send.cm/qr/4FETL
200 OK 329 B IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type PNG image data, 135 x 135, 1-bit grayscale, non-interlaced\012- data
Hash 92e96dd11497b5733bf585ad3c2abdbe
549b8486f6199b030a91cba6db51d9f5e2627e78
72148e17b810efaecf120e853b2c8c74ba2265bf86a6cf19aaffe8daa504523c
GET /qr/4FETL HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: image/png
content-length: 329
content-transfer-encoding: binary
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DhQraUGA2WOmm8HDHylcKgDZgsijLbGIwBCOcQZ1S%2BcPs5%2B6%2BibmLO3I1E92dBVRlYjdwTx9Z0DFs6FQAd5UgzEgYz4BxTmQduAT7XQkLMaureKWNSrR3Xo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa72c3eb529-OSL
alt-svc: h3=":443"; ma=86400
send.cm/static/css/auth.min.css
200 OK 82 kB URL GET HTTP/3 send.cm/static/css/auth.min.css
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (789), with no line terminators
Hash f095cdbc5703353ae870aa6fd1504bb8
395b5898fde4cb72dc30e7752bde4e68317fb299
d7091a28d7048b34315acc78d543eb1181751aec851df73f83da7d3b07081116
GET /static/css/auth.min.css HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: text/css
last-modified: Tue, 23 Mar 2021 17:04:40 GMT
etag: W/"315-5be372d95fefb-gzip"
vary: Accept-Encoding
expires: Tue, 28 Nov 2023 18:55:22 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FSGBm9mnAmil0K9U2jSEKHvrUDLFqrGzp5DGtkFGvUyC3q4CvvXdAQZm%2BmP%2FpU2XiXsFxmiB96dkl%2Fk5aKapjGL%2FDbXddk23lZrR34Z6Z1QHt2ucrfhNzqU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa70c12b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
fvcwqkkqmuv.com/aas/r45d/vki/1951167/2819e174.js
200 OK 112 kB URL GET HTTP/2 fvcwqkkqmuv.com/aas/r45d/vki/1951167/2819e174.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerBuypass AS-983163327
Subject
FingerprintF4:CF:5F:33:5D:62:A5:49:C0:ED:F4:A2:07:7B:6A:FC:5A:C8:EE:2D
ValiditySat, 28 Oct 2023 11:35:09 GMT - Wed, 24 Apr 2024 21:59:00 GMT
File type gzip compressed data, max speed, from Unix\012- data
Size 112 kB (111518 bytes)
Hash e14118b0c5d7ad9c6fb89bed0f9fa647
f8eb49f2ba67dc0507156c6331009dac8061caec
7cb826f06356f735a3ee47be6bd138327cd5dd3e9e50e416efd8718427866e1c
GET /aas/r45d/vki/1951167/2819e174.js HTTP/1.1
Host: fvcwqkkqmuv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript
last-modified: Tue, 28 Nov 2023 11:34:35 GMT
vary: Accept-Encoding
etag: W/"6565d04b-15e20"
x-js-ab2: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
send.cm/assets/js/dashforge.js
200 OK 82 kB URL GET HTTP/3 send.cm/assets/js/dashforge.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (366)
Hash 6ede26a7d7238a4ed67bcbdb67b30bb6
581c80a8cfec9844478e3b99b7774221c78d2be9
ccc7d942a1cfa3c238044a4885889799d7b215b5b29b2c48f5db28bececc2040
GET /assets/js/dashforge.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript; charset=utf8
access-control-allow-headers: X-Requested-With
access-control-allow-origin: *
cache-control: max-age=259200
cf-bgj: minify
cf-polished: origSize=3370
etag: W/"d2a-5d2f044f765a3-gzip"
expires: Tue, 28 Nov 2023 18:54:34 GMT
last-modified: Sun, 12 Dec 2021 10:17:54 GMT
vary: Accept-Encoding
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VpuoI3nAtG3evUHzX7AGp4UkSn9gbZsTh3W9ukRP8uuVM0DFuJsgunM%2BV%2B%2FXCjCZlcGVCk18e7vR8%2B%2B9aEzrYX6YxQdIv2%2BuGCQ%2Fdlfkcy%2ByQSn47WqnDtM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa72c44b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
d2dkurdav21mkk.cloudfront.net/?rukdd=984022
200 OK 55 kB URL GET HTTP/2 d2dkurdav21mkk.cloudfront.net/?rukdd=984022
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (15945)
Hash f7c9c9c9b1e921bb585159947ed766a3
ef851b85058e986ea1485c2f142447cff094710c
b6c6a6ea1266f9b2428a3053456334c17eb9eea972db7622397a1b36f4f73de8
GET /?rukdd=984022 HTTP/1.1
Host: d2dkurdav21mkk.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 54796
date: Tue, 28 Nov 2023 18:31:08 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 2nyPp7BsUp_QDPrfjxKs9lnxZ-kQvi7h_6Zy56AyTa4y_SBD6uZCdw==
X-Firefox-Spdy: h2
walker.send.cm/s.php?action_name=send.cm%2Fxh9qez3on8ib&idsite=1&rec=1&r=968123&h=18&m=31&s=12&url=https%3A%2F%2Fsend.cm%2Fxh9qez3on8ib&_id=b7dcff335dd5d6ce&_idn=1&send_image=0&_refts=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024&pv_id=dGvhEt&pf_net=19&pf_srv=167&pf_tfr=94&uadata=%7B%7D
204 No Content 0 B URL POST HTTP/3 walker.send.cm/s.php?action_name=send.cm%2Fxh9qez3on8ib&idsite=1&rec=1&r=968123&h=18&m=31&s=12&url=https%3A%2F%2Fsend.cm%2Fxh9qez3on8ib&_id=b7dcff335dd5d6ce&_idn=1&send_image=0&_refts=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024&pv_id=dGvhEt&pf_net=19&pf_srv=167&pf_tfr=94&uadata=%7B%7D
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /s.php?action_name=send.cm%2Fxh9qez3on8ib&idsite=1&rec=1&r=968123&h=18&m=31&s=12&url=https%3A%2F%2Fsend.cm%2Fxh9qez3on8ib&_id=b7dcff335dd5d6ce&_idn=1&send_image=0&_refts=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024&pv_id=dGvhEt&pf_net=19&pf_srv=167&pf_tfr=94&uadata=%7B%7D HTTP/1.1
Host: walker.send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Content-Length: 0
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/3 204 No Content
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.2.13
content-encoding: none
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jKvoBnfyxwAtC%2Bp6%2FnP58v8KRrdh0Y0YK9%2B1DuZ6I%2FDoyyILHNlFCUNyzY3KYP%2BDyM5%2Bxp27ayG8STv5ExD6XFAcS6L31HVhH%2BHDN%2FU6IJqTOl8%2F9XFCZsJFFq%2FwfQcz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa91f5ab529-OSL
alt-svc: h3=":443"; ma=86400
fvcwqkkqmuv.com/solid.gif?z=1951167&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
200 OK 43 B URL POST HTTP/2 fvcwqkkqmuv.com/solid.gif?z=1951167&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerBuypass AS-983163327
Subject
FingerprintF4:CF:5F:33:5D:62:A5:49:C0:ED:F4:A2:07:7B:6A:FC:5A:C8:EE:2D
ValiditySat, 28 Oct 2023 11:35:09 GMT - Wed, 24 Apr 2024 21:59:00 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
POST /solid.gif?z=1951167&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1 HTTP/1.1
Host: fvcwqkkqmuv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
set-cookie: CHCK=1; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
UID=2311281331f90300323bf74fdb8f2d97c89c; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
walker.send.cm/s.js
200 OK 22 kB IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (63519)
Hash e5461eb0cef4256771e360d6306c3033
f31a23f1e2d15a7a03992010c359833efba3e6b8
78c25da6082dd620e0fe7f12d7ef6e3c6015304575d9ced465b4e84e15a7d82a
GET /s.js HTTP/1.1
Host: walker.send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=65842
etag: W/"10132-602c8b81f787d"
last-modified: Sun, 13 Aug 2023 07:16:06 GMT
cache-control: max-age=259200
cf-cache-status: HIT
age: 6624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PqLYQrSfKb%2FEPkqeUNv32QR0qysKLvoZ35k4ZvXidlGGkyrvzx0OI0lW%2B5SpDbBDdeLevK1KibnDxf25LM2Bhe0RdB2AmBTkOiFFimQ0pEojWH9oBM4a911vwF1BQaXh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afa8aeb0b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
send.cm/lib/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2
200 OK 74 kB URL GET HTTP/3 send.cm/lib/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type Web Open Font Format (Version 2), TrueType, length 74256, version 329.-17761\012- data
Hash 418dad87601f9c8abd0e5798c0dc1feb
a6b003ef506e92d05cde73adf67487d7fd7ec6df
f18c486a80175cf02fee0e05c2b4acd86c04cdbaecec61c1ef91f920509b5efe
GET /lib/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://send.cm/lib/@fortawesome/fontawesome-free/css/fa.min.css
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: font/woff2
content-length: 74256
last-modified: Thu, 03 Sep 2020 08:39:38 GMT
etag: "12210-5ae64b14b0680"
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cache-control: max-age=259200
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vWRt%2BLntn0WCe1tImoKrsqYOv19SAnygE5KjPI0XzZ1pHwTuOn8T%2FIxio4fZU9CZiC0ID6wyDkf1pdaXnm%2FHPZrGWjarrFqNsJtQFfFh9U4e3VDi7ZNBgvI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afaaa989b529-OSL
alt-svc: h3=":443"; ma=86400
send.cm/lib/perfect-scrollbar/perfect-scrollbar.min.js
200 OK 6.7 kB URL GET HTTP/3 send.cm/lib/perfect-scrollbar/perfect-scrollbar.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (18216)
Hash 4a10bcfa0a9c9fa9d503b5a498cac31e
c4f6c403e99fb37cb496c3844b332823db7c5837
a4ec9d558eeb7bc7359fe7c4820deea2c951fdd8bd34cb0e15727412c7f6c634
GET /lib/perfect-scrollbar/perfect-scrollbar.min.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript; charset=utf8
last-modified: Thu, 03 Sep 2020 08:39:38 GMT
etag: W/"4773-5ae64b14b0680-gzip"
vary: Accept-Encoding
expires: Tue, 28 Nov 2023 18:51:46 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WDP0BPVsQF7yO%2FEPc6jPoKAfpKRp0ACPCTRRN%2FCJJeoiOncBkgAVfwF5kdOI5sHT6oC9aJkoA9udCOhJGJKHO71CDWGn4svdeU3wka27hqKvZeHa3uSPMuE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa72c45b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
