943db4a4b3f74d60f8ef
3b441cb039c84490bdacfcd0df38f9250f0f532d
0b8389fea1a58592e00c803604f5c1ff98c5f9aa15779287bf145be2de050e1d
GET /upload/vod/2022/09/0iggrhw1wzk.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 9175
cf-bgj: h2pri
etag: "631ac933-23d7"
last-modified: Fri, 09 Sep 2022 05:03:47 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=83%2BCY9%2B0OTmbYYlNROe11bdi6KJvniGApRRfgLKT%2BEHUZv81%2Bf9lRgHJkLDM1i%2Bshrx4rJXynw8HCXMDyFNG2BRdPd60v9MVCMkQsDFwFUFC6V1u1oiWelIOTYGARVNcoYaN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a097713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/2xzbljcpqzz.jpg
104.21.235.63200 OK 10 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/2xzbljcpqzz.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 26d818fdfad46641f4b914d68264779a
8adddab787777d9503b71c33aee28a960f173258
5f55112b0db54738af6f277908f301bcbc6ff03133589458b63353e24267d1f1
GET /upload/vod/2022/09/2xzbljcpqzz.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 10115
cf-bgj: h2pri
etag: "6311a41b-2783"
last-modified: Fri, 02 Sep 2022 06:35:07 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FFWzdcQHujcdAurzyto90qe6JXZ9gKi9QA3iq6R8D%2B9Qy%2FxiAp2gLN0z7%2BuOph2DXLQ1INQ9tExq5V5p5qggs4nV6xLFLPcp%2Bli8DWnLNzMxOL8zvIqdwZKtdKo6l4w8wQaX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59d57713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/lbwtc2jhmvb.jpg
104.21.235.63200 OK 6.1 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/lbwtc2jhmvb.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 9b32ff57f2397cee226ed3f75d111728
723cf10678602c7b2454064633ac1765a4921aa7
0cc688cf416a786e1edbb399b55a0bc5c4749af605162fccaa8a3bb34d3545d9
GET /upload/vod/2022/09/lbwtc2jhmvb.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 6100
cf-bgj: h2pri
etag: "6322b942-17d4"
last-modified: Thu, 15 Sep 2022 05:33:54 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPyYdwtIqJG3kc9BdP9DPthyUvzVtLjSniqaBBbx2XpC3JXTD%2B0fgqLB1OTDxK9D7rn3SVLVO7Z9X9rDY67ksc6z5RDk048hfxT6rn%2Bk8Ace2ZxItgsLTHSTMBYV22fwCCfJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59e17713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/hv4xibegknd.jpg
104.21.235.63200 OK 8.9 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/hv4xibegknd.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash b60cf07d844293451788de8674277089
5884120955beccecb85083118c5e37f877c66da8
3b75f0ca57edf75d395eaa4e9469599ac3df441cdc4016ce87ed5ef505cd3962
GET /upload/vod/2022/09/hv4xibegknd.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 8927
cf-bgj: h2pri
etag: "63215d79-22df"
last-modified: Wed, 14 Sep 2022 04:50:01 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h1GB5I4NCJ%2B6JKnuPJkEslHFm5q6trn5FZU6bZaYdN1ZmIODAxQB%2BwlgW5RmmfyTJZgiiw%2FqpPEY1ygjvfRZQD95kBuFTPFrnzXjHmPJUCoSTjPMdcIvvIYS9fWtsfVdv%2FxN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a057713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/kqpmdegqqg5.jpg
104.21.235.63200 OK 9.1 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/kqpmdegqqg5.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 6565f5b4bb32391da35bf4c69ba15c7c
0d445f61fdd65e74f23811033d38f217e4eb8773
75af998e585bea7bbca7ba5f3323220f0f90948cae001ae6f4ecb1d07858b2c3
GET /upload/vod/2022/09/kqpmdegqqg5.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 9124
cf-bgj: h2pri
etag: "6322b941-23a4"
last-modified: Thu, 15 Sep 2022 05:33:53 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QK7byxt1rNE7YFZ%2BJwTEX7bUfZiFP%2BMNAhG7q65xrLQonCUtIf8fz2reIwgF7B19YgFmY3wj1xMRxFQqrzjCTlukBxDOuIKZKmfoAFPxfJvwZ9SUBXsgqzdUDlVCUU01ay0I"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59e07713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/10/cxhir0gz3sz.jpg
104.21.235.63200 OK 8.1 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/10/cxhir0gz3sz.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash f93df616f671a8bbea0388ef35e5d68a
75f4e4b37d52b0346910d12be131e319889121ac
353cad888cf8de03e77a55610798c29336a18ff09488e4415c426ac29760b463
GET /upload/vod/2022/10/cxhir0gz3sz.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 8087
cf-bgj: h2pri
etag: "633a7aa6-1f97"
last-modified: Mon, 03 Oct 2022 06:01:10 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V2prc4LO15Pj2NhP%2Bc81H2%2B9qK4bhMK7yiAxxBgfv8uczb%2BwrsUXlol8a4o7jTTDKsYwnAJ%2F%2F8BD8zGPlb8wovK6u33%2FQvVHHE1FjT%2FGgURZHCpDdmAH0WXFFAt7SOutsOTT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59db7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/10/rln0m5x4gmg.jpg
104.21.235.63200 OK 10 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/10/rln0m5x4gmg.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 7ffd12fab08fc8f7f77eafeae4dad026
9390fb1790f570d62653a54c9dcfb52eead9ffda
eda52b04414a33633bb9805b4e5b108fe62c7ba2ccead905ee219da516c99d07
GET /upload/vod/2022/10/rln0m5x4gmg.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 10180
cf-bgj: h2pri
etag: "633a7aa4-27c4"
last-modified: Mon, 03 Oct 2022 06:01:08 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ow%2B9S6i52BdnNsDr%2FHxGHRypvDURfgqX789VTVt1wlq49GCMgCD9M%2FrW2wG7Bkc4nOFD7Lzi8g8gWYF4FG4XfOL0GaG%2BcOEWL7PFnEgeMrSHSNrgjkubHhN06TVYX3vLqJoc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59da7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/10/dp0enkko3z5.jpg
104.21.235.63200 OK 9.2 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/10/dp0enkko3z5.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash f581760d8c26bbabd472eefc43f64895
69b327c052e23f2628a6423fc9ed37193fcc69bc
6829884474991d964ce8fd3123ce9a06af505caadc06ccfd9a709b8f06cf1e7f
GET /upload/vod/2022/10/dp0enkko3z5.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 9156
cf-bgj: h2pri
etag: "633a7aa7-23c4"
last-modified: Mon, 03 Oct 2022 06:01:11 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DOeyQefWnXm0zrSt2ihkVDLcM6UToyENKR%2FQrjmM9Yk70d%2BwcZRNWoTSwou0z3CiPLN2U61B4IDpr3kO3cIn9y%2FS9IOymWeSub6sXF5bXEw4MuOOfrMI6F0VXUk3x31dQAFO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a0c7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/10/bhcnz2h0c3j.jpg
104.21.235.63200 OK 9.4 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/10/bhcnz2h0c3j.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash c362dc83f4cd41c7a61f300c2fcaabb3
1407fbb3fe02f5b00d1b708a8bcb151e01d3acc7
3548bed124e93b686bfd2c46b0f75ca30d39c9e8a11af62c13f9b8141b3e0bdf
GET /upload/vod/2022/10/bhcnz2h0c3j.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 9446
cf-bgj: h2pri
etag: "633a7aa5-24e6"
last-modified: Mon, 03 Oct 2022 06:01:09 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mDPjLPmVOnjgq36Fsb7gaN63BmopNXaDdseO8KoU8VvPYN6iOCHGe88KNjjk1luUqJbtnwIjtRHD7mC5mg23q%2F9GHTCJQGAPokF0yRgs9uadXSdG4QhJSlA4tMCyiSGPZjAt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59d67713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/rrw0h3gijt0.jpg
104.21.235.63200 OK 8.7 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/rrw0h3gijt0.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash ce8f7380fb0e9a86306cca42764ac019
1145fbe448a6d0fe78c3df0e7665e43f834aad88
b32f9adf69287e9231290833e9bb5ec1b89b2d58cf145fba700e1fcf4637b0c1
GET /upload/vod/2022/09/rrw0h3gijt0.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 8661
