Report - 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418

Report Overview

Submitted URL
19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
IP
154.218.151.71
ASN
#137951 Clayer Limited
Submitted
2023-02-04 08:11:22
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.globalsign.com	2075	2012-07-20T19:46:16Z	2023-03-13T05:09:19Z	359 B	1.9 kB	104.18.21.226
img2.baidu.com	50786	2021-03-25T13:17:58Z	2023-03-12T11:23:13Z	1.7 kB	257 kB	111.170.27.1
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
t14.baidu.com	32559	2021-01-22T21:20:42Z	2023-03-12T11:23:14Z	705 B	98 kB	185.10.104.124
img0.baidu.com	50126	2021-03-25T13:17:59Z	2023-03-12T11:23:13Z	3.7 kB	680 kB	111.170.27.1
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	35.164.186.39
img1.baidu.com	50158	2021-03-25T13:17:58Z	2023-03-12T11:23:15Z	2.2 kB	314 kB	111.170.27.1
t15.baidu.com	33050	2021-01-09T17:16:17Z	2023-03-12T11:23:14Z	1.4 kB	486 kB	185.10.104.124
hm.baidu.com	8254	2012-05-26T10:38:45Z	2023-03-13T05:32:36Z	1.2 kB	12 kB	103.235.46.191
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3.4 kB	8.9 kB	23.36.76.226
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
19147.url.tudown.com	unknown	2022-08-04T05:37:09Z	2023-03-06T10:24:17Z	19 kB	110 kB	154.218.151.71
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	68 kB	34.120.237.76
t13.baidu.com	32653	2021-01-09T14:57:25Z	2023-03-12T11:23:14Z	1.1 kB	131 kB	185.10.104.124

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-04 08:11:48	medium	154.218.151.71	Client IP	ETPRO HUNTING HTTP 200 Stat Code with 404 in Body

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-04	medium	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (17)

	URL	Size	First Seen	Last Seen
	19147.url.tudown.com/template/company/1014xiazai/js/jquery-1.8.2.min.js	94 kB	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/jquery-1.8.2.min.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen441 Hash eabf66c7f2effd98eb0369b2938ec15a db1d89447ed467c6e554b0c4a12e9db0671cafe5 4a6020fc267f6de32c7c66f320f7bf938ee983a40048d9045eb81482e014ec66 Loading...

	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	19 B	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen402 Hash 5026565a967f558e10cc17c50a89b208 84ff7bf903b1b54627bafc90713f0b69bb3e6639 f31d97f14cca7accd0d28ede692755eb21a9d270f5323e748324fad0eab452df Loading...

	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	29 B	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen402 Hash 787d509535f89598c94cffe31e12365b 57c9e4d2c6316cf2cf0c8ab6deef7700105fd7ec f530c48da320b80bdc83e88903e1c40c2c7f59ec934029c7627b2f3d67e3fcf7 Loading...

	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	31 B	2023-03-09	2023-10-25
Pretty URL 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:20 Last Seen2023-10-25 23:41:33 Times Seen394 Hash 35956d352872ce846dcc1e857b2f4887 fce0a27b007b22f391364d5494cbceee63b35432 a009487a5d907a1c488f1fca7d0cb512bc9107c204a67c2dcfa16a87e1fac047 Loading...

	hm.baidu.com/hm.js?dd9836db2e433f487a0aa434b7b3deb7	30 kB	2023-03-13	2023-03-13
Pretty URL hm.baidu.com/hm.js?dd9836db2e433f487a0aa434b7b3deb7 IP 103.235.46.191 ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 16:34:04 Last Seen2023-03-13 16:34:04 Times Seen1 Hash fdcd57b492b485862510c97f1818b51c 292143473770a0f637785ad17596c919d78cbde6 0f8fa2093f9f6e7eb8cbd065721a0407dc6494b7cd672446330c7b686cbdb015 Loading...

	19147.url.tudown.com/js/orsxg5a.script	944 B	2023-03-12	2023-03-18
Pretty URL 19147.url.tudown.com/js/orsxg5a.script IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 14:02:34 Last Seen2023-03-18 07:38:54 Times Seen1 Hash 115782a87f98ee819affba9c5fc37d4e e3e7eb2067add7793da4221acd4edc9776600c41 54f9e7c3cf8bb6599a306d4cf9a19259071fc3dab0865d538c8e03335889194b Loading...

	19147.url.tudown.com/template/company/1014xiazai/js/screenshots.js	4.6 kB	2023-03-09	2023-10-25
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/screenshots.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-10-25 23:41:33 Times Seen400 Hash 63d9902da8f282c300c14cf41ca14fca a1cf33435240f161d44ea2973da1aaf9c28b7388 4eceb556bd541b9df033ca8b2ad38ce1555f8a90dfeba42568746aa2fbfff58b Loading...

	19147.url.tudown.com/template/company/1014xiazai/js/jquery.uploadify.min.js	548 B	2023-03-08	2024-04-19
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/jquery.uploadify.min.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 16:42:13 Last Seen2024-04-19 20:40:42 Times Seen2531 Hash 370e16c3b7dba286cff055f93b9a94d8 65f3537c3c798f7da146c55aef536f7b5d0cb943 d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 Loading...

	19147.url.tudown.com/template/company/1014xiazai/js/global.js	6.3 kB	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/global.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen413 Hash e53eb4a74b966d89ed59103612508342 3c2050430ff5a62bf1bfa55c6ceccba1e082654d a052df383dbf824bec4a50313cdb570d82e4e2acf3cb8323a8a87ca00a4fc59e Loading...

	19147.url.tudown.com/template/company/1014xiazai/js/loading.js	7.4 kB	2023-03-09	2023-10-25
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/loading.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-10-25 23:41:33 Times Seen400 Hash 14654993bdcd4dd86b82f445f5ff16a0 6b65661376dad71b6563057aca9b70b45bdf93bb a364e0437445987ddb7869d3a604758ea831e14a5be023feca2d78757902c028 Loading...

	19147.url.tudown.com/template/company/1014xiazai/js/plugins.count.js	1.5 kB	2023-03-09	2023-10-25
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/plugins.count.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:20 Last Seen2023-10-25 23:41:33 Times Seen400 Hash 7af55053d0fc194bf97872047da2da66 bced6a877632c82c2bb6aa407022d1e417ea10fb f9d8944f0a8b068008c5e41c3eece9c7453abb5910e37fafddf2560584eccff6 Loading...

	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	254 B	2023-03-09	2023-12-23
Pretty URL 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:02:19 Last Seen2023-12-23 16:26:58 Times Seen1789 Hash c86ce41b80900dd60765c9dddb425e66 29681365731cf7d3bbaf1cf9d121090ef34624a5 a7d6678bd92dd9f38310914883d14c408d73826eeccbe32b7cdaf9f77c6c589b Loading...

	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	11 B	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen402 Hash e0e48230a926ee9d587d2fe8e675b45b 3bb03b2d3c60b53a06a7e6741bea13a7960091a4 2f1f8dee7a4ab98a2b25654ad2359337aea885dbb03256ddec930d46765d82ef Loading...

	19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe	15 B	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen403 Hash 7ad4d9a9129f304e49b26ae5c8e2a1ef b7f1cc5ddca7a2364e47cb7209eb9f0ae9b490b7 52e38dac3d85737e8f2e49acae5c002c6e1efee65fef33ffd1743c451a998920 Loading...