200 OK 0 B URL User Request GET HTTP/2 IP
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD /xh9qez3on8ib HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=0;includeSubDomains;
expires: Mon, 27 Nov 2023 18:31:09 GMT
set-cookie: c_7hyj5tegwm4sd2=xh9qez3on8ib; domain=.send.cm; path=/
aff=59249; domain=.send.cm; path=/; expires=Tue, 12-Dec-2023 18:31:09 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8W%2Fvn%2F5hCal59aPoygqgCWq9Pm9h99xJ2a1lJuYCPWRwGMtMp20KcMi0kTLB9ohG1Axx%2FfVvYbajiT41SFEnX7hNZJOPh0RjKjQO5fADtIVKNbS8C%2F2i7sg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afaa5918b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
limurol.com/ssp/req/1951167/?pb=18a56df6e905a445297c652e7849059b1701203469&psp=ygdF_0SlwB7AVLqt_M4RkTEnEi2ymd9h01eAsfF4aWOl2RnOHbuOE32SXZUizaLyvLW5lGZ93S0NHMPNGf6uuFGdQPTvpEVPktDGc32weMfmEx7PH1ztSXcgZoVTboivI_j-MiYLcscvpakVwMaKhcXMOrRDplLf4oDHj4w3lXYTvlc5nd6RbgbDMeF5cems0BiOUWUbAabcYGl9ahRMOzCkBrTb1IVXCaCiLJ3CDAF2HWtnX_6lv0pnXPkmeYI9SQRdDDfGc1FlIxW9tJ8yPLsx4sAKZ10VWyOO_t0W5jCIKtKdIepN-EDhdkwQd1s8MHhRvhGdJIqM-MkhM_mgMQTqZqYLSkrZAv-HQe-2otgg54x6qyu_xyAHzfCFJnb8EPZQFvTUAUXgRvQGWxg6W6TqNlCSfKxViydz9CnFBHPxfxxjNBipKu-ox-jihIY-04GnsoCLbUcFrz5DHcp7w87IP2hnoCbv1fQIl-7kVRX62nWwYwb37CEXsf8dBRywDhWLohjjoDw5jgC5JcoEBTpdBFJIYxY0Mx24PAKTYJo5tMDpv4sQMd6uoxTWJ0ikfPngdMs73dVK65IzWMXUTchrdcuMZAde3sX9eO_LdiIG7ObFr0yhT4794gldEIkXEQgZdUWBnFNPOsbwDNerpXuaN_pHWqPBspJy0m7SwbKpv7ExsfsJFD0dueSq0x3sMFQ2KMtGDIDnPJu6WynjxoJiogK5pEQb7hWeJ9FEqJoLWQ2MyYWcB3YAq_a5MXVF7GIkyXl59gLyyEoFdljgaLO3LrCm8oijzZ_s6CHLW3DkrXZuA1KyS-xyfloaPczV-IbfabMvY1htQzlQPDtOkyhF3GZuk8XiLSFl66mlnqySHF8Pqxyu&im=1&cb=_cletqnm743hp11dxhiz6s4&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
200 OK 7 B URL GET HTTP/2 limurol.com/ssp/req/1951167/?pb=18a56df6e905a445297c652e7849059b1701203469&psp=ygdF_0SlwB7AVLqt_M4RkTEnEi2ymd9h01eAsfF4aWOl2RnOHbuOE32SXZUizaLyvLW5lGZ93S0NHMPNGf6uuFGdQPTvpEVPktDGc32weMfmEx7PH1ztSXcgZoVTboivI_j-MiYLcscvpakVwMaKhcXMOrRDplLf4oDHj4w3lXYTvlc5nd6RbgbDMeF5cems0BiOUWUbAabcYGl9ahRMOzCkBrTb1IVXCaCiLJ3CDAF2HWtnX_6lv0pnXPkmeYI9SQRdDDfGc1FlIxW9tJ8yPLsx4sAKZ10VWyOO_t0W5jCIKtKdIepN-EDhdkwQd1s8MHhRvhGdJIqM-MkhM_mgMQTqZqYLSkrZAv-HQe-2otgg54x6qyu_xyAHzfCFJnb8EPZQFvTUAUXgRvQGWxg6W6TqNlCSfKxViydz9CnFBHPxfxxjNBipKu-ox-jihIY-04GnsoCLbUcFrz5DHcp7w87IP2hnoCbv1fQIl-7kVRX62nWwYwb37CEXsf8dBRywDhWLohjjoDw5jgC5JcoEBTpdBFJIYxY0Mx24PAKTYJo5tMDpv4sQMd6uoxTWJ0ikfPngdMs73dVK65IzWMXUTchrdcuMZAde3sX9eO_LdiIG7ObFr0yhT4794gldEIkXEQgZdUWBnFNPOsbwDNerpXuaN_pHWqPBspJy0m7SwbKpv7ExsfsJFD0dueSq0x3sMFQ2KMtGDIDnPJu6WynjxoJiogK5pEQb7hWeJ9FEqJoLWQ2MyYWcB3YAq_a5MXVF7GIkyXl59gLyyEoFdljgaLO3LrCm8oijzZ_s6CHLW3DkrXZuA1KyS-xyfloaPczV-IbfabMvY1htQzlQPDtOkyhF3GZuk8XiLSFl66mlnqySHF8Pqxyu&im=1&cb=_cletqnm743hp11dxhiz6s4&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerBuypass AS-983163327
Subject
FingerprintF5:B7:17:E8:F4:87:B4:48:99:C9:D2:6D:DA:4A:E3:52:D3:E9:8C:0E
ValiditySat, 28 Oct 2023 13:52:28 GMT - Wed, 24 Apr 2024 21:59:00 GMT
File type ASCII text, with no line terminators
Hash a97eb6fbe6f13b601d5d48c0eba8baae
736efb938caf3d0edec406932ada889f1a4f2268
a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821
GET /ssp/req/1951167/?pb=18a56df6e905a445297c652e7849059b1701203469&psp=ygdF_0SlwB7AVLqt_M4RkTEnEi2ymd9h01eAsfF4aWOl2RnOHbuOE32SXZUizaLyvLW5lGZ93S0NHMPNGf6uuFGdQPTvpEVPktDGc32weMfmEx7PH1ztSXcgZoVTboivI_j-MiYLcscvpakVwMaKhcXMOrRDplLf4oDHj4w3lXYTvlc5nd6RbgbDMeF5cems0BiOUWUbAabcYGl9ahRMOzCkBrTb1IVXCaCiLJ3CDAF2HWtnX_6lv0pnXPkmeYI9SQRdDDfGc1FlIxW9tJ8yPLsx4sAKZ10VWyOO_t0W5jCIKtKdIepN-EDhdkwQd1s8MHhRvhGdJIqM-MkhM_mgMQTqZqYLSkrZAv-HQe-2otgg54x6qyu_xyAHzfCFJnb8EPZQFvTUAUXgRvQGWxg6W6TqNlCSfKxViydz9CnFBHPxfxxjNBipKu-ox-jihIY-04GnsoCLbUcFrz5DHcp7w87IP2hnoCbv1fQIl-7kVRX62nWwYwb37CEXsf8dBRywDhWLohjjoDw5jgC5JcoEBTpdBFJIYxY0Mx24PAKTYJo5tMDpv4sQMd6uoxTWJ0ikfPngdMs73dVK65IzWMXUTchrdcuMZAde3sX9eO_LdiIG7ObFr0yhT4794gldEIkXEQgZdUWBnFNPOsbwDNerpXuaN_pHWqPBspJy0m7SwbKpv7ExsfsJFD0dueSq0x3sMFQ2KMtGDIDnPJu6WynjxoJiogK5pEQb7hWeJ9FEqJoLWQ2MyYWcB3YAq_a5MXVF7GIkyXl59gLyyEoFdljgaLO3LrCm8oijzZ_s6CHLW3DkrXZuA1KyS-xyfloaPczV-IbfabMvY1htQzlQPDtOkyhF3GZuk8XiLSFl66mlnqySHF8Pqxyu&im=1&cb=_cletqnm743hp11dxhiz6s4&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1 HTTP/1.1
Host: limurol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/javascript
content-length: 7
x-route-id: ssp.bet
set-cookie: CHCK=1; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
UID=231128133110f77ede0b53409aac0b20af62; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
limurol.com/ssp/req/1951167/?pb=18a56df6e905a445297c652e7849059b1701203469&psp=ygdF_0SlwB7AVLqt_M4RkTEnEi2ymd9h01eAsfF4aWOl2RnOHbuOE32SXZUizaLyvLW5lGZ93S0NHMPNGf6uuFGdQPTvpEVPktDGc32weMfmEx7PH1ztSXcgZoVTboivI_j-MiYLcscvpakVwMaKhcXMOrRDplLf4oDHj4w3lXYTvlc5nd6RbgbDMeF5cems0BiOUWUbAabcYGl9ahRMOzCkBrTb1IVXCaCiLJ3CDAF2HWtnX_6lv0pnXPkmeYI9SQRdDDfGc1FlIxW9tJ8yPLsx4sAKZ10VWyOO_t0W5jCIKtKdIepN-EDhdkwQd1s8MHhRvhGdJIqM-MkhM_mgMQTqZqYLSkrZAv-HQe-2otgg54x6qyu_xyAHzfCFJnb8EPZQFvTUAUXgRvQGWxg6W6TqNlCSfKxViydz9CnFBHPxfxxjNBipKu-ox-jihIY-04GnsoCLbUcFrz5DHcp7w87IP2hnoCbv1fQIl-7kVRX62nWwYwb37CEXsf8dBRywDhWLohjjoDw5jgC5JcoEBTpdBFJIYxY0Mx24PAKTYJo5tMDpv4sQMd6uoxTWJ0ikfPngdMs73dVK65IzWMXUTchrdcuMZAde3sX9eO_LdiIG7ObFr0yhT4794gldEIkXEQgZdUWBnFNPOsbwDNerpXuaN_pHWqPBspJy0m7SwbKpv7ExsfsJFD0dueSq0x3sMFQ2KMtGDIDnPJu6WynjxoJiogK5pEQb7hWeJ9FEqJoLWQ2MyYWcB3YAq_a5MXVF7GIkyXl59gLyyEoFdljgaLO3LrCm8oijzZ_s6CHLW3DkrXZuA1KyS-xyfloaPczV-IbfabMvY1htQzlQPDtOkyhF3GZuk8XiLSFl66mlnqySHF8Pqxyu&im=1&cb=_cletqnm743hp11dxhiz6s4&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
200 OK 7 B URL GET HTTP/2 limurol.com/ssp/req/1951167/?pb=18a56df6e905a445297c652e7849059b1701203469&psp=ygdF_0SlwB7AVLqt_M4RkTEnEi2ymd9h01eAsfF4aWOl2RnOHbuOE32SXZUizaLyvLW5lGZ93S0NHMPNGf6uuFGdQPTvpEVPktDGc32weMfmEx7PH1ztSXcgZoVTboivI_j-MiYLcscvpakVwMaKhcXMOrRDplLf4oDHj4w3lXYTvlc5nd6RbgbDMeF5cems0BiOUWUbAabcYGl9ahRMOzCkBrTb1IVXCaCiLJ3CDAF2HWtnX_6lv0pnXPkmeYI9SQRdDDfGc1FlIxW9tJ8yPLsx4sAKZ10VWyOO_t0W5jCIKtKdIepN-EDhdkwQd1s8MHhRvhGdJIqM-MkhM_mgMQTqZqYLSkrZAv-HQe-2otgg54x6qyu_xyAHzfCFJnb8EPZQFvTUAUXgRvQGWxg6W6TqNlCSfKxViydz9CnFBHPxfxxjNBipKu-ox-jihIY-04GnsoCLbUcFrz5DHcp7w87IP2hnoCbv1fQIl-7kVRX62nWwYwb37CEXsf8dBRywDhWLohjjoDw5jgC5JcoEBTpdBFJIYxY0Mx24PAKTYJo5tMDpv4sQMd6uoxTWJ0ikfPngdMs73dVK65IzWMXUTchrdcuMZAde3sX9eO_LdiIG7ObFr0yhT4794gldEIkXEQgZdUWBnFNPOsbwDNerpXuaN_pHWqPBspJy0m7SwbKpv7ExsfsJFD0dueSq0x3sMFQ2KMtGDIDnPJu6WynjxoJiogK5pEQb7hWeJ9FEqJoLWQ2MyYWcB3YAq_a5MXVF7GIkyXl59gLyyEoFdljgaLO3LrCm8oijzZ_s6CHLW3DkrXZuA1KyS-xyfloaPczV-IbfabMvY1htQzlQPDtOkyhF3GZuk8XiLSFl66mlnqySHF8Pqxyu&im=1&cb=_cletqnm743hp11dxhiz6s4&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerBuypass AS-983163327
Subject
FingerprintF5:B7:17:E8:F4:87:B4:48:99:C9:D2:6D:DA:4A:E3:52:D3:E9:8C:0E
ValiditySat, 28 Oct 2023 13:52:28 GMT - Wed, 24 Apr 2024 21:59:00 GMT
File type ASCII text, with no line terminators
Hash a97eb6fbe6f13b601d5d48c0eba8baae
736efb938caf3d0edec406932ada889f1a4f2268
a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821
GET /ssp/req/1951167/?pb=18a56df6e905a445297c652e7849059b1701203469&psp=ygdF_0SlwB7AVLqt_M4RkTEnEi2ymd9h01eAsfF4aWOl2RnOHbuOE32SXZUizaLyvLW5lGZ93S0NHMPNGf6uuFGdQPTvpEVPktDGc32weMfmEx7PH1ztSXcgZoVTboivI_j-MiYLcscvpakVwMaKhcXMOrRDplLf4oDHj4w3lXYTvlc5nd6RbgbDMeF5cems0BiOUWUbAabcYGl9ahRMOzCkBrTb1IVXCaCiLJ3CDAF2HWtnX_6lv0pnXPkmeYI9SQRdDDfGc1FlIxW9tJ8yPLsx4sAKZ10VWyOO_t0W5jCIKtKdIepN-EDhdkwQd1s8MHhRvhGdJIqM-MkhM_mgMQTqZqYLSkrZAv-HQe-2otgg54x6qyu_xyAHzfCFJnb8EPZQFvTUAUXgRvQGWxg6W6TqNlCSfKxViydz9CnFBHPxfxxjNBipKu-ox-jihIY-04GnsoCLbUcFrz5DHcp7w87IP2hnoCbv1fQIl-7kVRX62nWwYwb37CEXsf8dBRywDhWLohjjoDw5jgC5JcoEBTpdBFJIYxY0Mx24PAKTYJo5tMDpv4sQMd6uoxTWJ0ikfPngdMs73dVK65IzWMXUTchrdcuMZAde3sX9eO_LdiIG7ObFr0yhT4794gldEIkXEQgZdUWBnFNPOsbwDNerpXuaN_pHWqPBspJy0m7SwbKpv7ExsfsJFD0dueSq0x3sMFQ2KMtGDIDnPJu6WynjxoJiogK5pEQb7hWeJ9FEqJoLWQ2MyYWcB3YAq_a5MXVF7GIkyXl59gLyyEoFdljgaLO3LrCm8oijzZ_s6CHLW3DkrXZuA1KyS-xyfloaPczV-IbfabMvY1htQzlQPDtOkyhF3GZuk8XiLSFl66mlnqySHF8Pqxyu&im=1&cb=_cletqnm743hp11dxhiz6s4&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1 HTTP/1.1
Host: limurol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/javascript
content-length: 7
x-route-id: ssp.bet
set-cookie: CHCK=1; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
UID=23112813313142a1fc597b4687a1ceffdbfc; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint1E:A9:E1:96:78:1D:08:FC:96:C8:C2:34:4F:02:D3:3D:FA:9A:D2:6B
ValidityMon, 23 Oct 2023 11:25:04 GMT - Mon, 15 Jan 2024 11:25:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:dhEqOfJSjY-S-NB5MHJKL5gRRo0WNw:7gkW0dgdfDwexzuk; Expires=Thu, 27-Nov-2025 18:31:09 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:09 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp2IbjuXBKpu3pL-cBRvoMxro2BOudxudEr4umJFxqMn1fPnRXn6ntjWArZCb7cZKjHkLIltCg