cf-bgj: h2pri
etag: "6322b940-21d5"
last-modified: Thu, 15 Sep 2022 05:33:52 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TldS0zwYcNCsi32DQstPUQ90xselHSPRY%2BObsq8Kh1voxAcE6nim170Ynrr59XzuE9eCO90jMnSzYVwzKrW0s26i4oEx8Xb7yLmebeKkJCzf9KmI%2FPkivNqmU%2FBmmLrj3Yyk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59de7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/4oxwqgztqcj.jpg
104.21.235.63200 OK 5.6 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/4oxwqgztqcj.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash ef29120b4b53fe5f211425421f2f8b66
e5a3d30354effa3c98a1a49c0c08995dedecf6a2
c7db2e3e9bdbf5ab3c3e6b951281613e528fe8bf5a0b1f7d2dc70a9d3845ab9c
GET /upload/vod/2022/09/4oxwqgztqcj.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 5630
cf-bgj: h2pri
etag: "6322b944-15fe"
last-modified: Thu, 15 Sep 2022 05:33:56 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DvAlL3mdHzHu%2BkBDsh7B32nGcIIcqhIXfYmj4t%2BOx9PZ90%2FFw6CXkeTPerGnVMJS0ZGd8z7rXWoROoWo32H%2FK3m%2B4V68D3gAS4vScgiHh8fs3LiV7wFUjOAOlzel9Zl26%2FPn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce69fd7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/zuqfucurtqg.jpg
104.21.235.63200 OK 10 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/zuqfucurtqg.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 24068bb2c4a202275043c3e3a6d4b6cb
aa12ce68cbf9f6ff09fd78aa305005a79e446a1a
a655102444f7e611c8729e6610467e39e6e408613f64bf4e1ae11f7bb8aafc78
GET /upload/vod/2022/09/zuqfucurtqg.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 10542
cf-bgj: h2pri
etag: "6311a41a-292e"
last-modified: Fri, 02 Sep 2022 06:35:06 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 5816
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ffzOE0IKNxQIpbVOAGSZ0zVN37xO5yMfr5XlTVwcYFhaB0ya8LqkyaMbDYzlGakqJzvAJ3GbRJyTrFRiEZL3MSCcN8bcgXybSR2%2FOQC3mozt1y9m%2Fztui1MnoqiP7SVrfUYB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a017713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/hgfv5wirhg3.jpg
104.21.235.63200 OK 7.8 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/hgfv5wirhg3.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 44753b1258bc6b887a2a24a6cef09d9b
76e468eb2c1b7a4684b66f23b5b42bc190bfd2e4
874006d1c7e24cb5ee60e2c90b96f06a1d037520db0e61c96135f7cb70f3ec53
GET /upload/vod/2022/09/hgfv5wirhg3.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 7835
cf-bgj: h2pri
etag: "63215d73-1e9b"
last-modified: Wed, 14 Sep 2022 04:49:55 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivdcXJTXm4mPA3ZYQG3QWbBlMcKPH9t90BPFQ0x54gVO9FSa%2Blv%2BeKe9BtgXRbnuEnHXaQyT0Oimu3oqFGifKELCtJzFqypQPZ2De%2B9ZJuMYK2hh84MA5bMhHyYB2Ymruzcg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a0a7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/ovnzrgmwl0v.jpg
104.21.235.63200 OK 7.1 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/ovnzrgmwl0v.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 2b9352577dab4256259b81719668a97a
10ad7d5aa443ecbb4fa56691a3b7bedda18e9845
fd3eb23634ed229d8e61c0ef57447535333cfe098d5560c09890c945de400176
GET /upload/vod/2022/09/ovnzrgmwl0v.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 7133
cf-bgj: h2pri
etag: "6322b945-1bdd"
last-modified: Thu, 15 Sep 2022 05:33:57 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3tFNVVZysM6zvZvds9VniEz6lt%2FBEGY1EuLHT51MR2uNSyNZboIsaeOLzsu%2BbDFOm6YMNw5Y%2FG2zVQBkLIzrqBs6A%2Bdf%2BTMw4JQ%2FpabDDLfKRZhBmJfqpmwjXiygwpO00wo8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce69f97713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/x4jbtl4kwn2.jpg
104.21.235.63200 OK 9.2 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/x4jbtl4kwn2.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 60246105699e24936d013078e3869aa3
ffaefe2c1f51195233a99695de37447513809906
03c8abc83450ac5025707775430a5ecabd97e19dfbd12c8dd671d30eea5cb21d
GET /upload/vod/2022/09/x4jbtl4kwn2.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 9221
cf-bgj: h2pri
etag: "63215d7a-2405"
last-modified: Wed, 14 Sep 2022 04:50:02 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NS6qInc8anOz9bG8Y1TQCUTT2EbRBCwqiqhjiN5C%2Fn1jpQLyiNC4xSuBEiwhU7pLFOySY6QxFpYICp2nxqtJbIiH%2BiAjqE9eTH36YvUnhFVxgZEFgtc6KFqDooA5thC64WCP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a087713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/33ss1kl1mtb.jpg
104.21.235.63200 OK 12 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/33ss1kl1mtb.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 6d2737557c5323d3f634a6643be9d708
f0b1257d56cacd61dbe64780b5138a25bdffa7e0
72453d17df461be7fc8d38820294200d9d1e19fa4fe72e389fb03c4d7a3b3cab
GET /upload/vod/2022/09/33ss1kl1mtb.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 12014
cf-bgj: h2pri
etag: "63215d78-2eee"
last-modified: Wed, 14 Sep 2022 04:50:00 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZnHIXxtPGcvkKWtmYw%2Bc%2B%2FFqIhapSmCdiqiq%2BMi5j7CG0K%2BI92QC1DheVZ7sV5bwl4BW4%2F9EtgAzbxn4wwaZS4kdP9j5I1KSjDGL410ajVlOZySwM62ZAQ0YBHFHIgwE6H%2Fh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a0b7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/fzifp50yrn2.jpg
104.21.235.63200 OK 6.6 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/fzifp50yrn2.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash a3f8d7a1053fc7644381d076fa7d7e30
35da33e73d7a88c5106d0106057192d7f384c7b5
d26859adbffff48bba1ac6f2ebacecf956f9c1c1de4acfc256f07c07e5025452
GET /upload/vod/2022/09/fzifp50yrn2.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 6606
cf-bgj: h2pri
etag: "6311a41c-19ce"
last-modified: Fri, 02 Sep 2022 06:35:08 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4WYkB3EKDU%2Fy738m%2F3jSmDymjovFscoN37HFwzh7K%2FmS%2Bk9m94cj6Zx1sieevhptrEBB%2FREht3mm8J5JmsFFL%2F9xuc4xko5qA%2FP6%2FqWtiHwSYsAvfPKetlXayVZgg20QIXaB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a0f7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/09/h5ie5kfz2d5.jpg
104.21.235.63200 OK 8.5 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/09/h5ie5kfz2d5.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 12ec03ad382036377e2afd83822f2caf
714805c135b5ac5e2959af130d8c4b9163ca27c8
317b275ad2eabe40816e903f885682a98ba6c4499254c5b1d29d18dc65457825
GET /upload/vod/2022/09/h5ie5kfz2d5.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 8529
cf-bgj: h2pri
etag: "63215d79-2151"
last-modified: Wed, 14 Sep 2022 04:50:01 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4648