	19147.url.tudown.com/template/company/1014xiazai/js/member.js	53 kB	2023-03-09	2023-12-09
Pretty URL 19147.url.tudown.com/template/company/1014xiazai/js/member.js IP 154.218.151.71 ASN #137951 Clayer Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:21 Last Seen2023-12-09 20:21:57 Times Seen402 Hash 8ecb6d8d105dea52e40858cee6f3fc8f b98baeccd12a2fffcac223a979f5d2707a9f5f7f 4a2945d1b44252888e082d4995d905b00628a83b7851e5f8886304ccd7d98aa3 Loading...

		Size	First Seen	Last Seen
	#1 Write - 74312d9fd3d0d77a65b4edf6f7a9d543	169 B	2023-03-07	2024-04-14
Pretty Observations First Seen2023-03-07 12:43:11 Last Seen2024-04-14 17:35:46 Times Seen2523 Hash 74312d9fd3d0d77a65b4edf6f7a9d543 f8f99b78a90612dba2ab0f2f96d35ef3c77cd3c6 e3932ed210d0dfb6820eacc496a3e5a609b8f011515b9324fe93b5d956a11f08 Loading...

	#2 Write - 9104ef1ddb84ab257a9e746454b00ff8	310 B	2023-03-12	2023-03-18
Pretty Observations First Seen2023-03-12 14:02:34 Last Seen2023-03-18 07:38:54 Times Seen1 Hash 9104ef1ddb84ab257a9e746454b00ff8 abbc574006d442cf8207f6547e94799ac4aa2aaf 08cfa2671ab17fd81b2902c4c81aa0924c009028f346513b84a77417ae47d036 Loading...

HTTP Transactions (92)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
81713f952b51a865ad9764cde68e3fdb
278c3a9c4bb2a0ffb7375f90d89a1ba6e90a766a
c2eb0d8a24ecb51af28f1c71db4b9a95c568dcf6c94b41ee8c78787a4ebebcef

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C2EB0D8A24ECB51AF28F1C71DB4B9A95C568DCF6C94B41EE8C78787A4EBEBCEF"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5695
Expires: Sat, 04 Feb 2023 09:46:06 GMT
Date: Sat, 04 Feb 2023 08:11:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e935ea42be4feaed61a824b0b903913e
f966cfa80d65a805cb9d7c6a53b3340865d7c51a
eb0ce9ae50d156fe5924b2d77346735e4e93b5240cff301c9aa835bb0b385815

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB0CE9AE50D156FE5924B2D77346735E4E93B5240CFF301C9AA835BB0B385815"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3524
Expires: Sat, 04 Feb 2023 09:09:55 GMT
Date: Sat, 04 Feb 2023 08:11:11 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Backoff, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 04 Feb 2023 07:36:14 GMT
content-type: application/json
age: 2097
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7d2222d41721947297aaeb5a6e3d0714
04cc1ee417c8bf6338657fd4c2e4e1c1ddfd3065
de0e45969a2ad95e52f7e2fbd0d021d9075dd7b14666c929346efe111f648f7c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DE0E45969A2AD95E52F7E2FBD0D021D9075DD7B14666C929346EFE111F648F7C"
Last-Modified: Thu, 02 Feb 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5352
Expires: Sat, 04 Feb 2023 09:40:23 GMT
Date: Sat, 04 Feb 2023 08:11:11 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: eH0WOaSpq7SULJZPx8XnL2DOsM2YBhewp3HVX/fKm249p0rg7/9JZIF51gZrjfGXprj74oWX45s=
x-amz-request-id: PPGV2FZGY34QVP93
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 04 Feb 2023 07:23:54 GMT
age: 2837
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 08:11:12 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Last-Modified, Cache-Control, Pragma, ETag, Backoff, Content-Type, Alert, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 04 Feb 2023 08:07:19 GMT
age: 233
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe

154.218.151.71

200 OK

8.0 kB

URL HTTP/1.1
19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (478), with CRLF, LF line terminators
Size
8.0 kB (7962 bytes)
Hash
b62c08899d4d88116dfe9502d8dfd125
9ef84c6a124ecfec84e742ca070ef2207ef02e52
f9359ba4c41e9d7c762de1113a9f4e84229468ecdbba4bbe3340e9ba2fbdaf04

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:12 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dedf9c519ac38c4bece9c5bc895787d7
4911175c3f8a435978c5301c33c7a99a5e00a1d5
bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698"
Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4280
Expires: Sat, 04 Feb 2023 09:22:32 GMT
Date: Sat, 04 Feb 2023 08:11:12 GMT
Connection: keep-alive

push.services.mozilla.com/

35.164.186.39

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.164.186.39:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 9cvmN0NjdM8X9RLuEr97/Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: fcx7E1ZTVVMhU7wS2Qy7YA0AeQ0=

19147.url.tudown.com/template/company/1014xiazai/css/base.css

154.218.151.71

200 OK

3.2 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/css/base.css
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
Unicode text, UTF-8 text
Size
3.2 kB (3163 bytes)
Hash
b752c4d83249982bcbcd13a723247bc0
1ccb18e4440bb1209190670ad392ceb8418d6b01
cbdadd44ddee5bd601b32c82c1946469bb2fe3bb6f99167a0a59ed2d2ebb4d0d

HTTP Headers

GET /template/company/1014xiazai/css/base.css HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:12 GMT
Content-Type: text/css
Last-Modified: Wed, 14 Oct 2020 04:36:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f86806a-29c1"
Expires: Sat, 04 Feb 2023 20:11:12 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

19147.url.tudown.com/js/orsxg5a.script

154.218.151.71

200 OK

531 B

URL HTTP/1.1
19147.url.tudown.com/js/orsxg5a.script
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
HTML document, ASCII text, with CRLF line terminators
Size
531 B (531 bytes)
Hash
39fd4f4c17d424445d9f437c99c9d40a
84a56ab95c669d43c757a5f9a312d5f3a37f73fa
45f58e7b2e72c9f2734889b73ef5c3f2d3e1fb9ac69995afe1561ec4a7943d15

HTTP Headers

GET /js/orsxg5a.script HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:12 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

19147.url.tudown.com/template/company/1014xiazai/css/style3500.css

154.218.151.71

200 OK

12 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/css/style3500.css
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
Unicode text, UTF-8 text, with very long lines (1113)
Size
12 kB (11804 bytes)
Hash
caee2cfa3291c35837be265cfc3e168c
2abdd423b8b6351b26d52da1faa5517fc76c1730
0f7482f2f6732e4b7f55fdd2eb6e41acb5864a53f19c404728652eabe9923dea

HTTP Headers

GET /template/company/1014xiazai/css/style3500.css HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: text/css
Last-Modified: Wed, 14 Oct 2020 04:36:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f86806a-c99c"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

19147.url.tudown.com/template/company/1014xiazai/js/jquery.uploadify.min.js

154.218.151.71

200 OK

548 B

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/jquery.uploadify.min.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size
548 B (548 bytes)
Hash
370e16c3b7dba286cff055f93b9a94d8
65f3537c3c798f7da146c55aef536f7b5d0cb943
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Detections