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-O248246h6JK3dAlXO29pnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint1E:A9:E1:96:78:1D:08:FC:96:C8:C2:34:4F:02:D3:3D:FA:9A:D2:6B
ValidityMon, 23 Oct 2023 11:25:04 GMT - Mon, 15 Jan 2024 11:25:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:3O4cUUUJt1Xd2A4RbcAoIwL883iceg:SSJ4xIw1qHfZVtIr; Expires=Thu, 27-Nov-2025 18:31:09 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:09 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1Rixahchb6XNVi7T3snqnLLaunXFAhG73AZJUSL3EKvzUyC8GuxJT9rP9iomQ9tOm3f1ApuA
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy: unsafe-none
content-security-policy: script-src 'nonce-DFYgMMF65P-AHBiEHIALXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
send.cm/lib/@fortawesome/fontawesome-free/css/fa.min.css
200 OK 2.3 kB URL GET HTTP/3 send.cm/lib/@fortawesome/fontawesome-free/css/fa.min.css
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (6752), with no line terminators
Hash f6663f96baa8238002c5aa862b769f87
202a45f99a1b0fbd327f87589968eff85c2be31c
88dabccf1f52631259793dee850ec9f483cbb2ed382f6924df73d24576a4798d
GET /lib/@fortawesome/fontawesome-free/css/fa.min.css HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: text/css
last-modified: Mon, 31 Jan 2022 10:52:41 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"61f7bf79-1a60"
expires: Sun, 13 Aug 2023 21:42:22 GMT
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
pragma: public
cf-cache-status: HIT
age: 127696
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cgyNXzZUt1Wz1dkr1YZ2cTP%2B9yL7IQOtH8LkP1X06OsFAHWF4o5KNrDlK5x%2BBJh%2BlVR9HzgFCvzR5mT5QJETiYKY294tPFqn%2B9tAFlMbTooHShxtMXt%2F4Zo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa70c0ab529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
rumimorigu.com/utx?cb=3G8LmB5trPGk&top=send.cm&tid=984022
204 No Content 0 B URL GET HTTP/2 rumimorigu.com/utx?cb=3G8LmB5trPGk&top=send.cm&tid=984022
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerAmazon
Subjectrumimorigu.com
Fingerprint78:53:8F:25:03:3A:98:F6:F8:23:1D:92:FB:5F:B2:ED:2D:B4:62:1E
ValidityWed, 22 Nov 2023 00:00:00 GMT - Fri, 20 Dec 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=3G8LmB5trPGk&top=send.cm&tid=984022 HTTP/1.1
Host: rumimorigu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Tue, 28 Nov 2023 18:31:09 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://send.cm
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 28 Nov 2023 18:32:09 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 6b590e690e32695caa633ab770319d74.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: C00eGNCx8ec38nL_HHnobmbGOEr7u8ExNufQEQdS2hdBRS6Ze0cDdw==
X-Firefox-Spdy: h2
accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp2IbjuXBKpu3pL-cBRvoMxro2BOudxudEr4umJFxqMn1fPnRXn6ntjWArZCb7cZKjHkLIltCg
302 Found 403 B URL GET HTTP/3 accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp2IbjuXBKpu3pL-cBRvoMxro2BOudxudEr4umJFxqMn1fPnRXn6ntjWArZCb7cZKjHkLIltCg
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (395)
Hash 1deb1d27af544b669954144d3fb98201
331343adc936b217f004693213047b37e3005cb4
e69ea1caef94f22fecf16ccb9eccd8067cb2705b64006db99fb186e330c9a27e
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp2IbjuXBKpu3pL-cBRvoMxro2BOudxudEr4umJFxqMn1fPnRXn6ntjWArZCb7cZKjHkLIltCg HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:1irXvUgGmyBHZS7XjM_xHyf4Sa4SEw:9B0jeyEHtRCqfoe3;Path=/;Expires=Thu, 27-Nov-2025 18:31:09 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:09 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp1iWeEk-kfY4LzPDRkpsRlye7P-JqmmDWGk1hyMeGcSYChoVO9qhlT5UfofDWEI_aHx2EhWCg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1778691512%3A1701196269682956&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-zhFtTCoEQ7HYa1Kvt4hkoA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 403
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
fvcwqkkqmuv.com/get/1951167?zoneid=1951167&jp=_clzzrno61f0hoyoxsq5zu1&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
200 OK 12 kB URL GET HTTP/2 fvcwqkkqmuv.com/get/1951167?zoneid=1951167&jp=_clzzrno61f0hoyoxsq5zu1&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerBuypass AS-983163327
Subject
FingerprintF4:CF:5F:33:5D:62:A5:49:C0:ED:F4:A2:07:7B:6A:FC:5A:C8:EE:2D
ValiditySat, 28 Oct 2023 11:35:09 GMT - Wed, 24 Apr 2024 21:59:00 GMT
File type gzip compressed data, from Unix\012- data
Hash ac899434b1d60e36605ba39e6316991b
e5968c33f251497e86f8d92c30e581534a6d4d83
52e4bb1a72f944667978764eabc42b8b57cf0957aa06f0f2f69d957114f4b114
GET /get/1951167?zoneid=1951167&jp=_clzzrno61f0hoyoxsq5zu1&nojs=0&abvar=0&febuild=1.0.179&t=0&wcks=1&wgl=0&cnvs=1&os=0&ss=1&ls=1&bb=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=5740989133218816&eclog=0&sp=1&im=1 HTTP/1.1
Host: fvcwqkkqmuv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: CHCK=1; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
UID=231128133151da590c925745cca8b0c9901f; Path=/; Expires=Tue, 31 Dec 2024 18:31:09 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1Rixahchb6XNVi7T3snqnLLaunXFAhG73AZJUSL3EKvzUyC8GuxJT9rP9iomQ9tOm3f1ApuA
302 Found 410 B URL GET HTTP/3 accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1Rixahchb6XNVi7T3snqnLLaunXFAhG73AZJUSL3EKvzUyC8GuxJT9rP9iomQ9tOm3f1ApuA
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (400)
Hash ddfb75c266da6edb04f83cbbcb21261e
84ba5ceb287632b631b4f107aef2b800b3b80ab4
e5b2aa702998bb1958a44a4bcaf1167a0f6149f52696445d9132f250e7158e5f
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1Rixahchb6XNVi7T3snqnLLaunXFAhG73AZJUSL3EKvzUyC8GuxJT9rP9iomQ9tOm3f1ApuA HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:UBQ0KwdDncHKVLbl8wcy0EhKnHc_iA:5S7ifBJ9bo_zPAye;Path=/;Expires=Thu, 27-Nov-2025 18:31:09 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:09 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2uTMKjmo7WU9tq7Q7GYoAHW0QPZnofM8WkTzOpl8dA3fsiy5PB-mDt1O1cLe9Z1_zq4_ZbQA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1895718565%3A1701196269724881&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-COK7CEF1eb_DlYLS0djQ1w' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 410
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
send.cm/static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-Medium.woff
200 OK 82 kB URL GET HTTP/3 send.cm/static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-Medium.woff
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type Web Open Font Format, TrueType, length 81760, version 1.1\012- data
Hash 220843e2f1927e726e78ca63f426ce50
d86801f8452cda25025530f406773162decd1458
ae9310191397b69cd6dd015ba0c6f9d674f493d35384f29c9c7d23e3c7df0d24
GET /static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-Medium.woff HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://send.cm/static/css/dl.min.css
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: font/woff
content-length: 81760
last-modified: Thu, 17 Sep 2020 12:29:20 GMT
vary: Accept-Encoding
etag: "5f6356a0-13f60"
expires: Sat, 11 Nov 2023 16:45:04 GMT
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
age: 568138
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fKaBOlMSgCqNoHg%2BS6fMBZDa6%2FqsnSAUn2u8e3waiPeV7Ym%2Bppa4G9Uj7eDB23z8cBlCc9D5MdAZl0G0dAkpE72zoto5i%2F1Dv0aJ4GOPN4AYtaOTLf7W6UE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afae5e0db529-OSL
alt-svc: h3=":443"; ma=86400
send.cm/static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-SemiBold.woff
200 OK 82 kB URL GET HTTP/3 send.cm/static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-SemiBold.woff
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type Web Open Font Format, TrueType, length 82076, version 1.1\012- data
Hash dac78b0f1626eb1aa95d41b488e699c1
a377d0df34945fc45bdc030dc63139bd9cf28a2d
ee6d9467e82f91146b9f71f3ac572d66f4aeed0f261b30ef4765550edc11119d
GET /static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-SemiBold.woff HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://send.cm/static/css/dl.min.css
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: font/woff
content-length: 82076
last-modified: Thu, 17 Sep 2020 12:29:20 GMT
vary: Accept-Encoding
etag: "5f6356a0-1409c"
expires: Sat, 11 Nov 2023 16:42:52 GMT
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
age: 478773
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s0aCOKRqh6kyDuBlqNLt%2F6APlImuZ7Kjjh2l6s7vl1XCSuSb5mIjYAq8UZAAxkIgX7yun7a8g6wpiQsYs0njkgf7RpLTrLy7pry0WN3he5N0irXcytxRD2U%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afae5e0fb529-OSL
alt-svc: h3=":443"; ma=86400
send.cm/static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-Regular.woff
200 OK 77 kB URL GET HTTP/3 send.cm/static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-Regular.woff