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=20scie74QsKHIPWpspxlsPalEKLEOiCYFK3YG%2BeA3Ehf8Yv%2Bx%2FrrQ7eanBkvgNXaAxvCULykJX5oTOL0Z8hQ%2FfCjASiluK%2FYtfn7Fp6bOViXg8NX2SEyeFnAOcFzT17OVmCk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce6a0d7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ia.51.la/go1?id=21384351&rt=1668764799825&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E4%25B8%2580%25E7%25BA%25A7%25E6%25AF%259B%25E7%2589%2587%25E7%25BE%258E%25E5%25A5%25B3%25E6%25AC%25A7%25E6%25B4%25B2%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%25B2%25BE%25E5%2593%2581%25E4%25BA%259A%25E6%25B4%25B2%25E7%25BD%2591%25E7%25AB%2599%252C%25E5%259B%25BD%25E4%25BA%25A7%25E7%25B2%25BE%25E5%2593%2581%25E7%259B%25B4%25E6%2592%25AD%252C99re%25E5%259C%25A8&ing=1&ekc=&sid=1668764799825&tt=%25E6%25B5%25B7%25E5%25AE%2589%25E5%259D%259F%25E7%25A7%2581%25E7%2594%25B5%25E5%25AD%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=%25E4%25B8%2580%25E7%25BA%25A7%25E6%25AF%259B%25E7%2589%2587%25E7%25BE%258E%25E5%25A5%25B3%25E6%25AC%25A7%25E6%25B4%25B2%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%25B2%25BE%25E5%2593%2581%25E4%25BA%259A%25E6%25B4%25B2%25E7%25BD%2591%25E7%25AB%2599%252C%25E5%259B%25BD%25E4%25BA%25A7%25E7%25B2%25BE%25E5%2593%2581%25E7%259B%25B4%25E6%2592%25AD%252C99re%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2586%25E9%25A2%2591%252C%25E6%2580%25A7%25E7%258C%259B%25E6%25AC%25A7%25E7%25BE%258Exxxxbbbb%252C%25E6%2597%25A5%25E6%259C%25AC%25E5%2590%258C%25E5%25BF%2597gay%25E7%2589%2587%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2582%25E7%259C%258B%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%2594%25B7%25E5%2590%258C%25E6%2580%25A7%25E6%2581%258Bvideos%252C%25E7%25BE%258E%25E5%259B%25BD%25E4%25B8%2580%25E7%25BA%25A7%25E6%2583%2585%25E6%25AC%25B2%25E7%2589%2587&cu=http%253A%252F%252Fwww.myeduwatch.com%252Findex.php&pu=
103.143.19.103200 0 B URL HTTP/1.1 ia.51.la/go1?id=21384351&rt=1668764799825&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E4%25B8%2580%25E7%25BA%25A7%25E6%25AF%259B%25E7%2589%2587%25E7%25BE%258E%25E5%25A5%25B3%25E6%25AC%25A7%25E6%25B4%25B2%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%25B2%25BE%25E5%2593%2581%25E4%25BA%259A%25E6%25B4%25B2%25E7%25BD%2591%25E7%25AB%2599%252C%25E5%259B%25BD%25E4%25BA%25A7%25E7%25B2%25BE%25E5%2593%2581%25E7%259B%25B4%25E6%2592%25AD%252C99re%25E5%259C%25A8&ing=1&ekc=&sid=1668764799825&tt=%25E6%25B5%25B7%25E5%25AE%2589%25E5%259D%259F%25E7%25A7%2581%25E7%2594%25B5%25E5%25AD%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=%25E4%25B8%2580%25E7%25BA%25A7%25E6%25AF%259B%25E7%2589%2587%25E7%25BE%258E%25E5%25A5%25B3%25E6%25AC%25A7%25E6%25B4%25B2%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%25B2%25BE%25E5%2593%2581%25E4%25BA%259A%25E6%25B4%25B2%25E7%25BD%2591%25E7%25AB%2599%252C%25E5%259B%25BD%25E4%25BA%25A7%25E7%25B2%25BE%25E5%2593%2581%25E7%259B%25B4%25E6%2592%25AD%252C99re%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2586%25E9%25A2%2591%252C%25E6%2580%25A7%25E7%258C%259B%25E6%25AC%25A7%25E7%25BE%258Exxxxbbbb%252C%25E6%2597%25A5%25E6%259C%25AC%25E5%2590%258C%25E5%25BF%2597gay%25E7%2589%2587%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2582%25E7%259C%258B%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%2594%25B7%25E5%2590%258C%25E6%2580%25A7%25E6%2581%258Bvideos%252C%25E7%25BE%258E%25E5%259B%25BD%25E4%25B8%2580%25E7%25BA%25A7%25E6%2583%2585%25E6%25AC%25B2%25E7%2589%2587&cu=http%253A%252F%252Fwww.myeduwatch.com%252Findex.php&pu=
IP 103.143.19.103:0
ASN #4837 CHINA UNICOM China169 Backbone
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go1?id=21384351&rt=1668764799825&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E4%25B8%2580%25E7%25BA%25A7%25E6%25AF%259B%25E7%2589%2587%25E7%25BE%258E%25E5%25A5%25B3%25E6%25AC%25A7%25E6%25B4%25B2%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%25B2%25BE%25E5%2593%2581%25E4%25BA%259A%25E6%25B4%25B2%25E7%25BD%2591%25E7%25AB%2599%252C%25E5%259B%25BD%25E4%25BA%25A7%25E7%25B2%25BE%25E5%2593%2581%25E7%259B%25B4%25E6%2592%25AD%252C99re%25E5%259C%25A8&ing=1&ekc=&sid=1668764799825&tt=%25E6%25B5%25B7%25E5%25AE%2589%25E5%259D%259F%25E7%25A7%2581%25E7%2594%25B5%25E5%25AD%2590%25E6%259C%2589%25E9%2599%2590%25E5%2585%25AC%25E5%258F%25B8&kw=%25E4%25B8%2580%25E7%25BA%25A7%25E6%25AF%259B%25E7%2589%2587%25E7%25BE%258E%25E5%25A5%25B3%25E6%25AC%25A7%25E6%25B4%25B2%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%25B2%25BE%25E5%2593%2581%25E4%25BA%259A%25E6%25B4%25B2%25E7%25BD%2591%25E7%25AB%2599%252C%25E5%259B%25BD%25E4%25BA%25A7%25E7%25B2%25BE%25E5%2593%2581%25E7%259B%25B4%25E6%2592%25AD%252C99re%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2586%25E9%25A2%2591%252C%25E6%2580%25A7%25E7%258C%259B%25E6%25AC%25A7%25E7%25BE%258Exxxxbbbb%252C%25E6%2597%25A5%25E6%259C%25AC%25E5%2590%258C%25E5%25BF%2597gay%25E7%2589%2587%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2582%25E7%259C%258B%252C%25E6%25AC%25A7%25E7%25BE%258E%25E7%2594%25B7%25E5%2590%258C%25E6%2580%25A7%25E6%2581%258Bvideos%252C%25E7%25BE%258E%25E5%259B%25BD%25E4%25B8%2580%25E7%25BA%25A7%25E6%2583%2585%25E6%25AC%25B2%25E7%2589%2587&cu=http%253A%252F%252Fwww.myeduwatch.com%252Findex.php&pu= HTTP/1.1
Host: ia.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.myeduwatch.com/
HTTP/1.1 200
Server: CloudWAF
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=a5c8df9afcab5e1c878; path=/
HWWAFSESTIME=1668764798194; path=/
kkguangao0.com/top/shang.js
154.212.145.9200 OK 767 B URL HTTP/1.1 kkguangao0.com/top/shang.js
IP 154.212.145.9:0
File type HTML document, ASCII text
Hash b22ea6098fcfee87896cf6859b7a02bc
6bff29ec643696f33647886ae881e3692ae90313
905f1325cf42584fc44f3f8a864ebc49c2172ba1d949d6407c2199dcf838d264
GET /top/shang.js HTTP/1.1
Host: kkguangao0.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Type: application/javascript
Last-Modified: Thu, 17 Nov 2022 22:07:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6376b09b-a57"
Expires: Fri, 18 Nov 2022 21:46:42 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
kkguangao0.com/top/zhong.js
154.212.145.9200 OK 405 B URL HTTP/1.1 kkguangao0.com/top/zhong.js
IP 154.212.145.9:0
File type HTML document, ASCII text, with CRLF line terminators
Hash d3a96e540367bbdc29c8fe33c3c9e3cb
e994b57a8a1d4e7420f9cff82c47f64b80416044
09b1e7b5fc2a866a90536a80bb95272772ce39724250f95ffafba6233b3fb8a8
GET /top/zhong.js HTTP/1.1
Host: kkguangao0.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Type: application/javascript
Content-Length: 405
Last-Modified: Tue, 08 Nov 2022 19:42:21 GMT
Connection: keep-alive
ETag: "636ab11d-195"
Expires: Fri, 18 Nov 2022 21:46:42 GMT
Cache-Control: max-age=43200
Accept-Ranges: bytes
ak-d.tripcdn.com/images/0Z01t2215cyparbxc8012.gif
96.6.16.143200 OK 1.4 MB URL HTTP/2 ak-d.tripcdn.com/images/0Z01t2215cyparbxc8012.gif
IP 96.6.16.143:0
File type GIF image data, version 89a, 960 x 240\012- data
Size 1.4 MB (1369097 bytes)
Hash 328c8d1c235a2191ea073d29ff1e131b
4bb53374e8d7604be8c3627b0ed1d57f0749c39b
bef0d5038e32ecdeb1f1ae632115b53f2e23649d6d271e7fb96f45a3a517337f
GET /images/0Z01t2215cyparbxc8012.gif HTTP/1.1
Host: ak-d.tripcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 1369097
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=7186865
expires: Thu, 09 Feb 2023 14:07:47 GMT
date: Fri, 18 Nov 2022 09:46:42 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
fmtu.netfhtu.com/upload/vod/2022/10/jfe2prizopx.jpg
104.21.235.63200 OK 5.9 kB URL HTTP/2 fmtu.netfhtu.com/upload/vod/2022/10/jfe2prizopx.jpg
IP 104.21.235.63:0
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 4x3, segment length 16, comment: "Lavc57.89.100", baseline, precision 8, 320x240, components 3\012- data
Hash 26e59102604fead637d2a3fdbd569553
1921c8c30613949392d179752748354986b24247
6c5d65d99e3eb543077896846348519b07a72d8909c50fb2c8bdf955f1924d47
GET /upload/vod/2022/10/jfe2prizopx.jpg HTTP/1.1