NIDS	Severity	Alert
suricata	medium	ETPRO HUNTING HTTP 200 Stat Code with 404 in Body

HTTP Headers

GET /template/company/1014xiazai/js/jquery.uploadify.min.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Content-Length: 548
Last-Modified: Wed, 14 Oct 2020 04:37:19 GMT
Connection: keep-alive
ETag: "5f86807f-224"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Accept-Ranges: bytes

19147.url.tudown.com/template/company/1014xiazai/js/member.js

154.218.151.71

200 OK

12 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/member.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
HTML document, Unicode text, UTF-8 text, with very long lines (364), with CRLF line terminators
Size
12 kB (11778 bytes)
Hash
a95b815530baa4c6efdad8929348d846
fb59238a8fa4c6e4b25dbd8956a7a4b4f8bdbff3
e0ac53257204eb74bc8c9c87b8fcbd55037c972324f10b1904d0610db932b555

HTTP Headers

GET /template/company/1014xiazai/js/member.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Last-Modified: Wed, 14 Oct 2020 04:37:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f868082-ceda"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

19147.url.tudown.com/template/company/1014xiazai/js/global.js

154.218.151.71

200 OK

2.8 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/global.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
Unicode text, UTF-8 text, with very long lines (345), with CRLF line terminators
Size
2.8 kB (2756 bytes)
Hash
26b58b731bc22007a9514da5788e5639
ff7a2a214e6a44becf3dd6bc1f70cbf3272d0695
7fc9b78cfc935e6eed582efc9002a03bdabeccfa6be21925c960248083b86113

HTTP Headers

GET /template/company/1014xiazai/js/global.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Last-Modified: Wed, 14 Oct 2020 04:37:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f86806e-1879"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

19147.url.tudown.com/template/company/1014xiazai/js/screenshots.js

154.218.151.71

200 OK

1.7 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/screenshots.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
ASCII text, with very long lines (3463), with CRLF line terminators
Size
1.7 kB (1743 bytes)
Hash
5f2d7d98f138edb321f4806bfcd16ca8
fac55732cfd8b6536b6ca8c257f3e1d11cfdf199
c9435192fb089165cfec52d7ab8f807a2b8a0fa533014bb9da0f659719e70d08

HTTP Headers

GET /template/company/1014xiazai/js/screenshots.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Last-Modified: Wed, 14 Oct 2020 04:37:06 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f868072-1219"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

19147.url.tudown.com/template/company/1014xiazai/js/loading.js

154.218.151.71

200 OK

1.5 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/loading.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
HTML document, Unicode text, UTF-8 text, with very long lines (613), with CRLF line terminators
Size
1.5 kB (1531 bytes)
Hash
2422ef78f8b0e865bc47afdacbc60161
f3cb0bf96ba8a395b5587fd8d74243e7572894b7
8ebd398c983e3d9b329d44bcdd9be269243b9838e0fcdbfcd3a814bc1255b39b

HTTP Headers

GET /template/company/1014xiazai/js/loading.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Last-Modified: Wed, 14 Oct 2020 04:37:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f86807e-1d0e"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

19147.url.tudown.com/template/company/1014xiazai/js/plugins.count.js

154.218.151.71

200 OK

683 B

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/plugins.count.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
ASCII text, with very long lines (525), with CRLF line terminators
Size
683 B (683 bytes)
Hash
9279ffdda939f259cbd5bd201b72ab71
12395c3521b33935aee973d761bf424add3a1e36
76fb346f9b8c62f7da6a752511aa20e147069607a28eb98fb843b650a2c6c203

HTTP Headers

GET /template/company/1014xiazai/js/plugins.count.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Last-Modified: Wed, 14 Oct 2020 04:37:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f868082-609"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ae58d39edb7923f0dac8e7b20767f306
827e75323edf1548d2b898b96caaec9556893e3a
2c18f66718230665099bdc4a96dbed4e667ff233f9853aebd3e0802235c658d8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2C18F66718230665099BDC4A96DBED4E667FF233F9853AEBD3E0802235C658D8"
Last-Modified: Thu, 02 Feb 2023 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17632
Expires: Sat, 04 Feb 2023 13:05:05 GMT
Date: Sat, 04 Feb 2023 08:11:13 GMT
Connection: keep-alive

19147.url.tudown.com/template/company/1014xiazai/js/jquery-1.8.2.min.js

154.218.151.71

200 OK

38 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/js/jquery-1.8.2.min.js
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
Unicode text, UTF-8 text, with very long lines (65480)
Size
38 kB (37670 bytes)
Hash
e96252242dc7d419f1f3d2ca4a1dec5d
b16a288a9bdc1b1050c1bee256dde6de54166b83
f62af873d226a9a37ba6bc7385d50888f03a99785135547f03b4aeec63a81fa1

HTTP Headers

GET /template/company/1014xiazai/js/jquery-1.8.2.min.js HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:13 GMT
Content-Type: application/javascript
Last-Modified: Wed, 14 Oct 2020 04:37:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f868082-16e8c"
Expires: Sat, 04 Feb 2023 20:11:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4947
Expires: Sat, 04 Feb 2023 09:33:41 GMT
Date: Sat, 04 Feb 2023 08:11:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4947
Expires: Sat, 04 Feb 2023 09:33:41 GMT
Date: Sat, 04 Feb 2023 08:11:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4947
Expires: Sat, 04 Feb 2023 09:33:41 GMT
Date: Sat, 04 Feb 2023 08:11:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4947
Expires: Sat, 04 Feb 2023 09:33:41 GMT
Date: Sat, 04 Feb 2023 08:11:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4947
Expires: Sat, 04 Feb 2023 09:33:41 GMT
Date: Sat, 04 Feb 2023 08:11:14 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F651be34f-d4ea-4a24-987c-b006e5f9a876.jpeg

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F651be34f-d4ea-4a24-987c-b006e5f9a876.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (13309 bytes)
Hash
f926cd4f39b1a10b152e5959b28ae29e
2b1982d21321071394e363888e007598e968fb35
a51b246a9aa5a2583cae7fd4f0a3bdf73f0b318b7838828d36ea5674a5f26753

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F651be34f-d4ea-4a24-987c-b006e5f9a876.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13309
x-amzn-requestid: f6a3f0f3-d91b-4f4d-8265-0f87742ba5d2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyFeBFX4oAMFfpA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd82bf-5808ceec265756c702d212dc;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:55:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: WWjzs8W8GmSAM0-Uc8XBTxz67RJJCIzp3fBYhkoIWZ26UrobmZV8mw==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:14:12 GMT
etag: "2b1982d21321071394e363888e007598e968fb35"
content-type: image/jpeg
age: 35822
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a6c7026-85a2-4419-bd6b-ba1bac463dda.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.5 kB (8527 bytes)
Hash
6661b7263315f5eb3cd2465f671e1fcd
b7b5831c6b3ccc41d7a980b6088adc10ff8785f1
eb25507950d81db4b54a1af7fadaceee1bcff780eb28b6a04dbfb3886785f5b7