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type Web Open Font Format, TrueType, length 77420, version 1.1\012- data
Hash 2afba28a9ce96315436db858db163c47
550d4374a60527b4f68d4700019aaac11a9140a2
b51d665d9cfebb31a2b61491bf408a172a5791166a0eb99a57ae4a7acbcba0d4
GET /static/fonts/ibm-plex-sans/complete/woff/IBMPlexSans-Regular.woff HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://send.cm/static/css/dl.min.css
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: font/woff
content-length: 77420
last-modified: Thu, 17 Sep 2020 12:29:21 GMT
vary: Accept-Encoding
etag: "5f6356a1-12e6c"
expires: Sat, 11 Nov 2023 16:43:34 GMT
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
age: 316444
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vHNtOP%2FvxO2tEYQHoCXD%2F6VOh0PWCHs7UinWPWxP5tEo0wXlQdITp7jNqVbq%2Bqb1kPNwdb08y68GuqHdq9Yegbf0fI35z%2Bnq8b6q%2BjIS1IQzA6R8iV0dsnk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afae5e10b529-OSL
alt-svc: h3=":443"; ma=86400
thetreuntalle.com/popunder.gif
200 OK 35 B URL GET HTTP/3 thetreuntalle.com/popunder.gif
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectthetreuntalle.com
FingerprintA0:C4:A9:41:BB:1A:27:2A:7A:EC:69:AB:80:8C:80:5D:6F:9A:9C:CE
ValidityMon, 27 Nov 2023 16:40:56 GMT - Sun, 25 Feb 2024 16:40:55 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28d6814f309ea289f847c69cf91194c6
0f4e929dd5bb2564f7ab9c76338e04e292a42ace
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
GET /popunder.gif HTTP/1.1
Host: thetreuntalle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: image/gif
access-control-allow-origin: *
pragma: public
cache-control: public, max-age=604800, immutable
cf-cache-status: HIT
age: 61277
last-modified: Tue, 28 Nov 2023 01:29:53 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mqQmWNMxx8o6shZbyzUUxLmuKBI9mtrIYkRgzKss9C5RymEqkCBCh8PvR5jSJ3Cp5alKvoh9Fk9GaAAGhSmi5%2FWq7M%2F2R5ZpDisu14G8DeP360wEoIEidV%2Fa3xILpoCGLE4NKg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afb0ceee56af-OSL
alt-svc: h3=":443"; ma=86400
thetreuntalle.com/T2VjeUhgWgAKdRpWKUorfSMKKngBITVLDgg0NisdFg4XOxt+KEUNIStYWkl7d1RQXzgmAV5IbjwRAg09PFhSXyEhAwxEbjlYUld7e0tQTWZ/QxZEf3lQUU97eVFbT3B5V1dMbjsVAh51fkMTDTwjWFJOeH5UWk96eFFRTns
204 No Content 0 B URL GET HTTP/3 thetreuntalle.com/T2VjeUhgWgAKdRpWKUorfSMKKngBITVLDgg0NisdFg4XOxt+KEUNIStYWkl7d1RQXzgmAV5IbjwRAg09PFhSXyEhAwxEbjlYUld7e0tQTWZ/QxZEf3lQUU97eVFbT3B5V1dMbjsVAh51fkMTDTwjWFJOeH5UWk96eFFRTns
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectthetreuntalle.com
FingerprintA0:C4:A9:41:BB:1A:27:2A:7A:EC:69:AB:80:8C:80:5D:6F:9A:9C:CE
ValidityMon, 27 Nov 2023 16:40:56 GMT - Sun, 25 Feb 2024 16:40:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /T2VjeUhgWgAKdRpWKUorfSMKKngBITVLDgg0NisdFg4XOxt+KEUNIStYWkl7d1RQXzgmAV5IbjwRAg09PFhSXyEhAwxEbjlYUld7e0tQTWZ/QxZEf3lQUU97eVFbT3B5V1dMbjsVAh51fkMTDTwjWFJOeH5UWk96eFFRTns HTTP/1.1
Host: thetreuntalle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Tue, 28 Nov 2023 18:31:10 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nHrag84uQvv9OpDpzFlnaHnQJ9uuE2cQLaDKmx5hrCCZpLyaqLHI6gpghICf1LGX%2FEAxFF21MAl4Za7x3IbiLvJaQezX0kNxQArqGCxbpctAWUCco9IHVEcm7SAGcqseaVObZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afb13fd356af-OSL
alt-svc: h3=":443"; ma=86400
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp1iWeEk-kfY4LzPDRkpsRlye7P-JqmmDWGk1hyMeGcSYChoVO9qhlT5UfofDWEI_aHx2EhWCg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1778691512%3A1701196269682956&theme=glif
403 Forbidden 2.0 kB URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp1iWeEk-kfY4LzPDRkpsRlye7P-JqmmDWGk1hyMeGcSYChoVO9qhlT5UfofDWEI_aHx2EhWCg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1778691512%3A1701196269682956&theme=glif
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4707), with no line terminators
Hash 9bc5815bcf15d0e786640573d6a00a7e
114a86edd3d4fe531bba4a0a791bf4137326eda5
4e1dc00431220ae467d0b60b135fcf7af27fd9a012184f6af1db7567a8c6362f
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp1iWeEk-kfY4LzPDRkpsRlye7P-JqmmDWGk1hyMeGcSYChoVO9qhlT5UfofDWEI_aHx2EhWCg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1778691512%3A1701196269682956&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:09 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: script-src 'nonce-tMAeMvjfIERqGfyqcl6VGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2uTMKjmo7WU9tq7Q7GYoAHW0QPZnofM8WkTzOpl8dA3fsiy5PB-mDt1O1cLe9Z1_zq4_ZbQA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1895718565%3A1701196269724881&theme=glif
403 Forbidden 26 kB URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2uTMKjmo7WU9tq7Q7GYoAHW0QPZnofM8WkTzOpl8dA3fsiy5PB-mDt1O1cLe9Z1_zq4_ZbQA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1895718565%3A1701196269724881&theme=glif
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type gzip compressed data, max compression\012- data
Hash b0c7ea9af94ebcde646868a35c3d8be2
248d56bb1498d5eece1f1be78cfc2057c1ddb41a
f0b263123553bed5b91f6d0b05fb35898100048fefaa39718a6aa00eff8268a5
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2uTMKjmo7WU9tq7Q7GYoAHW0QPZnofM8WkTzOpl8dA3fsiy5PB-mDt1O1cLe9Z1_zq4_ZbQA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1895718565%3A1701196269724881&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:09 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-hEI5YYwvOBXCq9Uxtzb3Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
my.rtmark.net/gid.js?userId=d9963648dd2f42fcb7cd6dd6e8a6c0b4
200 OK 65 B URL GET HTTP/2 my.rtmark.net/gid.js?userId=d9963648dd2f42fcb7cd6dd6e8a6c0b4
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT
File type JSON data\012- , ASCII text
Hash 8280e2755b7c2f15ebe21a5ddd7a78ca
8bc10ba3ebe30a765f4e5dc453f5f8cb790ab8b5
799bb5a3b46f64579137333722c12f291af25475efb4f561c12d4fd3cb9a6cfe
GET /gid.js?userId=d9963648dd2f42fcb7cd6dd6e8a6c0b4 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://send.cm
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=d9963648dd2f42fcb7cd6dd6e8a6c0b4; expires=Wed, 27 Nov 2024 18:31:10 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
d1i64ia3gj0ol1.cloudfront.net/yZG5rMEEHAQVWfhAHDw14VF1TAXJCBBhfLxRTM3IpEA0SX3MwPj5ULUIaEVR8VEgHUS8DU01VLwdTWhYgAAxWBGcQHgRbfAgNDl0tBRYCQyVCGwoNLAsUAlwtBUtZdnRKXk4CcUwZAl4lCxkYFXNUAB8Vc1RfWx5xQV0pFXNUGQJed1BLWHJkVl4TBnVBXS-kVc1QcHRVyJV9bBW9UR04CcQMLCFsuQVwtAnFVXlsBcVVLWQAnDRwOVi4cS1l2cFRbRQBnEVNcBnRWWFgGdVxYUwZzUFs
542 B URL d1i64ia3gj0ol1.cloudfront.net/yZG5rMEEHAQVWfhAHDw14VF1TAXJCBBhfLxRTM3IpEA0SX3MwPj5ULUIaEVR8VEgHUS8DU01VLwdTWhYgAAxWBGcQHgRbfAgNDl0tBRYCQyVCGwoNLAsUAlwtBUtZdnRKXk4CcUwZAl4lCxkYFXNUAB8Vc1RfWx5xQV0pFXNUGQJed1BLWHJkVl4TBnVBXS-kVc1QcHRVyJV9bBW9UR04CcQMLCFsuQVwtAnFVXlsBcVVLWQAnDRwOVi4cS1l2cFRbRQBnEVNcBnRWWFgGdVxYUwZzUFs
IP
File type ASCII text, with very long lines (765), with no line terminators
Hash caa3705f9d82dabeab1ccde867ed62cb
079fd5d52c86cc4d524e83f565898c158f9ff61c
449f4674fb7eb7eab2879a3ea01b90e5a3fe4260629dc12328e20b34b14a030d
GET /yZG5rMEEHAQVWfhAHDw14VF1TAXJCBBhfLxRTM3IpEA0SX3MwPj5ULUIaEVR8VEgHUS8DU01VLwdTWhYgAAxWBGcQHgRbfAgNDl0tBRYCQyVCGwoNLAsUAlwtBUtZdnRKXk4CcUwZAl4lCxkYFXNUAB8Vc1RfWx5xQV0pFXNUGQJed1BLWHJkVl4TBnVBXS-kVc1QcHRVyJV9bBW9UR04CcQMLCFsuQVwtAnFVXlsBcVVLWQAnDRwOVi4cS1l2cFRbRQBnEVNcBnRWWFgGdVxYUwZzUFs HTTP/1.1
Host: d1i64ia3gj0ol1.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rumimorigu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 542
date: Tue, 28 Nov 2023 18:31:10 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: pNf-L4FTedukJ2Gjx45la87zShT1nVJQtRzg3Dd7PgKl_7Qcv8vYkQ==
X-Firefox-Spdy: h2
evidenceguidance.com/9c/ed/24/9ced2453f41586bc39632e754938332a.json
200 OK 409 B URL GET HTTP/1.1 evidenceguidance.com/9c/ed/24/9ced2453f41586bc39632e754938332a.json
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectevidenceguidance.com
Fingerprint73:DA:5D:A0:74:AB:D2:A0:E4:AD:F8:6A:1A:42:80:4C:E9:E5:01:99
ValiditySun, 26 Nov 2023 06:32:48 GMT - Sat, 24 Feb 2024 06:32:47 GMT
File type JSON data\012- , ASCII text, with very long lines (409), with no line terminators
Hash b7008b1552572ff8842b251855d6fa5c
d7d42e28542937e0140565df32f140f05c5f96cd
de17f00f5b7d501a859d6d22135a7ab0b36feae7239316b8769ea137277125f2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /9c/ed/24/9ced2453f41586bc39632e754938332a.json HTTP/1.1
Host: evidenceguidance.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 28 Nov 2023 18:31:11 GMT
Content-Type: application/json
Content-Length: 409
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4e3ac736db8bc5e9fc71ee08290a9247
Strict-Transport-Security: max-age=0; includeSubdomains
evidenceguidance.com/9c/ed/24/9ced2453f41586bc39632e754938332a.json
200 OK 403 B URL GET HTTP/1.1 evidenceguidance.com/9c/ed/24/9ced2453f41586bc39632e754938332a.json
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectevidenceguidance.com