Host: fmtu.netfhtu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:42 GMT
content-type: image/jpeg
content-length: 5855
cf-bgj: h2pri
etag: "633a7abe-16df"
last-modified: Mon, 03 Oct 2022 06:01:34 GMT
cache-control: max-age=31536000
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2BPCWHWGvIOgI5Qvxbhy7lNvmqyD19JMzWQlGRf9oMcvngfzTEmjL3WkprusutimiBwne3UzN22N%2B7bb4%2FdthABLJEo42sKUyQwQfavIDvfEz9Qc4%2FJCLY9pjalghf3vd3Uy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7ce59dd7713-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash ea8d348a480c41e7c6b4435992b06eec
aa511ad72ec91db7490f0a1fa4fd7f6cbb34fa88
557312155d0c8f53aff8e7bdbbbbd15203ac51d2d41bd03e1bbc18c20ddcfb7a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "557312155D0C8F53AFF8E7BDBBBBD15203AC51D2D41BD03E1BBC18C20DDCFB7A"
Last-Modified: Wed, 16 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21199
Expires: Fri, 18 Nov 2022 15:40:01 GMT
Date: Fri, 18 Nov 2022 09:46:42 GMT
Connection: keep-alive
ocsp.globalsign.com/gsgccr3dvtlsca2020
104.18.21.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsgccr3dvtlsca2020
IP 104.18.21.226:0
Hash 0ebda37ef50bd1b4bd6a70f7749a1ab2
97d14dce6541e799fcca17763ecab51a373187ed
6eb2d3692ce56b5d7c57d6663ed8965ba562c47ba506508e0f0adca7c2333f68
POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:42 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Tue, 22 Nov 2022 06:38:34 GMT
ETag: "97d14dce6541e799fcca17763ecab51a373187ed"
Last-Modified: Fri, 18 Nov 2022 06:38:35 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 758
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76bfc7d13bd7b523-OSL
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3914
Expires: Fri, 18 Nov 2022 10:51:56 GMT
Date: Fri, 18 Nov 2022 09:46:42 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3914
Expires: Fri, 18 Nov 2022 10:51:56 GMT
Date: Fri, 18 Nov 2022 09:46:42 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3914
Expires: Fri, 18 Nov 2022 10:51:56 GMT
Date: Fri, 18 Nov 2022 09:46:42 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1d9d6315-de31-43b3-8c19-dc3528c7eefe.jpeg
34.120.237.76200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1d9d6315-de31-43b3-8c19-dc3528c7eefe.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 158a07cdb0174c0cf0c2473cb069a459
46753b0476f8a272a047b07070db272a0fd3b42e
40bacc15755d920085e52af0bc9f6e8eac0379a31765f6ba72cf53546e296a2e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1d9d6315-de31-43b3-8c19-dc3528c7eefe.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5917
x-amzn-requestid: 47ec37aa-10ef-4e35-a76c-301d34e4a102
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw9VaHt9oAMFpIg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376a8ef-6eb9776b4df9facd0f19c974;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:34:39 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: qReov2_mDTOantzcbI8dBALwKBsq58MGL2yHuJwk0DxNL7um6T_M1g==
via: 1.1 76dcc62b68091cc715d50b5017be77fc.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:55:57 GMT
age: 42645
etag: "46753b0476f8a272a047b07070db272a0fd3b42e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg
34.120.237.76200 OK 3.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5d0b6106f00f9fd8b89c2d484a559a1a
399ac393209dcdac7d2188d7aa8d95f04570ef7c
5d8151c9eb558f4a2b8bd2952c6845606ddb0c27e36f6e49aca7e60908cd9fe4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3759
x-amzn-requestid: 8c91ac59-89dc-4218-b69f-0cebb29f301b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-wJHgxoAMF-hQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab33-4dac305614a92bc52c038222;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:44:19 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Mb2-PTjNmt06Wd5jOjQ5WoLY-0NgI80CKPXtwgzBt4n5km8Pu_WN0Q==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 22:08:54 GMT
age: 41868
etag: "399ac393209dcdac7d2188d7aa8d95f04570ef7c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd2b71261-68cc-40d8-9fce-033095c5889d.jpeg
34.120.237.76200 OK 9.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd2b71261-68cc-40d8-9fce-033095c5889d.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f22c78eb5d83b4a108e0fff0806ff1a1
7e246b0b4697140ae7429aeff92aa16ab88dd6f6
1afadc1fb89b5a321e067893609c154b6d7dbd39123d15883c799aab6214cd4a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd2b71261-68cc-40d8-9fce-033095c5889d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9661
x-amzn-requestid: dcff71d8-a6ac-45f2-acc1-e14314334495
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-7RHGAIAMFSOA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab7b-3598a746247615de161878e3;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:45:31 GMT
x-amz-cf-pop: SEA73-P2, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nNm3mly0cy8etL6Tg2gC2jpSc37d77L8rNny7C5fSTG2jn4zRo04lg==
via: 1.1 bd6f70221217681265382902c6157c76.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:49:45 GMT
age: 43017
etag: "7e246b0b4697140ae7429aeff92aa16ab88dd6f6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84053cb2-edec-465e-8700-6af61bae8236.jpeg
34.120.237.76200 OK 8.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84053cb2-edec-465e-8700-6af61bae8236.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 676b1603008690786aa36dc3113b7581
cbdc425467a5d41aba5e8e5c54354b4f03cd194a
7e5e7bf695ff31df6c97e502a44f4fa9197c6579b0c7a7c590457ea067d1cf1e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84053cb2-edec-465e-8700-6af61bae8236.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8155
x-amzn-requestid: 5650af50-eb93-47d9-8322-8a2e263e12ea
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-7vFU5IAMFYGw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab7e-759bbd5b5a22e07c1c181c0a;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:45:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XzJcm_AlMH4hb2urV7RORAjz7LR7NXZ2pAMEhx1foW2VJgj4mxVxJw==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 22:05:52 GMT
age: 42050
etag: "cbdc425467a5d41aba5e8e5c54354b4f03cd194a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57ba71d8-c0f3-4d43-a49a-3576bdcfb322.jpeg
34.120.237.76200 OK 4.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57ba71d8-c0f3-4d43-a49a-3576bdcfb322.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 292dc2edef978e128f70b96ee4b2b3e2
1530f860e2b54b7b382f59654db63eaed59c5f95
f74b08f1bdd35ea7ebb6e2887fc6c02abc76f9e276cd30d1d7d6475e667b5624
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57ba71d8-c0f3-4d43-a49a-3576bdcfb322.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4310
x-amzn-requestid: 6452483a-f96e-4f27-a18e-55e9206e7be6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-78FiToAMFQag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab7f-4e366d3612f39c5c421e864e;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:45:35 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: C8hVBVyCgsK-mT6_PXr68AjfNsNPGqD_TWBEwNlyY_Nur_RgB5aE3w==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 22:42:15 GMT
age: 39867
etag: "1530f860e2b54b7b382f59654db63eaed59c5f95"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cd5bdc050716bb76afe8090fc81617e7
5109c156b180727767fc03c411190ccc0d3fb5fc