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a6c7026-85a2-4419-bd6b-ba1bac463dda.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8527
x-amzn-requestid: 6a8c6487-6069-47d1-afa1-648626f85439
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyDqqGg5oAMFV-A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd7fdd-0a772cde1e6fba6d7da97435;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:42:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: CHWhIpyzhoPtMUplzh1430Q9FfCM1wkTc_hQsgQk6InM9tYBPGYnNg==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:05:44 GMT
age: 36330
etag: "b7b5831c6b3ccc41d7a980b6088adc10ff8785f1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd74fd89c-32f8-4ed4-ab23-e95f810fbc57.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.3 kB (9349 bytes)
Hash
4b5c35cdff2fb0758db780212b0b1f77
edbb557a3bf57128467335685aebbd4831d802f8
e0fa59843073ba8bd171c66610bc1b3d59a1a94c4991e6023507b9453ca0edba

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd74fd89c-32f8-4ed4-ab23-e95f810fbc57.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9349
x-amzn-requestid: ecd1913d-7dbe-4ffd-ba85-0549aab51a06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyayOGPlIAMFQ7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dda4da-6a9b8d146155fa8b6c1c02d6;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 00:20:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: jGBEz2d-SXXPBZhwlJgR4w248y-NY2c-18euLre5PULjWUIfhfUmNQ==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 00:30:47 GMT
age: 27627
etag: "edbb557a3bf57128467335685aebbd4831d802f8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11565 bytes)
Hash
e366b32074025aaf60bbae8bdb08d330
a52c2883bad98fa20333aa639a5dd3a5bf544c8e
9d661c26effaec9efee16833f6459d6ecbe4f77b822c9c46e2a6433bda816e5c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11565
x-amzn-requestid: 87a84ffd-1176-4656-aac4-e98f38ec2cd9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fboIrFGboAMFyyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d48704-162ed8114aa1809204500548;Sampled=0
x-amzn-remapped-date: Sat, 28 Jan 2023 02:23:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: lsQxPtozrh2Ty1T-3d-1crDfi8HgVKRafOXb1UFl033bCx3kAzTS7w==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 06:20:04 GMT
age: 6670
etag: "a52c2883bad98fa20333aa639a5dd3a5bf544c8e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcae6042d-d677-4e39-b4e4-858988eb847b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9141 bytes)
Hash
f7101f6e43855cb76ce48271a847ffbd
8e674830a97d8ce3818132fda197db4f0289d316
e78a83a4024e238bcdec3b9c4d5c12a99f49aabd57e34952f6a4cc8ed4422f55

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcae6042d-d677-4e39-b4e4-858988eb847b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9141
x-amzn-requestid: ed7db574-6bca-4f3e-8879-c3e836549339
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyD8zE5lIAMF1HA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8051-4480112f11d4ced0037d1ad8;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:44:49 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: aKr85ooofBPeKkeJIDO5W_X5Rn6xnJlRHmVrs8tgBMYe3HQhobsm3w==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 21:56:07 GMT
age: 36907
etag: "8e674830a97d8ce3818132fda197db4f0289d316"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F10640252-429d-4110-bf18-1908ac233402.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10253 bytes)
Hash
392b61306c346508d3ac4a2f28218f9c
d2de32b52e0d3f4fc6acaf687b3521294b01dc03
018712a4d6734b84ac1777124f97dae4d93b1e5b297a5dcfe0955b52710b8a35

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F10640252-429d-4110-bf18-1908ac233402.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10253
x-amzn-requestid: a90cb6b3-8a72-4b4b-b4f5-6dafc8c6752a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyD7GGv5IAMFu8A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8046-3ca59e7c52800a4e44bda8fd;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:44:38 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: jBxNmhfAeUgxg8w4XpQHZ1QoN9GatdUV7V7r2tHd7YePJYPHpesd2Q==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:05:21 GMT
age: 36353
etag: "d2de32b52e0d3f4fc6acaf687b3521294b01dc03"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

19147.url.tudown.com/uploads/images/609837.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/609837.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/609837.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img2.baidu.com/it/u=4101330877,2763654611&fm=253&fmt=auto?w=500&h=375

19147.url.tudown.com/uploads/images/182476.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/182476.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/182476.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://img0.baidu.com/it/u=236493224,1828024268&fm=253&app=120&f=JPEG?w=1422&h=800

19147.url.tudown.com/uploads/images/289425.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/289425.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/289425.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img1.baidu.com/it/u=2451065939,2179232251&fm=253&fmt=auto&app=138&f=JPG?w=397&h=645

19147.url.tudown.com/uploads/images/899320.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/899320.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/899320.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img0.baidu.com/it/u=260464696,3372985220&fm=253&fmt=auto&app=138&f=JPEG?w=400&h=710

19147.url.tudown.com/uploads/images/413752.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/413752.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/413752.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img0.baidu.com/it/u=1967811984,1890972519&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=308

19147.url.tudown.com/uploads/images/482967.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/482967.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/482967.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://img1.baidu.com/it/u=3520074141,629878444&fm=253&app=120&f=JPEG?w=1280&h=800

ocsp.globalsign.com/gsrsaovsslca2018

104.18.21.226

200 OK

1.4 kB

URL HTTP/1.1
ocsp.globalsign.com/gsrsaovsslca2018
IP
104.18.21.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.4 kB (1432 bytes)
Hash
fd85c457807ba420192d9fdb1e3b2e76
1309191996088c5e1bce3f6d5ca5b8ea2ff489ad
7d1c4dba2f7a95c9ec75b4f5abeb2b9d66abc8650424b896152f4d27fd3b4a8c

HTTP Headers

POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Wed, 08 Feb 2023 06:27:25 GMT
ETag: "1309191996088c5e1bce3f6d5ca5b8ea2ff489ad"
Last-Modified: Sat, 04 Feb 2023 06:27:26 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3566
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7941ef389889b515-OSL

19147.url.tudown.com/template/company/1014xiazai/images/icos.png

154.218.151.71

200 OK

15 kB

URL HTTP/1.1
19147.url.tudown.com/template/company/1014xiazai/images/icos.png
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
PNG image data, 166 x 300, 8-bit/color RGBA, non-interlaced\012- data
Size
15 kB (15004 bytes)
Hash
a4e686563c8daf2f139cc5c6629d2730
ad2a8926a53aa4f3e6de38b4e63a017182f8b514
38b01bc71af931846808835315e85841cd7bd42c640b0656b276cc5aeff018c4

HTTP Headers

GET /template/company/1014xiazai/images/icos.png HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/template/company/1014xiazai/css/base.css
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/png
Content-Length: 15004
Last-Modified: Wed, 14 Oct 2020 05:48:52 GMT
Connection: keep-alive
ETag: "5f869144-3a9c"
Accept-Ranges: bytes

19147.url.tudown.com/uploads/images/830334.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/830334.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/830334.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t15.baidu.com/it/u=3300204813,3793908592&fm=224&app=112&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/225829.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/225829.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/225829.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t13.baidu.com/it/u=164423245,1478100639&fm=224&app=112&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/737620.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/737620.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/737620.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img2.baidu.com/it/u=3363146563,757254913&fm=253&fmt=auto&app=138&f=JPEG?w=313&h=500

19147.url.tudown.com/uploads/images/403018.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/403018.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/403018.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img2.baidu.com/it/u=2688926110,2125781014&fm=253&fmt=auto&app=120&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/707762.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/707762.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/707762.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img1.baidu.com/it/u=3894510337,3342339241&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=746