Fingerprint73:DA:5D:A0:74:AB:D2:A0:E4:AD:F8:6A:1A:42:80:4C:E9:E5:01:99
ValiditySun, 26 Nov 2023 06:32:48 GMT - Sat, 24 Feb 2024 06:32:47 GMT
File type JSON data\012- , ASCII text, with very long lines (403), with no line terminators
Hash 85da5e31e814ef665c4d2fa3d33bbc2c
57439ef5adc9dcbaa0d55b24aee0d5db7f050768
db6ee56c77f4e8fb55454515d5c1829ecc52971500bae17b433a0618a03823d5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /9c/ed/24/9ced2453f41586bc39632e754938332a.json HTTP/1.1
Host: evidenceguidance.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 28 Nov 2023 18:31:11 GMT
Content-Type: application/json
Content-Length: 403
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d3bf28e2be8a317c2d617262efe9ffff
Strict-Transport-Security: max-age=0; includeSubdomains
wetryprogress.com/pixel/pure
204 No Content 0 B URL OPTIONS HTTP/1.1 wetryprogress.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectwetryprogress.com
Fingerprint5F:2C:F3:3B:10:8A:65:4B:E6:3A:AB:B8:EE:BC:1A:45:D2:3A:E0:28
ValidityFri, 03 Nov 2023 10:33:04 GMT - Thu, 01 Feb 2024 10:33:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /pixel/pure HTTP/1.1
Host: wetryprogress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://send.cm/
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx/1.21.6
Date: Tue, 28 Nov 2023 18:31:11 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Content-Length: 0
send.cm/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
200 OK 3.4 kB URL GET HTTP/3 send.cm/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (7290), with no line terminators
Hash 36e20f36e90a8eedda25fe939a1ff001
ac534e11e92a61b08f5675226ba59b72180cf5f7
6f8ee28541ca5a10d79d7d72dfc8f44417a306ec14109b121641d01f01393843
GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-content-type-options: nosniff
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U14QtauW%2BhGFpH%2Fz9orHh9%2BGHlUX9OWr0YDmaFj3PNnZn8D4HG7HApR%2F%2F%2BMucmIPahQeHNy%2BWIXOatgvJhgtdnSgq7fhF6PDd4JODs6wo%2FOKNA%2BhufuJXbM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afb1daadb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
wetryprogress.com/pixel/pure
204 No Content 0 B URL OPTIONS HTTP/1.1 wetryprogress.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectwetryprogress.com
Fingerprint5F:2C:F3:3B:10:8A:65:4B:E6:3A:AB:B8:EE:BC:1A:45:D2:3A:E0:28
ValidityFri, 03 Nov 2023 10:33:04 GMT - Thu, 01 Feb 2024 10:33:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /pixel/pure HTTP/1.1
Host: wetryprogress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 73
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 28 Nov 2023 18:31:11 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
wetryprogress.com/pixel/pure
204 No Content 0 B URL OPTIONS HTTP/1.1 wetryprogress.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectwetryprogress.com
Fingerprint5F:2C:F3:3B:10:8A:65:4B:E6:3A:AB:B8:EE:BC:1A:45:D2:3A:E0:28
ValidityFri, 03 Nov 2023 10:33:04 GMT - Thu, 01 Feb 2024 10:33:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /pixel/pure HTTP/1.1
Host: wetryprogress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 73
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 28 Nov 2023 18:31:11 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint1E:A9:E1:96:78:1D:08:FC:96:C8:C2:34:4F:02:D3:3D:FA:9A:D2:6B
ValidityMon, 23 Oct 2023 11:25:04 GMT - Mon, 15 Jan 2024 11:25:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:gqrMQw-TfzHERUug7uVuQpLva3LPgw:iputjeubHmbd0GCA; Expires=Thu, 27-Nov-2025 18:31:11 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:11 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp1-pHdlVubI7Y1C59ePpR-UYnyayWiSjKkUqFVluFOZ44xUehbQez2njOSDIwVRKcJECuAqrA
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-VgWPUCmgdzJU8osdYaBIOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint1E:A9:E1:96:78:1D:08:FC:96:C8:C2:34:4F:02:D3:3D:FA:9A:D2:6B
ValidityMon, 23 Oct 2023 11:25:04 GMT - Mon, 15 Jan 2024 11:25:03 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:PQLBLWhCIH-yNxTo0CvbD17ViFhH6A:NBuzHC2NH9y2pcHy; Expires=Thu, 27-Nov-2025 18:31:11 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:11 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp2GUDPInQEdWSDe2lz3_fwEk9sIA2lAJpSpypPvso2g0SEiGvoSFfP2BRDQap10u2NcVLoWKQ
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy: unsafe-none
content-security-policy: script-src 'nonce-hDIMENjaWU8cE4rwx79quw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp1-pHdlVubI7Y1C59ePpR-UYnyayWiSjKkUqFVluFOZ44xUehbQez2njOSDIwVRKcJECuAqrA
302 Found 402 B URL GET HTTP/3 accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp1-pHdlVubI7Y1C59ePpR-UYnyayWiSjKkUqFVluFOZ44xUehbQez2njOSDIwVRKcJECuAqrA
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (395)
Hash 0dfeb284b7eeb5054022db5b00616d92
9aa9e017db18b77fba573fd96f2f004990b9b966
6af7978b74f366a43f28e696651b65a364b64d287bcad9b5a57d021e4863adeb
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKXGp1-pHdlVubI7Y1C59ePpR-UYnyayWiSjKkUqFVluFOZ44xUehbQez2njOSDIwVRKcJECuAqrA HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:hbg-3d_FPJNStQzCW5aLUp4bhy25PQ:Mv9gRW6RXOucien9;Path=/;Expires=Thu, 27-Nov-2025 18:31:11 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:11 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp22cUCgdD8_sdehta-v10jKaah6XQjsADlL14MQOvnoUuLfkItJ0chOH224lNaVdhWRvPI2VQ&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2013639685%3A1701196271726824&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: script-src 'nonce-EJSRzZ4J4O7CI8w5XXFbNg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 402
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp2GUDPInQEdWSDe2lz3_fwEk9sIA2lAJpSpypPvso2g0SEiGvoSFfP2BRDQap10u2NcVLoWKQ
302 Found 408 B URL GET HTTP/3 accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp2GUDPInQEdWSDe2lz3_fwEk9sIA2lAJpSpypPvso2g0SEiGvoSFfP2BRDQap10u2NcVLoWKQ
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (399)
Hash dcb9fc4e006946c6a55bb1e55f4be0df
236ae534406db72ab448f4aeda7ae6d84c1f4d1e
991358dff4ba79c113a46c4a5b4db7db675ebf0633bfc78e8e19e647e5cf58b5
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp2GUDPInQEdWSDe2lz3_fwEk9sIA2lAJpSpypPvso2g0SEiGvoSFfP2BRDQap10u2NcVLoWKQ HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:xGGsMtoPKaL3WDUJJ45qSzCtXmxK8g:nwNTUvw7ZMIG2JWU;Path=/;Expires=Thu, 27-Nov-2025 18:31:11 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:11 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2bWisw6K7z_BsbdS34L4ruo3mmorfzpQJ57J1KP4Tloqrl1HJ6TxS4oGa3YcUk03KjCDIw-Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-553499860%3A1701196271739873&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-sqsplwto_6AxccYkAZ0glw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 408
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pogothere.xyz/
200 OK 26 B IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 2b09fffb63de69442e7e7cdf68b765be
fe8116375dee602be8b068a1a7bc9bce08b96c75
3c6e7f605d5af98632825a6a59b5e5e09ac1866d1090be5e3e2457ff41a574d1
GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/plain
set-cookie: csu=765263648686245@1@1701196269; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TY4CwH3bvI%2BY56lI6FSBkg6pmsoIMm2Q813ih0libTuoU1E9PrH3AkDd8c7T%2Bx9Q9cO4EgC49Br0dgWVztJtUk%2B9PRXLAEHTgWmczOvXqusgxZc4l4qnWhFeB8LM8hPO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afad6f9f63d4-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
rumimorigu.com/utx?cb=PAa1AXKIlnlZ&top=send.cm&tid=903813
204 No Content 0 B URL GET HTTP/2 rumimorigu.com/utx?cb=PAa1AXKIlnlZ&top=send.cm&tid=903813
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerAmazon
Subjectrumimorigu.com
Fingerprint78:53:8F:25:03:3A:98:F6:F8:23:1D:92:FB:5F:B2:ED:2D:B4:62:1E
ValidityWed, 22 Nov 2023 00:00:00 GMT - Fri, 20 Dec 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=PAa1AXKIlnlZ&top=send.cm&tid=903813 HTTP/1.1
Host: rumimorigu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Tue, 28 Nov 2023 18:31:10 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://send.cm
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 28 Nov 2023 18:32:10 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 6b590e690e32695caa633ab770319d74.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: PcW69MfdoQ-0OAEzMSpMIJD9j2Y7TUzZzEncM2WKRhWu8ohY6bFMgg==
X-Firefox-Spdy: h2
send.cm/cdn-cgi/challenge-platform/h/g/jsd/r/82d4afa3984056bb
200 OK 0 B URL POST HTTP/3 send.cm/cdn-cgi/challenge-platform/h/g/jsd/r/82d4afa3984056bb
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/challenge-platform/h/g/jsd/r/82d4afa3984056bb HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12176
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: text/plain; charset=UTF-8