9b13e7838946c6654dda17886c2ca8d42de934acb93f4bddb1008dfa1bd1ea99
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11715
x-amzn-requestid: 20e508bd-6568-4225-9bee-c683a49d44f6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhUHkpIAMFfJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-7dc726b94a37fc667e2e6646;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: X3SUo1LP97TxraRav0ftskBhzWkTJInHaS44PW26yloF-dgD-bHBuA==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 00:26:57 GMT
age: 33585
etag: "5109c156b180727767fc03c411190ccc0d3fb5fc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
api.share.baidu.com/s.gif?l=http://www.myeduwatch.com/index.php
182.61.240.101200 OK 0 B URL HTTP/1.1 api.share.baidu.com/s.gif?l=http://www.myeduwatch.com/index.php
IP 182.61.240.101:0
ASN #38365 Beijing Baidu Netcom Science and Technology Co., Ltd.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s.gif?l=http://www.myeduwatch.com/index.php HTTP/1.1
Host: api.share.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.myeduwatch.com/
HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Fri, 18 Nov 2022 09:46:42 GMT
dimg04.c-ctrip.com/images/0Z05r12000a1q2ru71C64.gif
104.110.17.24200 OK 415 kB URL HTTP/2 dimg04.c-ctrip.com/images/0Z05r12000a1q2ru71C64.gif
IP 104.110.17.24:0
File type GIF image data, version 89a, 960 x 80\012- data
Size 415 kB (414559 bytes)
Hash 1a2cba8175d957d2379d06e6d2d4250d
190eb918616fa53aaca8a53b917f2627e626fecc
17e78ffe065be76212de6b960082ea287cc0e712b6f170f44c63e2144ec14c84
GET /images/0Z05r12000a1q2ru71C64.gif HTTP/1.1
Host: dimg04.c-ctrip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 414559
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=11745661
expires: Mon, 03 Apr 2023 08:27:44 GMT
date: Fri, 18 Nov 2022 09:46:43 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
dimg04.c-ctrip.com/images/0391z120009rs7p3u5EB0.gif
104.110.17.24200 OK 1.8 MB URL HTTP/2 dimg04.c-ctrip.com/images/0391z120009rs7p3u5EB0.gif
IP 104.110.17.24:0
File type GIF image data, version 89a, 960 x 240\012- data
Size 1.8 MB (1794526 bytes)
Hash c345c325b2dd601744e2fdf749337f8e
dd3274e216acb47a17b211ad0a14a84ed72322c4
01e6d867c83b80e6e0dcacb7c4d09ea7118bb3cce0e8bf20457a54f3e172777e
GET /images/0391z120009rs7p3u5EB0.gif HTTP/1.1
Host: dimg04.c-ctrip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 1794526
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=8562505
expires: Sat, 25 Feb 2023 12:15:08 GMT
date: Fri, 18 Nov 2022 09:46:43 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
ocsp.sectigo.com/
104.18.32.68200 OK 471 B IP 104.18.32.68:0
Hash 30a46804238bb664cd7c14e2678c8fd0
b713b021043b7a2162ea79f9a4f5327dba5d8346
6202da355f5aed734b7f9bfa8801f7a5328028d898bd88c27a5a287293fee0c1
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Tue, 15 Nov 2022 11:20:37 GMT
Expires: Tue, 22 Nov 2022 11:20:36 GMT
Etag: "b713b021043b7a2162ea79f9a4f5327dba5d8346"
Cache-Control: max-age=350632,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76bfc7d2cafab511-OSL
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 3fe1456ca5942ea0f57a75601f0e06f5
5d56143348e112a11c6f02c73fabcacf5e18eaa7
3b3b1f5f436598fd83f4b69321b1800f05266e9cd45d6deb8c05e7149261ec89
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3B3B1F5F436598FD83F4B69321B1800F05266E9CD45D6DEB8C05E7149261EC89"
Last-Modified: Wed, 16 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=427
Expires: Fri, 18 Nov 2022 09:53:50 GMT
Date: Fri, 18 Nov 2022 09:46:43 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 4051e623246938fb64d34c9913e89690
2537ea4a4b2ddafc5aa31c623389890b0d71e886
d7d9881ccce277a2f359efabd823de8ddf4837b315932658ba936252ead94641
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D7D9881CCCE277A2F359EFABD823DE8DDF4837B315932658BA936252EAD94641"
Last-Modified: Wed, 16 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2856
Expires: Fri, 18 Nov 2022 10:34:19 GMT
Date: Fri, 18 Nov 2022 09:46:43 GMT
Connection: keep-alive
ocsp.sectigo.com/
104.18.32.68200 OK 472 B IP 104.18.32.68:0
Hash df7c303224936af3b5f7a386f52e6a32
ce084117ae68bfbb46c9a239d4448d90a62c011b
96a7fbe9507ee01a1534c1fc946433f97179d9a06b3b8a95390a1ddc6a6d4acc
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Tue, 15 Nov 2022 22:05:46 GMT
Expires: Tue, 22 Nov 2022 22:05:45 GMT
Etag: "ce084117ae68bfbb46c9a239d4448d90a62c011b"
Cache-Control: max-age=389341,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76bfc7d2c85fb4ff-OSL
js.users.51.la/21433859.js
103.143.19.103200 OK 2.3 kB URL HTTP/1.1 js.users.51.la/21433859.js
IP 103.143.19.103:0
ASN #4837 CHINA UNICOM China169 Backbone
File type ASCII text, with very long lines (4898)
Hash 8d1b909a979f0267dcb37490ab8ea541
c8452c41c5cfd2128cec091e9cfa1e259b71aa8a
d69bae4f73be3f057b84b5d2d4ad7c374681cfa3626530da1170178df840eeb4
GET /21433859.js HTTP/1.1
Host: js.users.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: CloudWAF
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=e0faf30d690d46918cd; path=/
HWWAFSESTIME=1668764801150; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
ocsp.sectigo.com/
104.18.32.68200 OK 471 B IP 104.18.32.68:0
Hash a9b7e6b20e19e9848b1f8a08989410a1
a0b0cf763abcb2bd8907297db15f5ba70c27eeb7
78d98870e26ad3543814af383557376ed5fb7b7ad65d51a1c2ab44be6fec2f59
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 04:45:14 GMT
Expires: Fri, 25 Nov 2022 04:45:13 GMT
Etag: "a0b0cf763abcb2bd8907297db15f5ba70c27eeb7"
Cache-Control: max-age=586109,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76bfc7d43a47b4ff-OSL
ocsp.sectigo.com/
104.18.32.68200 OK 471 B IP 104.18.32.68:0
Hash c93ce76bb6edcfb6b9abb8403d77d109
ffc62cf2a99abd559598c5db9e5172e6be2b21fe
4c00f48839942b6af804507473d5f4dd42a6055d8fa29a74965f278bc0472a62
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 16 Nov 2022 16:33:46 GMT
Expires: Wed, 23 Nov 2022 16:33:45 GMT
Etag: "ffc62cf2a99abd559598c5db9e5172e6be2b21fe"
Cache-Control: max-age=455821,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76bfc7d43a55b4ff-OSL
kveff.com/9bef4285c9ea4840fabcc5335deef3b4.gif
66.150.130.123301 Moved Permanently 162 B URL HTTP/2 kveff.com/9bef4285c9ea4840fabcc5335deef3b4.gif
IP 66.150.130.123:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /9bef4285c9ea4840fabcc5335deef3b4.gif HTTP/1.1
Host: kveff.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Fri, 18 Nov 2022 09:46:43 GMT
content-type: text/html
content-length: 162
location: https://kvteee.top/9bef4285c9ea4840fabcc5335deef3b4.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
ocsp.sectigo.com/
104.18.32.68200 OK 472 B IP 104.18.32.68:0
Hash df7c303224936af3b5f7a386f52e6a32
ce084117ae68bfbb46c9a239d4448d90a62c011b
96a7fbe9507ee01a1534c1fc946433f97179d9a06b3b8a95390a1ddc6a6d4acc
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Tue, 15 Nov 2022 22:05:46 GMT
Expires: Tue, 22 Nov 2022 22:05:45 GMT
Etag: "ce084117ae68bfbb46c9a239d4448d90a62c011b"
Cache-Control: max-age=389341,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76bfc7d37bf7b511-OSL
kvevv.com/4bf88adf466b90cef3686374a27fc0e2.gif
45.150.164.88301 Moved Permanently 162 B URL HTTP/2 kvevv.com/4bf88adf466b90cef3686374a27fc0e2.gif
IP 45.150.164.88:0