19147.url.tudown.com/uploads/images/855372.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/855372.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/855372.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://img0.baidu.com/it/u=1852215905,124408758&fm=253&app=120&f=JPEG?w=1280&h=800

19147.url.tudown.com/uploads/images/295001.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/295001.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/295001.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t14.baidu.com/it/u=201885268,2703098843&fm=224&app=112&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/569445.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/569445.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/569445.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t15.baidu.com/it/u=1928007667,2265831670&fm=224&app=112&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/744415.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/744415.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/744415.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://img2.baidu.com/it/u=3792422041,3447389939&fm=253&app=120&f=JPEG?w=1280&h=800

19147.url.tudown.com/uploads/images/334909.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/334909.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/334909.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img0.baidu.com/it/u=1798045498,3325482606&fm=253&fmt=auto&app=138&f=JPEG?w=800&h=500

19147.url.tudown.com/uploads/images/721975.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/721975.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/721975.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t14.baidu.com/it/u=71046538,2967008886&fm=224&app=112&f=JPEG?w=500&h=500

img1.baidu.com/it/u=2451065939,2179232251&fm=253&fmt=auto&app=138&f=JPG?w=397&h=645

111.170.27.1

200 OK

19 kB

URL HTTP/2
img1.baidu.com/it/u=2451065939,2179232251&fm=253&fmt=auto&app=138&f=JPG?w=397&h=645
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 397x645, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
19 kB (19026 bytes)
Hash
26a0910b3898e67d146821f584ee7fd7
61501a1089268fc031390db0880f02fef6866d34
d7421c1b23a253aca95efa7bfd523b002bd6fd9a6336935b7e5c1c6a28f7b5d0

HTTP Headers

GET /it/u=2451065939,2179232251&fm=253&fmt=auto&app=138&f=JPG?w=397&h=645 HTTP/1.1
Host: img1.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 19026
expires: Mon, 06 Feb 2023 23:57:12 GMT
last-modified: Fri, 09 Jan 1970 00:00:00 GMT
etag: 26a0910b3898e67d146821f584ee7fd7
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Sat, 07 Jan 2023 23:57:12 GMT
ohc-cache-hit: xiangfct105 [1], czix105 [2]
ohc-file-size: 19026
x-cache-status: MISS
X-Firefox-Spdy: h2

19147.url.tudown.com/uploads/images/58238.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/58238.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/58238.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://img0.baidu.com/it/u=1828393767,2221414728&fm=253&app=138&f=JPEG?w=800&h=500

img2.baidu.com/it/u=4101330877,2763654611&fm=253&fmt=auto?w=500&h=375

111.170.27.1

200 OK

27 kB

URL HTTP/2
img2.baidu.com/it/u=4101330877,2763654611&fm=253&fmt=auto?w=500&h=375
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 500x375, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
27 kB (26578 bytes)
Hash
b16881ee81277032e27307f206bafe5c
12d705519eb05342f4062aa49abed93680f6dff8
dcdf1e13c04d27e74267d51beb999b44e77d265679decb1c8858d7368494310a

HTTP Headers

GET /it/u=4101330877,2763654611&fm=253&fmt=auto?w=500&h=375 HTTP/1.1
Host: img2.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 26578
expires: Tue, 28 Feb 2023 12:35:34 GMT
last-modified: Wed, 07 Jan 1970 00:00:00 GMT
etag: b16881ee81277032e27307f206bafe5c
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Sun, 29 Jan 2023 12:35:34 GMT
ohc-cache-hit: xiangfct89 [1], csix89 [4]
ohc-file-size: 26578
x-cache-status: MISS
X-Firefox-Spdy: h2

19147.url.tudown.com/uploads/images/306218.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/306218.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/306218.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://img0.baidu.com/it/u=1089538976,1066714642&fm=253&app=120&f=JPEG?w=1280&h=800

19147.url.tudown.com/uploads/images/logo.png?n=42ylrznxt3s3raxgw2eotgfs5cxl5zneq7t3xnhex6xopk4z&w=250

154.218.151.71

200 OK

3.7 kB

URL HTTP/1.1
19147.url.tudown.com/uploads/images/logo.png?n=42ylrznxt3s3raxgw2eotgfs5cxl5zneq7t3xnhex6xopk4z&w=250
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type
PNG image data, 250 x 66, 8-bit colormap, non-interlaced\012- data
Size
3.7 kB (3677 bytes)
Hash
25133ad3f7f16fb3c964465cef6e8493
308059daec7ca3b6381df58e5a316c1a3eb221b2
430ca1214a940fd2efd326b80a04aba47eb5101ebb196e53ad42b2fc67239f3f

HTTP Headers

GET /uploads/images/logo.png?n=42ylrznxt3s3raxgw2eotgfs5cxl5zneq7t3xnhex6xopk4z&w=250 HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive

19147.url.tudown.com/uploads/images/925931.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/925931.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/925931.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img0.baidu.com/it/u=1039606715,3013122277&fm=253&fmt=auto?w=640&h=337

19147.url.tudown.com/uploads/images/705501.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/705501.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/705501.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img0.baidu.com/it/u=3695460795,2785799515&fm=253&fmt=auto&app=138&f=JPEG?w=889&h=500

19147.url.tudown.com/uploads/images/893688.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/893688.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/893688.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t13.baidu.com/it/u=1746895854,3109469754&fm=224&app=112&f=JPEG?w=500&h=500

t14.baidu.com/it/u=71046538,2967008886&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

35 kB

URL HTTP/1.1
t14.baidu.com/it/u=71046538,2967008886&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
35 kB (34649 bytes)
Hash
72165ca6c883f15ef165cb0ae478bd7c
10566d8d24a7d8cc49e64a5997a3e02edf5ce22c
b3eb2afb8e00d2980783b835ea336baeb7f147cb33b9b2d653c455ff15dfb5df

HTTP Headers

GET /it/u=71046538,2967008886&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t14.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 34649
Connection: keep-alive
Expires: Sat, 04 Feb 2023 16:27:12 GMT
Last-Modified: Thu, 08 Jan 1970 00:00:00 GMT
ETag: 72165ca6c883f15ef165cb0ae478bd7c
Age: 2025639
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Thu, 05 Jan 2023 16:27:12 GMT
Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [4], zhuzuncache65 [1], csix78 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 34649
X-Cache-Status: HIT
Timing-Allow-Origin: *

t13.baidu.com/it/u=164423245,1478100639&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

50 kB

URL HTTP/1.1
t13.baidu.com/it/u=164423245,1478100639&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
50 kB (49778 bytes)
Hash
e31e4063fda82cb2a9a484ff790a795a
66c90e36e616ebb2a01584c523b15968ac661471
b4a3e7c4a780d1137500ceef4ea0848bd7c548f5f856f872839cf732f4857786

HTTP Headers

GET /it/u=164423245,1478100639&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t13.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 49778
Connection: keep-alive
Expires: Sun, 05 Mar 2023 20:50:25 GMT
Last-Modified: Tue, 13 Jan 1970 00:00:00 GMT
ETag: e31e4063fda82cb2a9a484ff790a795a
Age: 14944
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Fri, 03 Feb 2023 20:50:25 GMT
Ohc-Cache-HIT: fra01-sys-jomo0.fra01.baidu.com [2], zhuzuncache63 [1], bdix135 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 49778
X-Cache-Status: HIT
Timing-Allow-Origin: *

t14.baidu.com/it/u=201885268,2703098843&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