set-cookie: cf_clearance=PVV9b.p0VBOXQ4sCRj2V6ThRt2biZ4V8SudSsu3ONzQ-1701196270-0-1-730ca2d2.73a07051.5b213570-0.2.1701196270; path=/; expires=Wed, 27-Nov-24 18:31:10 GMT; domain=.send.cm; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FNRfZQKy9%2FudgeL6RiG500qyvxD9L%2FKzlVa6XUF%2BP7IaQG5lDX9f%2BXT9FT4NA1VQWKmVtecpflee7Ne2oeqoJOhPK9kAUfAaaLAdByPWAYS55QdrMz3qIn4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afb2cc06b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
atservineor.com/?rb=JtZ0nneE4HmnlaFyAGYfkxke-L1hWOaK9_cGm90vnZPprgSrctSoZB_aoxACJPRx-ihdW8f_I1AjezkwFJe7wJqJ2BdejbL4tDXQS7NZgrqC52kRLgd5a3gHTcRybAcCH39DGzazgLG6vfo8_MfC98-UPpo6zHBjAOzVOoOPTWImv_C_brWAECOzlz-14fcLVydvb0Fbg8-bnWPbQQBs9p3rrVFd3trS&request_ab2=0&zoneid=4277204&js_build=iclick-v1.634.0&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=1024&wiw=1280&wfc=4&pl=https%3A%2F%2Fsend.cm%2Fxh9qez3on8ib&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&wgl=&js_build=iclick-v1.634.0&bs=26c51c38-a8f9-45a2-8b28-073ba8f5d071&userId=d9963648dd2f42fcb7cd6dd6e8a6c0b4&m=link
200 OK 1.8 kB URL GET HTTP/2 atservineor.com/?rb=JtZ0nneE4HmnlaFyAGYfkxke-L1hWOaK9_cGm90vnZPprgSrctSoZB_aoxACJPRx-ihdW8f_I1AjezkwFJe7wJqJ2BdejbL4tDXQS7NZgrqC52kRLgd5a3gHTcRybAcCH39DGzazgLG6vfo8_MfC98-UPpo6zHBjAOzVOoOPTWImv_C_brWAECOzlz-14fcLVydvb0Fbg8-bnWPbQQBs9p3rrVFd3trS&request_ab2=0&zoneid=4277204&js_build=iclick-v1.634.0&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=1024&wiw=1280&wfc=4&pl=https%3A%2F%2Fsend.cm%2Fxh9qez3on8ib&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&wgl=&js_build=iclick-v1.634.0&bs=26c51c38-a8f9-45a2-8b28-073ba8f5d071&userId=d9963648dd2f42fcb7cd6dd6e8a6c0b4&m=link
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectatservineor.com
Fingerprint7F:A6:D8:C6:07:B2:43:13:77:39:5A:91:57:E3:4C:1C:7A:E3:EF:51
ValidityWed, 11 Oct 2023 05:20:30 GMT - Tue, 09 Jan 2024 05:20:29 GMT
File type troff or preprocessor input, ASCII text, with very long lines (1813), with no line terminators
Hash b169f7bb2b9d9f560eab8b93fe277bf7
931faed0831620b376b3c0699b46efaa0e7b1d48
e3cfd58eb923886cd94f6d07a3bbef81f4a1fbc9d64ae580b79851b0bccfedf7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /?rb=JtZ0nneE4HmnlaFyAGYfkxke-L1hWOaK9_cGm90vnZPprgSrctSoZB_aoxACJPRx-ihdW8f_I1AjezkwFJe7wJqJ2BdejbL4tDXQS7NZgrqC52kRLgd5a3gHTcRybAcCH39DGzazgLG6vfo8_MfC98-UPpo6zHBjAOzVOoOPTWImv_C_brWAECOzlz-14fcLVydvb0Fbg8-bnWPbQQBs9p3rrVFd3trS&request_ab2=0&zoneid=4277204&js_build=iclick-v1.634.0&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=1024&wiw=1280&wfc=4&pl=https%3A%2F%2Fsend.cm%2Fxh9qez3on8ib&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&wgl=&js_build=iclick-v1.634.0&bs=26c51c38-a8f9-45a2-8b28-073ba8f5d071&userId=d9963648dd2f42fcb7cd6dd6e8a6c0b4&m=link HTTP/1.1
Host: atservineor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Cookie: OAID=d9963648dd2f42fcb7cd6dd6e8a6c0b4; oaidts=1701196270
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: application/json
x-trace-id: 1a0ee0744d995141b919fe853c9f324a
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=d9963648dd2f42fcb7cd6dd6e8a6c0b4; expires=Wed, 27 Nov 2024 18:31:10 GMT; path=/; secure; SameSite=None
oaidts=1701196270; expires=Wed, 27 Nov 2024 18:31:10 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Tue, 05 Dec 2023 18:31:10 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
thetreuntalle.com/Zk9seVpJcA8KZzEIGCwAMgkfLg0wFy5LHDUtKjgYBBkcFQ8nAkoNMwJyVUFuVn1eXyoPK1FIfBU7DQ0vFXJdXzMIKQNEfBByXVdpUmFfTXRWaRlEa0A7HBg9W35KCS4SI1FIbVZ+XUBsVHhfSWJW
204 No Content 0 B URL GET HTTP/2 thetreuntalle.com/Zk9seVpJcA8KZzEIGCwAMgkfLg0wFy5LHDUtKjgYBBkcFQ8nAkoNMwJyVUFuVn1eXyoPK1FIfBU7DQ0vFXJdXzMIKQNEfBByXVdpUmFfTXRWaRlEa0A7HBg9W35KCS4SI1FIbVZ+XUBsVHhfSWJW
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectthetreuntalle.com
FingerprintA0:C4:A9:41:BB:1A:27:2A:7A:EC:69:AB:80:8C:80:5D:6F:9A:9C:CE
ValidityMon, 27 Nov 2023 16:40:56 GMT - Sun, 25 Feb 2024 16:40:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /Zk9seVpJcA8KZzEIGCwAMgkfLg0wFy5LHDUtKjgYBBkcFQ8nAkoNMwJyVUFuVn1eXyoPK1FIfBU7DQ0vFXJdXzMIKQNEfBByXVdpUmFfTXRWaRlEa0A7HBg9W35KCS4SI1FIbVZ+XUBsVHhfSWJW HTTP/1.1
Host: thetreuntalle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Tue, 28 Nov 2023 18:31:09 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t6mTwo8XLOh00LFsGDN4DBl956MVG9sidQzZGDYbB0NtZXOO9Fej%2BHfC%2BUESRkkmoCvzkAx1bR19uNLvfEdEpEi69EEM3How6nZSkX%2BSA%2FV3OHtaM5ZUqz8qIgGv41csl7bZ2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afaa0aef712d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
professionalswebcheck.com/stats
0 B URL GET professionalswebcheck.com/stats
IP
Requested by https://send.cm/xh9qez3on8ib
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
professionalswebcheck.com/stats
0 B URL GET professionalswebcheck.com/stats
IP
Requested by https://send.cm/xh9qez3on8ib
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
send.cm/static/js/jquery.min.js
200 OK 93 kB URL GET HTTP/3 send.cm/static/js/jquery.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (32072)
Hash bdce12c949e78d570c8d44e9c2b23508
9afdc4fec954646bd6270caf82f107fdef605bc5
c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc
GET /static/js/jquery.min.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript; charset=utf8
last-modified: Sat, 26 Sep 2020 12:00:16 GMT
etag: W/"16b88-5b0362d29f400-gzip"
vary: Accept-Encoding
expires: Tue, 28 Nov 2023 18:51:25 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Icosk7LLHAKqGAB%2BfRvkXGnd%2FzlsgOP7TPZLDhwPMHLKqFy%2FqgaNy6ELdF8PqSIrA8I569NtSOFBZNieXIfNSiM70XDOVcezOgn0qwUCBWjvTu89EBCE54k%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa71c1cb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
pogothere.xyz/asd100.bin
200 OK 102 kB IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
Size 102 kB (102400 bytes)
Hash 4c6426ac7ef186464ecbb0d81cbfcb1e
5a6918eebd9d635e8f632e3ef34e3792b1b5ec13
f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16
GET /asd100.bin HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 194
last-modified: Tue, 28 Nov 2023 18:27:55 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c8Pwms9CHLfGw1klcqGm1%2BZIRnF%2B7zoDUeJXN7eQLL0scKWQO7PFrdmgtIzhefSz1I6rCeHnZjRIoWIQ8%2BC3ws3VTk5Gj8BNcXcMsY%2FPhxURvFjvPzQxYdnvGvNS1bPw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afad7fac63d4-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
send.cm/cdn-cgi/challenge-platform/h/g/jsd/r/82d4afa3984056bb
200 OK 0 B URL POST HTTP/3 send.cm/cdn-cgi/challenge-platform/h/g/jsd/r/82d4afa3984056bb
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/challenge-platform/h/g/jsd/r/82d4afa3984056bb HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12176
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: text/plain; charset=UTF-8
set-cookie: cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269; path=/; expires=Wed, 27-Nov-24 18:31:09 GMT; domain=.send.cm; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLxM%2FRz69lnsNP%2BOMi2KaW2vTKyrc8hw4WSfdcWFsPW8Au7mwVbblKDBU7u8UNhNfKlfWouBrEbVWHJCo0ne6nrxrqyf4HcB0WoQaDve6nEVFNiO%2FTcMmJQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afad3cc5b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
send.cm/js/share.js
200 OK 329 B IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (332), with no line terminators
Hash 1d2236286294d62230ccc88e96b5297b
de15f3e22b3e2719f872e47a63b5702c48835a3f
c482daeb5dbeb1b8b60adbd8a47e025cbfe19ea0a0f798d8f77b862781694dbc
GET /js/share.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: application/javascript; charset=utf8
access-control-allow-headers: X-Requested-With
access-control-allow-origin: *
cache-control: max-age=259200
cf-bgj: minify
cf-polished: origSize=354
etag: W/"162-5ae64b15a48c0-gzip"
expires: Tue, 28 Nov 2023 18:24:08 GMT
last-modified: Thu, 03 Sep 2020 08:39:39 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 1255
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ANa4yoykVKv1nPVESoHYGwiMWh6ipZwLSe4%2FnMb5TsEloY6YyT41tfQjhx%2FnpjBSVjjqATuQJESXSghdTkbw7nZTC7hQuR35KEQUexHoJW9DN6ch4c0Jmfw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afaaa984b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
send.cm/favicon.ico
200 OK 65 kB IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 64x64, 32 bits/pixel\012- data
Hash 22dab3b36a487940c539e179b7edd7ea
ad1d193daab9eb56c4d27b10e0f0638307c262cc
b64c225956915ee8b619ea190276ebe838880d3a16793a5614487e8be5b5d3bf
GET /favicon.ico HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 03 Sep 2020 08:39:39 GMT
etag: W/"fcae-5ae64b15a48c0"
expires: Tue, 28 Nov 2023 18:37:33 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8esNWGBJQC4L8pOpJI1XQ1%2F9vZqQCKKiuvjhAcRD%2F%2FX%2BftdzulvC3r0BelNZ2uZtm%2BEL6R5hBjacSdBZPH9gsGf8KGExpgMwm8lzAUMCRmh2IxvfZwnjRjY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afac9c36b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