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /4bf88adf466b90cef3686374a27fc0e2.gif HTTP/1.1
Host: kvevv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Fri, 18 Nov 2022 09:46:43 GMT
content-type: text/html
content-length: 162
location: https://kvtiii.top/4bf88adf466b90cef3686374a27fc0e2.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
ocsp.sectigo.com/
104.18.32.68200 OK 471 B IP 104.18.32.68:0
Hash ff98dd021c3ce49095fcfdc6b11f22e4
eb508315b2069962b8512011922ed494bce2a9bf
3074691349deb1f61c79a89e3269844b6f742bc315506477fe98b01e2bf8bf24
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 16 Nov 2022 17:43:35 GMT
Expires: Wed, 23 Nov 2022 17:43:34 GMT
Etag: "eb508315b2069962b8512011922ed494bce2a9bf"
Cache-Control: max-age=460010,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76bfc7d5ac29b4ff-OSL
ocsp.digicert.com/
93.184.220.29200 OK 280 B IP 93.184.220.29:0
Hash 28c3cca9cc091fa11c105c75dcdc53f2
511575c151e3d06dec774d478a1e8f486c1b63f3
9f225c43f1a7e88e9a5cf6651a16f0d1c3509a451cc125b7127b2bc0e5889700
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=152412
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:43 GMT
Etag: "637704df-118"
Expires: Sun, 20 Nov 2022 04:06:55 GMT
Last-Modified: Fri, 18 Nov 2022 04:06:55 GMT
Server: nginx
Content-Length: 280
328858prw.com/b1ba693e316843a484aedcd7d368b61f.gif
45.61.212.126200 OK 62 kB URL HTTP/1.1 328858prw.com/b1ba693e316843a484aedcd7d368b61f.gif
IP 45.61.212.126:0
File type GIF image data, version 89a, 320 x 185\012- data
Hash a39609b18140975f8099754386591e3c
5758379628e0102c65a87bd04cbe5158e43a94b0
fcd1a2d3584bb5dd209871dca8cef09495c9b1a3651ee204f87319e9b4a670de
Analyzer Verdict Alert quad9 Sinkholed
GET /b1ba693e316843a484aedcd7d368b61f.gif HTTP/1.1
Host: 328858prw.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635ba2af-f205"
Date: Sun, 30 Oct 2022 12:48:36 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 09:36:47 GMT
Accept-Ranges: bytes
X-Cache: HIT from cloud-us2-cdnb-26
Content-Length: 61957
ia.51.la/go1?id=21433859&rt=1668764801615&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=0&cd=24&ds=%25E6%258F%2590%25E4%25BE%259B%25E6%259C%2580%25E6%2596%25B0%25E6%259C%2580%25E5%25BF%25AB%25E7%259A%2584%25E8%25A7%2586%25E9%25A2%2591%25E5%2588%2586%25E4%25BA%25AB%25E6%2595%25B0%25E6%258D%25AE&ing=1&ekc=&sid=1668764801615&tt=%25E8%2593%259D&kw=%25E7%259F%25AD%25E8%25A7%2586%25E9%25A2%2591%252C%25E6%2590%259E%25E7%25AC%2591%25E8%25A7%2586%25E9%25A2%2591%252C%25E8%25A7%2586%25E9%25A2%2591%25E5%2588%2586%25E4%25BA%25AB%252C%25E5%2585%258D%25E8%25B4%25B9%25E8%25A7%2586%25E9%25A2%2591%252C%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2586%25E9%25A2%2591%252C%25E9%25A2%2584%25E5%2591%258A%25E7%2589%2587&cu=http%253A%252F%252Fwww.znsndnng2rf4f4e.com%252F&pu=http%253A%252F%252Fwww.myeduwatch.com%252F
103.143.19.103200 0 B URL HTTP/1.1 ia.51.la/go1?id=21433859&rt=1668764801615&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=0&cd=24&ds=%25E6%258F%2590%25E4%25BE%259B%25E6%259C%2580%25E6%2596%25B0%25E6%259C%2580%25E5%25BF%25AB%25E7%259A%2584%25E8%25A7%2586%25E9%25A2%2591%25E5%2588%2586%25E4%25BA%25AB%25E6%2595%25B0%25E6%258D%25AE&ing=1&ekc=&sid=1668764801615&tt=%25E8%2593%259D&kw=%25E7%259F%25AD%25E8%25A7%2586%25E9%25A2%2591%252C%25E6%2590%259E%25E7%25AC%2591%25E8%25A7%2586%25E9%25A2%2591%252C%25E8%25A7%2586%25E9%25A2%2591%25E5%2588%2586%25E4%25BA%25AB%252C%25E5%2585%258D%25E8%25B4%25B9%25E8%25A7%2586%25E9%25A2%2591%252C%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2586%25E9%25A2%2591%252C%25E9%25A2%2584%25E5%2591%258A%25E7%2589%2587&cu=http%253A%252F%252Fwww.znsndnng2rf4f4e.com%252F&pu=http%253A%252F%252Fwww.myeduwatch.com%252F
IP 103.143.19.103:0
ASN #4837 CHINA UNICOM China169 Backbone
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go1?id=21433859&rt=1668764801615&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=0&cd=24&ds=%25E6%258F%2590%25E4%25BE%259B%25E6%259C%2580%25E6%2596%25B0%25E6%259C%2580%25E5%25BF%25AB%25E7%259A%2584%25E8%25A7%2586%25E9%25A2%2591%25E5%2588%2586%25E4%25BA%25AB%25E6%2595%25B0%25E6%258D%25AE&ing=1&ekc=&sid=1668764801615&tt=%25E8%2593%259D&kw=%25E7%259F%25AD%25E8%25A7%2586%25E9%25A2%2591%252C%25E6%2590%259E%25E7%25AC%2591%25E8%25A7%2586%25E9%25A2%2591%252C%25E8%25A7%2586%25E9%25A2%2591%25E5%2588%2586%25E4%25BA%25AB%252C%25E5%2585%258D%25E8%25B4%25B9%25E8%25A7%2586%25E9%25A2%2591%252C%25E5%259C%25A8%25E7%25BA%25BF%25E8%25A7%2586%25E9%25A2%2591%252C%25E9%25A2%2584%25E5%2591%258A%25E7%2589%2587&cu=http%253A%252F%252Fwww.znsndnng2rf4f4e.com%252F&pu=http%253A%252F%252Fwww.myeduwatch.com%252F HTTP/1.1
Host: ia.51.la
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
HTTP/1.1 200
Server: CloudWAF
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=2c0431f3701f886f7a0; path=/
HWWAFSESTIME=1668764802919; path=/
ocsp.digicert.com/
93.184.220.29200 OK 280 B IP 93.184.220.29:0
Hash 28c3cca9cc091fa11c105c75dcdc53f2
511575c151e3d06dec774d478a1e8f486c1b63f3
9f225c43f1a7e88e9a5cf6651a16f0d1c3509a451cc125b7127b2bc0e5889700
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=152412
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:43 GMT
Etag: "637704df-118"
Expires: Sun, 20 Nov 2022 04:06:55 GMT
Last-Modified: Fri, 18 Nov 2022 04:06:55 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 280
taiwtp1.com/img/200200.gif
220.128.218.220200 OK 75 kB URL HTTP/2 taiwtp1.com/img/200200.gif
IP 220.128.218.220:0
ASN #3462 Data Communication Business Group
File type GIF image data, version 89a, 200 x 200\012- data
Hash 03c13356e00c2033df2c88cb919251eb
f3a334a0366ddda6a87034f7d6c889c4d159dc8d
0c184e206259e8d0c54d3fc12d3d5332e9f6ff5f0404630fcb2daefe65fe1bfe
GET /img/200200.gif HTTP/1.1
Host: taiwtp1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 18 Nov 2022 09:44:23 GMT
content-type: image/gif
content-length: 75259
last-modified: Wed, 09 Mar 2022 04:51:10 GMT
etag: "6228323e-125fb"
expires: Sun, 18 Dec 2022 09:44:23 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
kvteee.top/9bef4285c9ea4840fabcc5335deef3b4.gif
104.21.233.124200 OK 336 kB URL HTTP/2 kvteee.top/9bef4285c9ea4840fabcc5335deef3b4.gif
IP 104.21.233.124:0
File type GIF image data, version 89a, 750 x 150\012- data
Size 336 kB (336314 bytes)
Hash adc6c5339212a33bfc341e2a9e25e226
0ded491f264be031441fff7bf7e5e0546d4b8a9a
b4ad174696d79d3105222a523fbd03511836e991ea59218c66137495d06caf8e
GET /9bef4285c9ea4840fabcc5335deef3b4.gif HTTP/1.1
Host: kvteee.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.znsndnng2rf4f4e.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 18 Nov 2022 09:46:43 GMT
content-type: image/gif
content-length: 336314
last-modified: Tue, 16 Aug 2022 11:20:31 GMT
etag: "62fb7d7f-521ba"
expires: Mon, 28 Nov 2022 15:22:44 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1707839
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ScacAzZOUCAIOySsmKh5ZxXbiloyxB114G%2FPOFOt165OetOcVRJ6p6rpQ4yAICb0rODRLHOH%2Fk76jCFRihcJLo51mkMCyWDDjQvT16OaNqjOzHxxvrWXNG3NpcRG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76bfc7d61c0a72f6-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
339282bdb.com/47a7724b974a47a0a7ff9b1c9af7a26c.gif
45.61.212.126200 OK 113 kB URL HTTP/1.1 339282bdb.com/47a7724b974a47a0a7ff9b1c9af7a26c.gif