62 kB

URL HTTP/1.1
t14.baidu.com/it/u=201885268,2703098843&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
62 kB (61896 bytes)
Hash
aefcee65dff3dacf000cc99fc076f9df
ebf581af4de4e534bec7a48d15221d63e36e8ff0
b10bd314f49035f685d9948a3684b42e1883659ea3fa9f55099762ea0ec5f031

HTTP Headers

GET /it/u=201885268,2703098843&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t14.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 61896
Connection: keep-alive
Expires: Mon, 06 Feb 2023 06:43:51 GMT
Last-Modified: Sun, 18 Jan 1970 00:00:00 GMT
ETag: aefcee65dff3dacf000cc99fc076f9df
Age: 2026605
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Sat, 07 Jan 2023 06:43:51 GMT
Ohc-Cache-HIT: fra01-sys-jomo6.fra01.baidu.com [4], zhuzuncache50 [1], czix205 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 61896
X-Cache-Status: HIT
Timing-Allow-Origin: *

img1.baidu.com/it/u=3894510337,3342339241&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=746

111.170.27.1

200 OK

29 kB

URL HTTP/2
img1.baidu.com/it/u=3894510337,3342339241&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=746
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 500x746, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
29 kB (29220 bytes)
Hash
2ba9583d3002ba5507cb4901b755824e
b2e89c07734cf1a2534fa3617e963abdef0bfa9f
9cbbcca8609373929d333cb3682a2ab52c5c063fca8ead2d287df1d582d93ae3

HTTP Headers

GET /it/u=3894510337,3342339241&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=746 HTTP/1.1
Host: img1.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 29220
expires: Fri, 24 Feb 2023 10:18:27 GMT
last-modified: Sat, 10 Jan 1970 00:00:00 GMT
etag: 2ba9583d3002ba5507cb4901b755824e
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Wed, 25 Jan 2023 10:18:27 GMT
ohc-cache-hit: xiangfct53 [1], suzix53 [4]
ohc-file-size: 29220
x-cache-status: MISS
X-Firefox-Spdy: h2

img2.baidu.com/it/u=3363146563,757254913&fm=253&fmt=auto&app=138&f=JPEG?w=313&h=500

111.170.27.1

200 OK

26 kB

URL HTTP/2
img2.baidu.com/it/u=3363146563,757254913&fm=253&fmt=auto&app=138&f=JPEG?w=313&h=500
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 313x500, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
26 kB (25992 bytes)
Hash
f71fcae3f86b46570c9c9a520800abff
3ce06736fe34c108479a484a6716bca3aa6cb39a
5c3b7ef7f67bcbc844cf7cef78ac0c1050e9bf4f3b512b2c383cdecd01807310

HTTP Headers

GET /it/u=3363146563,757254913&fm=253&fmt=auto&app=138&f=JPEG?w=313&h=500 HTTP/1.1
Host: img2.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 25992
expires: Sun, 05 Feb 2023 13:59:31 GMT
last-modified: Fri, 09 Jan 1970 00:00:00 GMT
etag: f71fcae3f86b46570c9c9a520800abff
age: 185608
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Fri, 06 Jan 2023 13:59:31 GMT
ohc-cache-hit: xiangfct82 [4], csix82 [4]
ohc-file-size: 25992
x-cache-status: HIT
X-Firefox-Spdy: h2

img2.baidu.com/it/u=2688926110,2125781014&fm=253&fmt=auto&app=120&f=JPEG?w=500&h=500

111.170.27.1

200 OK

13 kB

URL HTTP/2
img2.baidu.com/it/u=2688926110,2125781014&fm=253&fmt=auto&app=120&f=JPEG?w=500&h=500
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 500x500, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
13 kB (12752 bytes)
Hash
b5533329e8cb1cd81e7492690f318c7e
0a080ad0ee78d6736ab6c0c40e1f3224c1bf683b
759a4a20d13777777cae4648894fa8e16b0e9e3e5e2c3b85574ea8baa5e4b6eb

HTTP Headers

GET /it/u=2688926110,2125781014&fm=253&fmt=auto&app=120&f=JPEG?w=500&h=500 HTTP/1.1
Host: img2.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 12752
expires: Tue, 14 Feb 2023 02:24:44 GMT
last-modified: Wed, 07 Jan 1970 00:00:00 GMT
etag: b5533329e8cb1cd81e7492690f318c7e
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Sun, 15 Jan 2023 02:24:44 GMT
ohc-cache-hit: xiangfct84 [1], suzix215 [4]
ohc-file-size: 12752
x-cache-status: MISS
X-Firefox-Spdy: h2

t15.baidu.com/it/u=3300204813,3793908592&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

29 kB

URL HTTP/1.1
t15.baidu.com/it/u=3300204813,3793908592&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
29 kB (29300 bytes)
Hash
1e1f9b2a14e25fe1cc1686c386259ba3
e14379a5179c8ae228000852c7701a552e8afe22
d3939de842a0d24f0bd700bae3d3e384db2abe31a2fc78887b049226ab43f9ee

HTTP Headers

GET /it/u=3300204813,3793908592&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t15.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 29300
Connection: keep-alive
Expires: Tue, 21 Feb 2023 04:26:30 GMT
Last-Modified: Fri, 09 Jan 1970 00:00:00 GMT
ETag: 1e1f9b2a14e25fe1cc1686c386259ba3
Age: 1125931
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Sun, 22 Jan 2023 04:26:30 GMT
Ohc-Cache-HIT: fra01-sys-jomo7.fra01.baidu.com [4], zhuzuncache51 [1], czix158 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 29300
X-Cache-Status: HIT
Timing-Allow-Origin: *

19147.url.tudown.com/uploads/images/449076.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/449076.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/449076.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img1.baidu.com/it/u=2496475843,3200580494&fm=253&fmt=auto&app=138&f=JPEG?w=310&h=310

img1.baidu.com/it/u=3520074141,629878444&fm=253&app=120&f=JPEG?w=1280&h=800

111.170.27.1

200 OK

187 kB

URL HTTP/1.1
img1.baidu.com/it/u=3520074141,629878444&fm=253&app=120&f=JPEG?w=1280&h=800
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x800, components 3\012- data
Size
187 kB (186752 bytes)
Hash
8c0c2cb0ec1759e93078a80b4e1b5d9d
03da17317ee1d3eabb5813ebe4a97491eeab4a10
7ff69f4552c9d1b3a54a01daa20a82676c1aa60c2266e8d8e171b4130c236fac

HTTP Headers

GET /it/u=3520074141,629878444&fm=253&app=120&f=JPEG?w=1280&h=800 HTTP/1.1
Host: img1.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:14 GMT
Content-Type: image/jpeg
Content-Length: 186752
Connection: keep-alive
Expires: Mon, 27 Feb 2023 00:59:38 GMT
Last-Modified: Sat, 10 Jan 1970 00:00:00 GMT
ETag: 8c0c2cb0ec1759e93078a80b4e1b5d9d
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Sat, 28 Jan 2023 00:59:38 GMT
Ohc-Cache-HIT: xiangfct76 [2], czix184 [4]
Ohc-File-Size: 186752
X-Cache-Status: MISS