rumimorigu.com/d2laOVMWCzlUbBZUOB8mBQVnHGExTGh/N0YAbA06Flo9U2MYBWsXMBsGL101BQY0TX0ZDC4cYTEQAH5mBSQffBs2OAxuNR8oEn0kRl0Mf2IjKAJzEDUrMl8fDzsOdGA+GR94YyQxaXQkJwNvbB8iIDt8BSVRDHw0PzwJARciWWtvHwANDm47Lg4beCsgKx1aAj8OCFs1Ng4UfT9HHRhrCjQ4I28QMB41dx82Gg94PwAdGGwnLQ00axgvAm56MCIeAHg/QwUZQTguLwJ3BjYrYm8wRjs8bitCEQtvYwcvAncGMDgQXDdGKxZuGz0CDFVnIys0bxEvOndSBRRYC1obJT8jcwVOCxhuaiI7ag0QFDgXdRAxGi9oBQAdG1cVITE2ShEUPwx1BCYoNH0BACYMUGcUOmtVYRQvCFsBJis0fAU5ChhXASA+HF4UEz8iYAYAMyBsFQRPMEo8GRlnYREfHTlAPEU9Cmw3Gw
200 OK 3.1 kB URL GET HTTP/2 rumimorigu.com/d2laOVMWCzlUbBZUOB8mBQVnHGExTGh/N0YAbA06Flo9U2MYBWsXMBsGL101BQY0TX0ZDC4cYTEQAH5mBSQffBs2OAxuNR8oEn0kRl0Mf2IjKAJzEDUrMl8fDzsOdGA+GR94YyQxaXQkJwNvbB8iIDt8BSVRDHw0PzwJARciWWtvHwANDm47Lg4beCsgKx1aAj8OCFs1Ng4UfT9HHRhrCjQ4I28QMB41dx82Gg94PwAdGGwnLQ00axgvAm56MCIeAHg/QwUZQTguLwJ3BjYrYm8wRjs8bitCEQtvYwcvAncGMDgQXDdGKxZuGz0CDFVnIys0bxEvOndSBRRYC1obJT8jcwVOCxhuaiI7ag0QFDgXdRAxGi9oBQAdG1cVITE2ShEUPwx1BCYoNH0BACYMUGcUOmtVYRQvCFsBJis0fAU5ChhXASA+HF4UEz8iYAYAMyBsFQRPMEo8GRlnYREfHTlAPEU9Cmw3Gw
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerAmazon
Subjectrumimorigu.com
Fingerprint78:53:8F:25:03:3A:98:F6:F8:23:1D:92:FB:5F:B2:ED:2D:B4:62:1E
ValidityWed, 22 Nov 2023 00:00:00 GMT - Fri, 20 Dec 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3089), with no line terminators
Hash aabe9540f735282a86666939b64a8949
136bedf6eb43d978308bbe4b56007633f6fa759f
d8abaafee8555c0b0d72ab4634f17034ee3d859bf89486bedc17ac2ea95e0043
GET /d2laOVMWCzlUbBZUOB8mBQVnHGExTGh/N0YAbA06Flo9U2MYBWsXMBsGL101BQY0TX0ZDC4cYTEQAH5mBSQffBs2OAxuNR8oEn0kRl0Mf2IjKAJzEDUrMl8fDzsOdGA+GR94YyQxaXQkJwNvbB8iIDt8BSVRDHw0PzwJARciWWtvHwANDm47Lg4beCsgKx1aAj8OCFs1Ng4UfT9HHRhrCjQ4I28QMB41dx82Gg94PwAdGGwnLQ00axgvAm56MCIeAHg/QwUZQTguLwJ3BjYrYm8wRjs8bitCEQtvYwcvAncGMDgQXDdGKxZuGz0CDFVnIys0bxEvOndSBRRYC1obJT8jcwVOCxhuaiI7ag0QFDgXdRAxGi9oBQAdG1cVITE2ShEUPwx1BCYoNH0BACYMUGcUOmtVYRQvCFsBJis0fAU5ChhXASA+HF4UEz8iYAYAMyBsFQRPMEo8GRlnYREfHTlAPEU9Cmw3Gw HTTP/1.1
Host: rumimorigu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1206
date: Tue, 28 Nov 2023 18:31:10 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 6b590e690e32695caa633ab770319d74.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: SjZl4VfDyncKpqerWoJYJ2JrLt0ZD35N16cOIyPhdxc9kkHEOxc2Xw==
X-Firefox-Spdy: h2
send.cm/lib/bootstrap/js/bootstrap.bundle.min.js
200 OK 79 kB URL GET HTTP/3 send.cm/lib/bootstrap/js/bootstrap.bundle.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (65297)
Hash a454220fc07088bf1fdd19313b6bfd50
265a733cb7fbc481fd2510a659a85ad55c93c895
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
GET /lib/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: application/javascript; charset=utf8
last-modified: Thu, 03 Sep 2020 08:39:38 GMT
etag: W/"1332b-5ae64b14b0680-gzip"
vary: Accept-Encoding
expires: Tue, 28 Nov 2023 18:59:31 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KtIa1w2O0t6iJIrIrRv64vIwd7gxY4g5p%2BjqTf%2B%2B%2BwfLOD3NoQ1f0FZF1ciEwJiNmP8CO0e8GGazPGHhGRGwupNLlCGetVF8zt9EJHXE3oGvgwhbeO9ROVY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afaaa983b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
send.cm/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
200 OK 12 kB URL GET HTTP/3 send.cm/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (12331)
Hash 88a769d2fe35899fd45a332a0a032cc0
514c6c1d8475d17e412849a4c90159517d0fa10a
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript
last-modified: Thu, 16 Nov 2023 21:55:48 GMT
etag: W/"65568fe4-302c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9zn%2BFbLdMKDVfbWpk3VfPSS4dbfsctMU3WtXIhjgt9qwNmhuhPWCKU34fDxFL4Z%2FHb0rXHAW4CqActSv76zMq9%2FtzfQARTHnveOkpp%2FECNjcl2gPy%2FPTDy4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afa72c46b529-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Thu, 30 Nov 2023 18:31:08 GMT
cache-control: max-age=172800, public
content-encoding: gzip
send.cm/static/js/clipboard.min.js
200 OK 9.0 kB URL GET HTTP/3 send.cm/static/js/clipboard.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type Unicode text, UTF-8 text, with very long lines (9258), with no line terminators
Hash db9c29b300b6e957b611f437fe482b0c
a7ca1b86b66aa417e5ded8bddf571bd28775d7d1
02b7776bbff33fa250331338c8a085b5447d8575283a7943519c56f72215b2b2
GET /static/js/clipboard.min.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:09 GMT
content-type: application/javascript; charset=utf8
last-modified: Wed, 14 Dec 2022 18:00:20 GMT
etag: W/"234a-5efcd82834534-gzip"
vary: Accept-Encoding
expires: Tue, 28 Nov 2023 18:14:48 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
age: 1255
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OZkbn%2F5SPQuGRcSruwhOoK7bfky0%2B1%2Bio986M7eKy15t3YQGepOopQD6qUraOI6YBvqT9w2KlEWkpn16JAmweFeorRtqRcLHfU0jYz6Zd4utYYFNCYhUThM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afaaa982b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
atservineor.com/5/4277204/?oo=1&aab=1
200 OK 2.8 kB URL GET HTTP/2 atservineor.com/5/4277204/?oo=1&aab=1
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectatservineor.com
Fingerprint7F:A6:D8:C6:07:B2:43:13:77:39:5A:91:57:E3:4C:1C:7A:E3:EF:51
ValidityWed, 11 Oct 2023 05:20:30 GMT - Tue, 09 Jan 2024 05:20:29 GMT
File type troff or preprocessor input, ASCII text, with very long lines (3022), with no line terminators
Hash 2c8589e7fb7db3900647396974bda8fb
e298392b0cc8b49a3e9e00e2c6d582e9d096ffd6
bf7faf7522f068001a100262e3a66ef7e303973eab00cb3e263fb1f1544362cd
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /5/4277204/?oo=1&aab=1 HTTP/1.1
Host: atservineor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: application/json
x-trace-id: 36b3a49a01521451b2460824eb009fb9
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=d9963648dd2f42fcb7cd6dd6e8a6c0b4; expires=Wed, 27 Nov 2024 18:31:10 GMT; path=/; secure; SameSite=None
oaidts=1701196270; expires=Wed, 27 Nov 2024 18:31:10 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
dismantlepenantiterrorist.com/pxf.gif?uuid=&eb=18b30c6599f2cc55a4e95ff938f1022d&te=baea64896a02d34b4567f77c6840ba09&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=13.3095&b_frame=0&pk=9ced2453f41586bc39632e754938332a&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18
0 B URL GET dismantlepenantiterrorist.com/pxf.gif?uuid=&eb=18b30c6599f2cc55a4e95ff938f1022d&te=baea64896a02d34b4567f77c6840ba09&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=13.3095&b_frame=0&pk=9ced2453f41586bc39632e754938332a&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18
IP
Requested by https://send.cm/xh9qez3on8ib
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=&eb=18b30c6599f2cc55a4e95ff938f1022d&te=baea64896a02d34b4567f77c6840ba09&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=13.3095&b_frame=0&pk=9ced2453f41586bc39632e754938332a&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 HTTP/1.1
Host: dismantlepenantiterrorist.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2bWisw6K7z_BsbdS34L4ruo3mmorfzpQJ57J1KP4Tloqrl1HJ6TxS4oGa3YcUk03KjCDIw-Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-553499860%3A1701196271739873&theme=glif
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2bWisw6K7z_BsbdS34L4ruo3mmorfzpQJ57J1KP4Tloqrl1HJ6TxS4oGa3YcUk03KjCDIw-Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-553499860%3A1701196271739873&theme=glif
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2bWisw6K7z_BsbdS34L4ruo3mmorfzpQJ57J1KP4Tloqrl1HJ6TxS4oGa3YcUk03KjCDIw-Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-553499860%3A1701196271739873&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:11 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-NmEeON4GhYhw7V3bgHg46g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
atservineor.com/tag.min.js
200 OK 81 kB URL GET HTTP/2 atservineor.com/tag.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerLet's Encrypt
Subjectatservineor.com
Fingerprint7F:A6:D8:C6:07:B2:43:13:77:39:5A:91:57:E3:4C:1C:7A:E3:EF:51
ValidityWed, 11 Oct 2023 05:20:30 GMT - Tue, 09 Jan 2024 05:20:29 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash a63fc8f3a4d2ea4cdeb83330db1dac6f
49fb987a8cf06cf1c76839a2ef871aca90e531c1
354b0495a58d8bf0e7568374b1b23fa0007c78fc037bc655736b7a28e4119d19
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /tag.min.js HTTP/1.1
Host: atservineor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 28 Nov 2023 18:31:10 GMT
content-type: text/javascript; charset=utf-8
content-length: 25606
content-encoding: br
x-trace-id: 7d5e9a39023b45a27a1c4ec86ab16dc4
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
accept-ranges: bytes
last-modified: Tue, 28 Nov 2023 12:25:36 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
send.cm/cdn-cgi/challenge-platform/scripts/jsd/main.js
302 Found 7.4 kB URL GET HTTP/3 send.cm/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Tue, 28 Nov 2023 18:31:10 GMT