IP 45.61.212.126:0
File type GIF image data, version 89a, 320 x 185\012- data
Size 113 kB (113076 bytes)
Hash 293a0887f1ab0b9517c19b77d51626dd
74adbd76d248f6cfc5cffdfaaaaaf942b69b080b
e14931a1bebe13bda41f170c97f7c45f725c13854e3a907c1648a403818326eb
Analyzer Verdict Alert quad9 Sinkholed
GET /47a7724b974a47a0a7ff9b1c9af7a26c.gif HTTP/1.1
Host: 339282bdb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635b942d-1b9b4"
Date: Thu, 17 Nov 2022 12:15:06 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 08:34:53 GMT
Accept-Ranges: bytes
X-Cache: HIT from cloud-us2-cdnb-26
Content-Length: 113076
ocsp.digicert.com/
93.184.220.29200 OK 727 B IP 93.184.220.29:0
Hash ce08d145eeabda841804bdfb0e67f79c
72e0e8e2e7ced07da65897e34b40d15a09cd92a3
7466dbbdc1c6c182cf28c0abb5152a3c1cf4d7cf5c8f10b0d251e008962994ed
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4200
Cache-Control: max-age=134310
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:43 GMT
Etag: "6376adc1-2d7"
Expires: Sat, 19 Nov 2022 23:05:13 GMT
Last-Modified: Thu, 17 Nov 2022 21:55:13 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 727
ocsp.digicert.com/
93.184.220.29200 OK 727 B IP 93.184.220.29:0
Hash ce08d145eeabda841804bdfb0e67f79c
72e0e8e2e7ced07da65897e34b40d15a09cd92a3
7466dbbdc1c6c182cf28c0abb5152a3c1cf4d7cf5c8f10b0d251e008962994ed
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4200
Cache-Control: max-age=134310
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:43 GMT
Etag: "6376adc1-2d7"
Expires: Sat, 19 Nov 2022 23:05:13 GMT
Last-Modified: Thu, 17 Nov 2022 21:55:13 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 727
ocsp.godaddy.com/
192.124.249.41200 OK 1.8 kB IP 192.124.249.41:0
Hash 94fedfee4b046a3cc676608c58ff2ad4
bfbba16bad0fc3629b8e878e82ea1d9fd7c7d42e
b43db434996be0d060d31baab4475411d5a9ce8d9483536f497eec4e67df86bd
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19041
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Thu, 17 Nov 2022 19:38:27 GMT
Expires: Fri, 18 Nov 2022 19:38:27 GMT
ETag: "bfbba16bad0fc3629b8e878e82ea1d9fd7c7d42e"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
p3.douyinpic.com/obj/tos-cn-i-dy/47e05dc34e2f482aa9e9091a5ac80f69
47.246.44.230200 OK 657 kB URL HTTP/2 p3.douyinpic.com/obj/tos-cn-i-dy/47e05dc34e2f482aa9e9091a5ac80f69
IP 47.246.44.230:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type GIF image data, version 89a, 750 x 160\012- data
Size 657 kB (656886 bytes)
Hash 9d6d02ea209de67a7ec9856ac77eccf8
d5de9a9636fc980532448d28eff9d0fc8b0958da
d1bc41dc67e2e7c3c305bd8929e7d022b98b721b4e25ff7e002081be3cb887d9
GET /obj/tos-cn-i-dy/47e05dc34e2f482aa9e9091a5ac80f69 HTTP/1.1
Host: p3.douyinpic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: image/gif
content-length: 656886
date: Thu, 17 Nov 2022 09:53:43 GMT
cache-control: max-age=31536000
imagex-fmt: gif2gif
last-modified: Thu, 17 Nov 2022 09:53:05 GMT
nw-session-id: 202211171753050101351572261DAE7060kwgvj03dy
nw-session-trace: 2022-11-17T17:53:05.386549086+08:00 48
x-bdcdn-cache-status: TCP_HIT
x-length: 656886
x-powered-by: ImageX
x-response-date: Thu, 17 Nov 2022 17:53:05 GMT
x-tt-logid: 202211171753050101351572261DAE7060
via: n132-085-021, cache17.l2de2[0,0,206-0,H], cache20.l2de2[2,0], cache20.l2de2[2,0], cache8.se1[0,0,200-0,H], cache1.se1[3,0]
x-request-ip: fdbd:dc03:8:577::14
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
x-response-cinfo: 91.90.42.154
x-response-cache: edge_hit
server-timing: cdn-cache;desc=HIT,edge;dur=3
x-tt-trace-host: 01d5c241c029ad4c9408133e2d277e7f9adb2010d18b6ea89ba8ae90c46bac6478fa3982fda5521c6b3f76d470c327a028616a2457743177ad26a4a3f318b3ed41d0320ccf52817295d021ac5055a7a63434e152cc1a100159b7f421ddf56e62a1
x-response-lb: image
ali-swift-global-savetime: 1668678823
age: 85980
x-cache: HIT TCP_HIT dirn:4:370771381 mlen:0
x-swift-savetime: Thu, 17 Nov 2022 09:56:05 GMT
x-swift-cachetime: 31535858
timing-allow-origin: *, *
access-control-allow-origin: *
eagleid: 2ff62c9516687648038324635e
X-Firefox-Spdy: h2
p3.douyinpic.com/obj/tos-cn-i-dy/9bb2c938a34649cf8215baa92a04acfd
47.246.44.230200 OK 289 kB URL HTTP/2 p3.douyinpic.com/obj/tos-cn-i-dy/9bb2c938a34649cf8215baa92a04acfd
IP 47.246.44.230:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type GIF image data, version 89a, 960 x 160\012- data
Size 289 kB (288859 bytes)
Hash 06d8e74c9de31ee18051d2f678108545
ee4b7db3f62a7010a73b501c9650c8a73311ab1d
4bd0ba46acbf5adf98cd02fa337832a143b214f0a13fe63be582628303120f64
GET /obj/tos-cn-i-dy/9bb2c938a34649cf8215baa92a04acfd HTTP/1.1
Host: p3.douyinpic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: image/gif
content-length: 288859
date: Fri, 21 Oct 2022 09:08:47 GMT
cache-control: max-age=31536000
imagex-fmt: gif2gif
last-modified: Fri, 21 Oct 2022 06:22:18 GMT
nw-session-id: 202210211422180101501320764A44E054pz86903dy
nw-session-trace: 2022-10-21T14:22:18.858920707+08:00 29
x-bdcdn-cache-status: TCP_HIT
x-length: 288859
x-powered-by: ImageX
x-response-date: Fri, 21 Oct 2022 14:22:18 GMT
x-tt-logid: 202210211422180101501320764A44E054
via: n204-098-015, cache16.l2de2[0,0,206-0,H], cache21.l2de2[0,0], cache21.l2de2[0,0], cache3.se1[0,0,200-0,H], cache1.se1[3,0]
x-request-ip: fdbd:dc01:22:35::154
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
x-response-cinfo: 91.90.42.154
x-response-cache: edge_hit
server-timing: cdn-cache;desc=HIT,edge;dur=3
x-tt-trace-host: 01cbee9379081dede4563ed816372eaed935aa13632784a987b1f72d43fcad7f2e85240210ae91640746c96b2319f5594a633274492b6301d682f0967126019884caaf985c2618bf2ed11187afd041fead8707a1f62eadf227eb95443ff33bce5c
x-response-lb: image
ali-swift-global-savetime: 1666343327
age: 2421476
x-cache: HIT TCP_HIT dirn:2:118385863
x-swift-savetime: Fri, 21 Oct 2022 09:35:47 GMT
x-swift-cachetime: 31534380
timing-allow-origin: *, *
access-control-allow-origin: *
eagleid: 2ff62c9516687648038414639e
X-Firefox-Spdy: h2
cdn.cnbj1.fds.api.mi-img.com/middle.community.vip.bkt/6cb12b1223cd27d1ad24eece74fd7c13
47.246.44.231200 OK 72 kB URL HTTP/2 cdn.cnbj1.fds.api.mi-img.com/middle.community.vip.bkt/6cb12b1223cd27d1ad24eece74fd7c13
IP 47.246.44.231:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type GIF image data, version 89a, 640 x 150\012- data
Hash f98b4ec7d301f32ac147a35fef29abc0
d6ee3870960f548b51598d00924ac919975672fc
777a0a643431889e46949dadaadc7497b874649a8f8340e3d97daabfded210f8
GET /middle.community.vip.bkt/6cb12b1223cd27d1ad24eece74fd7c13 HTTP/1.1
Host: cdn.cnbj1.fds.api.mi-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: image/webp
content-length: 71648
date: Sat, 29 Oct 2022 10:20:11 GMT
last-modified: Wed, 17 Nov 2021 07:56:33 GMT
x-xiaomi-meta-content-length: 71648
etag: "f98b4ec7d301f32ac147a35fef29abc0"
content-md5: f98b4ec7d301f32ac147a35fef29abc0
x-xiaomi-hash-crc64ecma: -2321489648883130390
x-xiaomi-request-id: 87073e18-208a-aca8-0000-018423419596
cache-control: max-age=86400
access-control-allow-credentials: true
access-control-expose-headers: content-md5, upload-time, x-xiaomi-meta-content-length
ali-swift-global-savetime: 1667038811
via: cache10.l2de2[0,0,200-0,H], cache4.l2de2[1,0], cache4.l2de2[1,0], cache1.se1[0,0,200-0,H], cache2.se1[2,0]
age: 1725992
x-cache: HIT TCP_HIT dirn:11:437733357