19147.url.tudown.com/uploads/images/53030.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/53030.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/53030.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t13.baidu.com/it/u=365243921,906260665&fm=224&app=112&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/268776.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/268776.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/268776.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t15.baidu.com/it/u=496646664,2249254928&fm=224&app=112&f=JPEG?w=500&h=500

19147.url.tudown.com/uploads/images/204909.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/204909.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/204909.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://t15.baidu.com/it/u=3804319905,3775489454&fm=224&app=112&f=PNG?w=500&h=500

t15.baidu.com/it/u=1928007667,2265831670&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

60 kB

URL HTTP/1.1
t15.baidu.com/it/u=1928007667,2265831670&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
60 kB (59853 bytes)
Hash
332a195c9bc9c9ea18b527cb53535dca
792d0e5893a32fa7cfe38a7e17b503a1506dc72c
55a03c97a93b477cea6480796fc9ed11a169e721046477c52755a6f3f127a54b

HTTP Headers

GET /it/u=1928007667,2265831670&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t15.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 59853
Connection: keep-alive
Expires: Sun, 26 Feb 2023 01:54:34 GMT
Last-Modified: Tue, 06 Jan 1970 00:00:00 GMT
ETag: 332a195c9bc9c9ea18b527cb53535dca
Age: 364829
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Fri, 27 Jan 2023 01:54:34 GMT
Ohc-Cache-HIT: fra01-sys-jomo0.fra01.baidu.com [2], zhuzuncache59 [1], xaix95 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 59853
X-Cache-Status: HIT
Timing-Allow-Origin: *

t13.baidu.com/it/u=365243921,906260665&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

38 kB

URL HTTP/1.1
t13.baidu.com/it/u=365243921,906260665&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
38 kB (38100 bytes)
Hash
1d50b0591217551147b3f20f007d30a5
73c86aebad625d1f29122da51b4a7d83dcc62ab2
5fe4c623e89b3c6a5f0315437c5ce44c32758f574801cce4a99fe06b271ecfe9

HTTP Headers

GET /it/u=365243921,906260665&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t13.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 38100
Connection: keep-alive
Expires: Tue, 07 Feb 2023 15:02:38 GMT
Last-Modified: Fri, 09 Jan 1970 00:00:00 GMT
ETag: 1d50b0591217551147b3f20f007d30a5
Age: 2027131
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Sun, 08 Jan 2023 15:02:37 GMT
Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [4], zhuzuncache60 [4], suzix228 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 38100
X-Cache-Status: HIT
Timing-Allow-Origin: *

19147.url.tudown.com/uploads/images/652609.jpg

154.218.151.71

301 Moved Permanently

0 B

URL HTTP/1.1
19147.url.tudown.com/uploads/images/652609.jpg
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /uploads/images/652609.jpg HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpg; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://img1.baidu.com/it/u=1963733748,2400176741&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=818

hm.baidu.com/hm.js?dd9836db2e433f487a0aa434b7b3deb7

103.235.46.191

200 OK

11 kB

URL HTTP/1.1
hm.baidu.com/hm.js?dd9836db2e433f487a0aa434b7b3deb7
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
ASCII text, with very long lines (633)
Size
11 kB (11271 bytes)
Hash
75fd02789f6c1455e03d3b4bc8dd4dcd
3584f7b70dfefe371b97c5429008a40e624f89d3
406de43f6d34ba38080e3741f76cacb3db307d81d32d42aa87209aafa6b7ed2c

HTTP Headers

GET /hm.js?dd9836db2e433f487a0aa434b7b3deb7 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://19147.url.tudown.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11271
Content-Type: application/javascript
Date: Sat, 04 Feb 2023 08:11:15 GMT
Etag: 8b1de0b7824917a9dffc6d332941d62e
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=5303B3C431FF60D4; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

img0.baidu.com/it/u=236493224,1828024268&fm=253&app=120&f=JPEG?w=1422&h=800

111.170.27.1

200 OK

187 kB

URL HTTP/1.1
img0.baidu.com/it/u=236493224,1828024268&fm=253&app=120&f=JPEG?w=1422&h=800
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1422x800, components 3\012- data
Size
187 kB (187428 bytes)
Hash
7b4fbe3d25ba7c7dd072b948d48e9b56
00d5571ac61f08c4ac907429329df6ace285020e
af40ab7418182e9a3f3a3bffe9942fc621606dc36a57f0d0444a587c9ed1c80b

HTTP Headers

GET /it/u=236493224,1828024268&fm=253&app=120&f=JPEG?w=1422&h=800 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 187428
Connection: keep-alive
Expires: Wed, 15 Feb 2023 07:30:05 GMT
Last-Modified: Fri, 09 Jan 1970 00:00:00 GMT
ETag: 7b4fbe3d25ba7c7dd072b948d48e9b56
Age: 570276
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Mon, 16 Jan 2023 07:30:05 GMT
Ohc-Cache-HIT: xiangfct55 [4], qdix157 [2]
Ohc-File-Size: 187428
X-Cache-Status: HIT

t15.baidu.com/it/u=496646664,2249254928&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

21 kB

URL HTTP/1.1
t15.baidu.com/it/u=496646664,2249254928&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
21 kB (20785 bytes)
Hash
e1a94e99940f086be3d1d7c00d68d931
90658bcb1d987255678fc99e9ee2bcbca45c02da
62c690849c6d0df403421a391e15a4809cd1649f4ad16c2070f05c941689c1b2

HTTP Headers

GET /it/u=496646664,2249254928&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t15.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 20785
Connection: keep-alive
Expires: Thu, 09 Feb 2023 02:28:16 GMT
Last-Modified: Sat, 10 Jan 1970 00:00:00 GMT
ETag: e1a94e99940f086be3d1d7c00d68d931
Age: 2025993
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Tue, 10 Jan 2023 02:28:16 GMT
Ohc-Cache-HIT: fra01-sys-jomo3.fra01.baidu.com [2], zhuzuncache64 [4], suzix174 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 20785
X-Cache-Status: HIT
Timing-Allow-Origin: *

img0.baidu.com/it/u=1828393767,2221414728&fm=253&app=138&f=JPEG?w=800&h=500

111.170.27.1

200 OK

51 kB

URL HTTP/1.1
img0.baidu.com/it/u=1828393767,2221414728&fm=253&app=138&f=JPEG?w=800&h=500
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 800x500, components 3\012- data
Size
51 kB (51405 bytes)
Hash
cb2fb924aaac7e3597fbfa018fe31060
db9d6f08dc06b1b56eb66c6a5ef0129c826f6897
bae750de2efcad9b3fb5b92891ab2992a5b0255d171cee9040e81d67a67839ab

HTTP Headers

GET /it/u=1828393767,2221414728&fm=253&app=138&f=JPEG?w=800&h=500 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 51405
Connection: keep-alive
Expires: Mon, 06 Feb 2023 18:05:01 GMT
Last-Modified: Tue, 06 Jan 1970 00:00:00 GMT
ETag: cb2fb924aaac7e3597fbfa018fe31060
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Sat, 07 Jan 2023 18:05:01 GMT
Ohc-Cache-HIT: xiangfct52 [1], suzix52 [2]
Ohc-File-Size: 51405
X-Cache-Status: MISS

img0.baidu.com/it/u=1798045498,3325482606&fm=253&fmt=auto&app=138&f=JPEG?w=800&h=500