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
vary: accept-encoding
cache-control: max-age=300, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZryWAbVK5Q8yuT5PeDPzabVizUMPaQrFPQuCIHHp3A%2F2vULykSVTrwqb2pdg%2BvL8lkdvZicVlYL99ad1wAT6uLD9jx0dL2jMJXxDetmstQcEqIenBOYAqdQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afb1ba95b529-OSL
alt-svc: h3=":443"; ma=86400
rumimorigu.com/ZFFGQ0QFMyUuewVsJGUxFj17ZnYidHQFIFY1LTY2ADAwcXUJOi1tJwg+MyciFj4oN2oKNDJmdiJoCC0SHh90DRIjOXcRHCEYJQUzFDACKAIgExAGFSwmBBoAMQsPABwPZyI5AQMEFC8oIAUTEQJUJhQXIwAXESsVAAQAdxUhE3cWHAM1EgYoKRMFcwIyAD4NHiw6cxcDVBQjAC9cBBE7DSYUFBkcNxNzGgMyaRwLdT4WBAcKIxYQDhA2YQslAiJpJAV1AwQUFQYmEzFyBzEUAwsRAwskEjwuACIFBiYTPhEiI2ETBxYDBHUVIzIFEigKLBQqAXQxFGsGDCEEBBIVLAsVAS8mNQRzKzADdg0VJj0TJgwmGxQgAQAVBC8JIwMDDgM2NhQFAjJlFBY8KTIScx0hHHYKDDI5LgUSMRsjATNCOzUsKhRsPA0dJRUVJT43KQA
200 OK 3.0 kB URL GET HTTP/2 rumimorigu.com/ZFFGQ0QFMyUuewVsJGUxFj17ZnYidHQFIFY1LTY2ADAwcXUJOi1tJwg+MyciFj4oN2oKNDJmdiJoCC0SHh90DRIjOXcRHCEYJQUzFDACKAIgExAGFSwmBBoAMQsPABwPZyI5AQMEFC8oIAUTEQJUJhQXIwAXESsVAAQAdxUhE3cWHAM1EgYoKRMFcwIyAD4NHiw6cxcDVBQjAC9cBBE7DSYUFBkcNxNzGgMyaRwLdT4WBAcKIxYQDhA2YQslAiJpJAV1AwQUFQYmEzFyBzEUAwsRAwskEjwuACIFBiYTPhEiI2ETBxYDBHUVIzIFEigKLBQqAXQxFGsGDCEEBBIVLAsVAS8mNQRzKzADdg0VJj0TJgwmGxQgAQAVBC8JIwMDDgM2NhQFAjJlFBY8KTIScx0hHHYKDDI5LgUSMRsjATNCOzUsKhRsPA0dJRUVJT43KQA
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerAmazon
Subjectrumimorigu.com
Fingerprint78:53:8F:25:03:3A:98:F6:F8:23:1D:92:FB:5F:B2:ED:2D:B4:62:1E
ValidityWed, 22 Nov 2023 00:00:00 GMT - Fri, 20 Dec 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3066), with no line terminators
Hash 53093458dc564066c0707600b35779cc
c31150ead8f71ceaf716db88f0016cfd6c010f61
65fa6e22c9c17ed7f3f4c4efed042ac365016d59ee3bd20948835f0f43f3144e
GET /ZFFGQ0QFMyUuewVsJGUxFj17ZnYidHQFIFY1LTY2ADAwcXUJOi1tJwg+MyciFj4oN2oKNDJmdiJoCC0SHh90DRIjOXcRHCEYJQUzFDACKAIgExAGFSwmBBoAMQsPABwPZyI5AQMEFC8oIAUTEQJUJhQXIwAXESsVAAQAdxUhE3cWHAM1EgYoKRMFcwIyAD4NHiw6cxcDVBQjAC9cBBE7DSYUFBkcNxNzGgMyaRwLdT4WBAcKIxYQDhA2YQslAiJpJAV1AwQUFQYmEzFyBzEUAwsRAwskEjwuACIFBiYTPhEiI2ETBxYDBHUVIzIFEigKLBQqAXQxFGsGDCEEBBIVLAsVAS8mNQRzKzADdg0VJj0TJgwmGxQgAQAVBC8JIwMDDgM2NhQFAjJlFBY8KTIScx0hHHYKDDI5LgUSMRsjATNCOzUsKhRsPA0dJRUVJT43KQA HTTP/1.1
Host: rumimorigu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1188
date: Tue, 28 Nov 2023 18:31:09 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 6b590e690e32695caa633ab770319d74.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: I676nXNKvo2QBJNAx6K1QFeA88jduqArJkou2RUER8EHa3RDxgf0JA==
X-Firefox-Spdy: h2
send.cm/cdn-cgi/challenge-platform/scripts/jsd/main.js
302 Found 7.3 kB URL GET HTTP/3 send.cm/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib; cf_clearance=zyB_sMKYYmo9.zbIni0t0rxnzaIH5O7qZx_5fR0rFd8-1701196269-0-1-730ca2d2.73a07051.5b213570-0.2.1701196269
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Tue, 28 Nov 2023 18:31:10 GMT
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
cache-control: max-age=300, public
access-control-allow-origin: *
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tqgLwvfSOKehDjirULlbq7UeuSZHlN3ElmJ3qlei0Lq5eHElTY0XIdCN8x1hrLcHJu7nyJl4boHIRgyGKISd6p%2FHqYBoWeaSknQq7uJgjepJtC73pTP1LWU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afb1ba93b529-OSL
alt-svc: h3=":443"; ma=86400
friendshipmale.com/sfp.js
200 OK 86 kB URL GET HTTP/2 friendshipmale.com/sfp.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 28 Nov 2023 18:31:11 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: dbdd571dcd9ac7f68d39778fd07aad18
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Tue, 28 Nov 2023 18:31:11 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8wjPULUDHNGV1EHtLYRnZji792N2wLmrsxuDE5MFPwZJitnI03xFmcJrZ3RaYhdcQQ3pqrz6uHk26P8l2xz9%2F4cm00lb3dZ0zLj3yM5Fn0Fxej05m2J0li7kYhkHedNNMFYUFhU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afb71fc76542-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
professionalswebcheck.com/stats
0 B URL GET professionalswebcheck.com/stats
IP
Requested by https://send.cm/xh9qez3on8ib
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
send.cm/static/css/dl.min.css
200 OK 180 kB URL GET HTTP/3 send.cm/static/css/dl.min.css
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 180 kB (179945 bytes)
Hash 3e85e3b581d51ddba21136119002fc2d
038a7216f7187936b4f4e5bee0975bf44e3e1449
dde25a807ebc087b35d1bbe9b3030ea528a52e414ce29a7894abd937bf67e7c6
GET /static/css/dl.min.css HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: text/css
last-modified: Thu, 07 Sep 2023 13:24:21 GMT
etag: W/"2bee9-604c4c72211a7-gzip"
vary: Accept-Encoding
expires: Tue, 28 Nov 2023 18:40:03 GMT
cache-control: max-age=259200
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: HIT
age: 1254
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1TuCUeOQhSHPbyosGGh3CaITw1VCNeVhHq%2BdguPw175A1d%2FsNRAJfSVQq%2FjAXFQwODha%2B5SnFiXVjQ%2Bb5g7GDduUf6Zmya47Q2wkMah3YuPPf%2FRZKTZJQ9Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa70c0eb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
send.cm/cdn-cgi/challenge-platform/scripts/jsd/main.js
302 Found 7.4 kB URL GET HTTP/3 send.cm/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq; _pk_id.1.43ee=b7dcff335dd5d6ce.1701196273.; _pk_ses.1.43ee=1; __PPU___PPU_SESSION_URL=%2Fxh9qez3on8ib; c_7hyj5tegwm4sd2=xh9qez3on8ib
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Tue, 28 Nov 2023 18:31:09 GMT
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
cache-control: max-age=300, public
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9j1totxoZtQojeISi%2BTovVCCSMPnGUHWZE7roZ5E2IM4Kv38A%2F9wAY995r4k%2FK%2B3vMC9ARqkai%2FZVbHfJ8vZUlMaJmFmN80zHo0IktroS8Fhc2ywKor0DLM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afab9a9bb529-OSL
alt-svc: h3=":443"; ma=86400
professionalswebcheck.com/stats
0 B URL GET professionalswebcheck.com/stats
IP
Requested by https://send.cm/xh9qez3on8ib
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp22cUCgdD8_sdehta-v10jKaah6XQjsADlL14MQOvnoUuLfkItJ0chOH224lNaVdhWRvPI2VQ&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2013639685%3A1701196271726824&theme=glif
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp22cUCgdD8_sdehta-v10jKaah6XQjsADlL14MQOvnoUuLfkItJ0chOH224lNaVdhWRvPI2VQ&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2013639685%3A1701196271726824&theme=glif
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp22cUCgdD8_sdehta-v10jKaah6XQjsADlL14MQOvnoUuLfkItJ0chOH224lNaVdhWRvPI2VQ&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2013639685%3A1701196271726824&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 28 Nov 2023 18:31:11 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'nonce-i4Io2lr_DC0Pv8KO7Ek84A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
send.cm/lib/feather-icons/feather.min.js
200 OK 66 kB URL GET HTTP/3 send.cm/lib/feather-icons/feather.min.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerGoogle Trust Services LLC
Subjectsend.cm
Fingerprint4A:FF:4D:B2:CC:85:F4:52:F9:78:AF:EB:79:F3:A2:6A:66:3E:98:D1
ValidityThu, 05 Oct 2023 16:49:19 GMT - Wed, 03 Jan 2024 16:49:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /lib/feather-icons/feather.min.js HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/xh9qez3on8ib
Cookie: aff=59249; c_7hyj5tegwm4sd1=xh9qez3on8ib; lang=english; __cflb=04dToPXYGQwzSVHrRvdmaaKmJbS8hsdYZTwpVPtAvq
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 28 Nov 2023 18:31:08 GMT
content-type: application/javascript; charset=utf8
last-modified: Thu, 03 Sep 2020 08:39:38 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"5f50abca-101aa"
expires: Sun, 13 Aug 2023 21:42:42 GMT
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
pragma: public
cf-cache-status: HIT
age: 558556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JApG3pEx8K7YAfZSt3NXYZITnjVCrne9jLgkBPZ8DNVn0pvXhB9G6SFy0rKNZHAmoeMocNQgbFiPDJT%2FtHEKZ2DUJjPB0D47ae5352YNDtJK45qDnqf8%2Ftw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82d4afa72c42b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
friendshipmale.com/sfp.js
200 OK 86 kB URL GET HTTP/2 friendshipmale.com/sfp.js
IP
Requested by https://send.cm/xh9qez3on8ib
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 28 Nov 2023 18:31:11 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: f2714532df190522f0c13765e146c2d6
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Tue, 28 Nov 2023 18:31:11 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7wa8hR7GGqrswwfDPZfzIhsC%2FbYRrlGxAJwHmBi%2F6DYSJQlsSQHGZw2oXr96QGSFmWmXAz3JcD34mobWlGtpS8twRRMJVze0xIB5ICO9pevdx4u1Ed%2BfCn6wm2%2F3l4f8SJ3e%2BQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82d4afb71fce6542-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
104.26.0.171
212.117.190.201
139.45.195.8
0.0.0.0
188.114.96.1