x-swift-savetime: Sun, 06 Nov 2022 07:57:33 GMT
x-swift-cachetime: 1909358
xm-cache-status: hit
xm-cdn-prov: 1
xm-remote-address: 47.246.44.231
access-control-allow-origin: *
timing-allow-origin: *
eagleid: 2ff62c9616687648038631316e
X-Firefox-Spdy: h2
573569djd.com/79f8cbd4c2cd4823a3e3fab20b0162bc..gif
103.170.15.96200 OK 433 kB URL HTTP/1.1 573569djd.com/79f8cbd4c2cd4823a3e3fab20b0162bc..gif
IP 103.170.15.96:0
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 240\012- data
Size 433 kB (432651 bytes)
Hash f1c643b92aaa59bdb6f306b5c4ddd0a6
2a6729038e8c8fb0503aec50e410e03d9690e3dc
a2f7dee849f083384ddf2cce606215edf40e645da3e73e4a895422ce8e32e067
Analyzer Verdict Alert quad9 Sinkholed
GET /79f8cbd4c2cd4823a3e3fab20b0162bc..gif HTTP/1.1
Host: 573569djd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "6370b587-69a0b"
Date: Wed, 16 Nov 2022 16:49:30 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Sun, 13 Nov 2022 09:14:47 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-26
Content-Length: 432651
p3.douyinpic.com/obj/tos-cn-i-dy/726f186a374c4b7e87c97afc133c5916
47.246.44.230200 OK 1.0 MB URL HTTP/2 p3.douyinpic.com/obj/tos-cn-i-dy/726f186a374c4b7e87c97afc133c5916
IP 47.246.44.230:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type GIF image data, version 89a, 1500 x 300\012- data
Size 1.0 MB (1038493 bytes)
Hash c2586053b6022bd62f7cc74d93ee8782
3277e2207aa77b9164cd97d4f22481b4e692de56
ae4666dec9bd07643eb8e48e65b9b28570a8700fc8bae2010a38b6228559e735
GET /obj/tos-cn-i-dy/726f186a374c4b7e87c97afc133c5916 HTTP/1.1
Host: p3.douyinpic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: Tengine
content-type: image/gif
content-length: 1038493
date: Fri, 21 Oct 2022 10:07:32 GMT
cache-control: max-age=31536000
imagex-fmt: gif2gif
last-modified: Thu, 20 Oct 2022 22:36:20 GMT
nw-session-id: 202210210636200101351572263E2E34DCrp5rs01dy
nw-session-trace: 2022-10-21T06:36:20.160210805+08:00 141
x-bdcdn-cache-status: TCP_HIT
x-length: 1038493
x-powered-by: ImageX
x-response-date: Fri, 21 Oct 2022 06:36:20 GMT
x-tt-logid: 202210210636200101351572263E2E34DC
via: n132-067-130, cache2.l2ot7-1[0,0,206-0,H], cache5.l2ot7-1[0,0], cache5.l2ot7-1[1,0], cache7.se1[0,0,200-0,H], cache1.se1[1,0]
x-request-ip: fdbd:dc03:15:231::134
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
x-response-cinfo: 91.90.42.154
x-response-cache: edge_hit
server-timing: cdn-cache;desc=HIT,edge;dur=1
x-tt-trace-host: 011a6c62a830d17cdb037d23f6bb2edd1e125596d389a331442e2d4880dba6b856474bfa9ae5222105037ededf7d84590e8600ae23630587cd25beb2fd5895ab2f9eef8472987e3e21904e270c7d65cc22ac39aa19f85f5fa4eb0f7242a3cec8b2
x-response-lb: image
ali-swift-global-savetime: 1666346852
age: 2417952
x-cache: HIT TCP_HIT dirn:5:278194733 mlen:0
x-swift-savetime: Wed, 02 Nov 2022 14:28:39 GMT
x-swift-cachetime: 30483533
timing-allow-origin: *, *
access-control-allow-origin: *
eagleid: 2ff62c9516687648042264868e
X-Firefox-Spdy: h2
935676yfc.com/82496202cb2c4e56ba49b0c254343bd0.gif
103.170.15.88200 OK 1.0 MB URL HTTP/1.1 935676yfc.com/82496202cb2c4e56ba49b0c254343bd0.gif
IP 103.170.15.88:0
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 240\012- data
Size 1.0 MB (1003281 bytes)
Hash daa7b1bac9f2a8b6e384971154f11753
62d445160534e04d36369efdcbb24a34223bda95
e603d6c689670c7a0f72a8c341b64aa06965479f543e2a170c1b73f9f67c26dc
Analyzer Verdict Alert quad9 Sinkholed
GET /82496202cb2c4e56ba49b0c254343bd0.gif HTTP/1.1
Host: 935676yfc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "6370b512-f4f11"
Date: Fri, 18 Nov 2022 09:02:40 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Sun, 13 Nov 2022 09:12:50 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-18
Content-Length: 1003281
339282bdb.com/c7a3f82a041e48d9bab5ca1e195e89bf.gif
45.61.212.126200 OK 1.2 MB URL HTTP/1.1 339282bdb.com/c7a3f82a041e48d9bab5ca1e195e89bf.gif
IP 45.61.212.126:0
File type GIF image data, version 89a, 960 x 240\012- data
Size 1.2 MB (1208721 bytes)
Hash 966fa4c9b18696dfe81ddeabcd8d8347
c9f78cdf869d74ab7a26a1eaf8716ffe30d7709f
6b09d8599a6d53fca26aab2f7e1d0472a63eba622fd2a74a299758946ed57b94
Analyzer Verdict Alert quad9 Sinkholed
GET /c7a3f82a041e48d9bab5ca1e195e89bf.gif HTTP/1.1
Host: 339282bdb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "6370b5a4-127191"
Date: Tue, 15 Nov 2022 09:26:38 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Sun, 13 Nov 2022 09:15:16 GMT
Accept-Ranges: bytes
X-Cache: HIT from cloud-us2-cdnb-26
Content-Length: 1208721
529723929.com/b25b4cb3f3b6410e865d80ab3ac7251a.gif
47.75.19.145200 OK 748 kB URL HTTP/1.1 529723929.com/b25b4cb3f3b6410e865d80ab3ac7251a.gif
IP 47.75.19.145:0
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 750 x 120\012- data
Size 748 kB (748166 bytes)
Hash dc16c165d9da37bf4a9e9596a765425c
824e5729161352cd5f7b57faea8a32c54d35b410
4abb336ff1a1a08dc2963b708638359da654fadaf843669e4406d6ab348b4608
GET /b25b4cb3f3b6410e865d80ab3ac7251a.gif HTTP/1.1
Host: 529723929.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 18 Nov 2022 09:46:43 GMT
Content-Type: image/gif
Content-Length: 748166
Connection: keep-alive
x-oss-request-id: 63775483FC567C35329CCB45
Accept-Ranges: bytes
ETag: "DC16C165D9DA37BF4A9E9596A765425C"
Last-Modified: Wed, 16 Nov 2022 10:15:09 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 3478477367098298607
x-oss-storage-class: Standard
Content-MD5: 3BbBZdnaN79KnpWWp2VCXA==
x-oss-server-time: 2
ocsp.pki.goog/s/gts1p5/GQSs7eGZfTs
142.250.74.3200 OK 471 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/GQSs7eGZfTs
IP 142.250.74.3:0
Hash 4315718e33c1bdc078f693de073762eb
bac362b7ebef181b2779862413869b91741cd4ec
e0ff697f3c011730c0a924c5451dbd7b506e350360b8ba82bae64f48d9dd1183
POST /s/gts1p5/GQSs7eGZfTs HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 09:46:48 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
img.x955.xyz/images/6310a60d591c08fe4ef56038.gif
38.47.102.248302 Found 0 B URL HTTP/2 img.x955.xyz/images/6310a60d591c08fe4ef56038.gif
IP 38.47.102.248:0
GET /images/6310a60d591c08fe4ef56038.gif HTTP/1.1
Host: img.x955.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
referrer-policy: no-referrer
location: https://p3.douyinpic.com/obj/tos-cn-i-dy/726f186a374c4b7e87c97afc133c5916
cache-control: max-age=3600
X-Firefox-Spdy: h2
img.9623x.com/images/636a3e9ab079c2ed23d10ec0.gif
38.47.102.139302 Found 0 B URL HTTP/2 img.9623x.com/images/636a3e9ab079c2ed23d10ec0.gif
IP 38.47.102.139:0
GET /images/636a3e9ab079c2ed23d10ec0.gif HTTP/1.1
Host: img.9623x.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
referrer-policy: no-referrer
location: https://p3.douyinpic.com/obj/tos-cn-i-dy/47e05dc34e2f482aa9e9091a5ac80f69
cache-control: max-age=3600
X-Firefox-Spdy: h2
img.u1771.com/images/63523a975fe50f0585d3ef71.gif
38.47.102.139302 Found 0 B URL HTTP/2 img.u1771.com/images/63523a975fe50f0585d3ef71.gif
IP 38.47.102.139:0
GET /images/63523a975fe50f0585d3ef71.gif HTTP/1.1
Host: img.u1771.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.znsndnng2rf4f4e.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
referrer-policy: no-referrer
location: https://p3.douyinpic.com/obj/tos-cn-i-dy/9bb2c938a34649cf8215baa92a04acfd
cache-control: max-age=3600
X-Firefox-Spdy: h2