111.170.27.1

200 OK

46 kB

URL HTTP/2
img0.baidu.com/it/u=1798045498,3325482606&fm=253&fmt=auto&app=138&f=JPEG?w=800&h=500
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 800x500, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
46 kB (45730 bytes)
Hash
35a2829ff9d79ba12c8495f9b9ba5831
d90e25b8c84456cd0798e2b1c9813e2c54a9c6a3
b9e632f1afcc7d459e32541afd6bd24daaaa44ef6094a587ee90f7e99ffdc4d0

HTTP Headers

GET /it/u=1798045498,3325482606&fm=253&fmt=auto&app=138&f=JPEG?w=800&h=500 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 45730
expires: Mon, 20 Feb 2023 10:34:16 GMT
last-modified: Sun, 11 Jan 1970 00:00:00 GMT
etag: 35a2829ff9d79ba12c8495f9b9ba5831
age: 880625
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Sat, 21 Jan 2023 10:34:16 GMT
ohc-cache-hit: xiangfct108 [4], bdix158 [4]
ohc-file-size: 45730
x-cache-status: HIT
X-Firefox-Spdy: h2

img0.baidu.com/it/u=1967811984,1890972519&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=308

111.170.27.1

200 OK

17 kB

URL HTTP/2
img0.baidu.com/it/u=1967811984,1890972519&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=308
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 500x308, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
17 kB (16822 bytes)
Hash
3b58b6ffb1abb52ca2a8403091a71bf6
13ad0a09da1123a1f15cc75a4523152ed15e7ec9
1c88a76f28fb74c8c4f8333a6d7f387430bcb5fc0d844d7a2ee0befcbd054a99

HTTP Headers

GET /it/u=1967811984,1890972519&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=308 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 16822
expires: Mon, 20 Feb 2023 02:01:48 GMT
last-modified: Thu, 08 Jan 1970 00:00:00 GMT
etag: 3b58b6ffb1abb52ca2a8403091a71bf6
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Sat, 21 Jan 2023 02:01:48 GMT
ohc-cache-hit: xiangfct86 [1], xaix227 [2]
ohc-file-size: 16822
x-cache-status: MISS
X-Firefox-Spdy: h2

img1.baidu.com/it/u=2496475843,3200580494&fm=253&fmt=auto&app=138&f=JPEG?w=310&h=310

111.170.27.1

200 OK

28 kB

URL HTTP/2
img1.baidu.com/it/u=2496475843,3200580494&fm=253&fmt=auto&app=138&f=JPEG?w=310&h=310
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 310x310, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
28 kB (27670 bytes)
Hash
5a3448e560d40d2cc230da418dffc0b0
5a87218b1836c60da3603dc67fa5f90f3cace239
d762b883224a01ee156bd8a93df0287e3f9f94f8187e16b516d42977cb541011

HTTP Headers

GET /it/u=2496475843,3200580494&fm=253&fmt=auto&app=138&f=JPEG?w=310&h=310 HTTP/1.1
Host: img1.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 27670
expires: Wed, 08 Feb 2023 12:06:46 GMT
last-modified: Tue, 06 Jan 1970 00:00:00 GMT
etag: 5a3448e560d40d2cc230da418dffc0b0
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Mon, 09 Jan 2023 12:06:46 GMT
ohc-cache-hit: xiangfct82 [1], wzix82 [2]
ohc-file-size: 27670
x-cache-status: MISS
X-Firefox-Spdy: h2

img0.baidu.com/it/u=1852215905,124408758&fm=253&app=120&f=JPEG?w=1280&h=800

111.170.27.1

200 OK

100 kB

URL HTTP/1.1
img0.baidu.com/it/u=1852215905,124408758&fm=253&app=120&f=JPEG?w=1280&h=800
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x800, components 3\012- data
Size
100 kB (99673 bytes)
Hash
8c172c83b354f8095083afc014770142
2880de2ebe26b22651a3fc343c2a9d35f5b680f2
2a00a5c07b41dd9bb7be5d36516cea36c2c253ad0ea399f9f2ba19da9d564521

HTTP Headers

GET /it/u=1852215905,124408758&fm=253&app=120&f=JPEG?w=1280&h=800 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 99673
Connection: keep-alive
Expires: Wed, 15 Feb 2023 11:21:37 GMT
Last-Modified: Tue, 06 Jan 1970 00:00:00 GMT
ETag: 8c172c83b354f8095083afc014770142
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Mon, 16 Jan 2023 11:21:37 GMT
Ohc-Cache-HIT: xiangfct93 [1], wzix93 [4]
Ohc-File-Size: 99673
X-Cache-Status: MISS

img0.baidu.com/it/u=1039606715,3013122277&fm=253&fmt=auto?w=640&h=337

111.170.27.1

200 OK

17 kB

URL HTTP/2
img0.baidu.com/it/u=1039606715,3013122277&fm=253&fmt=auto?w=640&h=337
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 640x337, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
17 kB (17112 bytes)
Hash
2efc2110541ccf212976248eacfc744a
6dd4db7ec40fac2ebe7fa6297ccb2acd29f40cca
12ac2bb2332ba32de68b287f7d6c305888467627ce5d927072b237384cffc2e5

HTTP Headers

GET /it/u=1039606715,3013122277&fm=253&fmt=auto?w=640&h=337 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 17112
expires: Sun, 05 Feb 2023 04:46:20 GMT
last-modified: Tue, 06 Jan 1970 00:00:00 GMT
etag: 2efc2110541ccf212976248eacfc744a
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Fri, 06 Jan 2023 04:46:20 GMT
ohc-cache-hit: xiangfct77 [1], suzix185 [4]
ohc-file-size: 17112
x-cache-status: MISS
X-Firefox-Spdy: h2

t15.baidu.com/it/u=3804319905,3775489454&fm=224&app=112&f=PNG?w=500&h=500

185.10.104.124

200 OK

374 kB

URL HTTP/1.1
t15.baidu.com/it/u=3804319905,3775489454&fm=224&app=112&f=PNG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced\012- data
Size
374 kB (374122 bytes)
Hash
623a64ac2152bc5c05e8ce51a7b5f595
931a17a6246b97fe348ab7e31a7199073f7dab81
ff77c8a019c4f1c0b2fd2a4dc384e4c5e718b9b4168cd02610ea365d5299a903

HTTP Headers

GET /it/u=3804319905,3775489454&fm=224&app=112&f=PNG?w=500&h=500 HTTP/1.1
Host: t15.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/png
Content-Length: 374122
Connection: keep-alive
Expires: Thu, 16 Feb 2023 14:04:43 GMT
Last-Modified: Mon, 12 Jan 1970 00:00:00 GMT
ETag: 623a64ac2152bc5c05e8ce51a7b5f595
Age: 538384
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Tue, 17 Jan 2023 14:04:42 GMT
Ohc-Cache-HIT: fra01-sys-jomo5.fra01.baidu.com [4], zhuzuncache55 [1], wzix55 [4]
Ohc-Response-Time: 1 0 0 0 0 0
Ohc-File-Size: 374122
X-Cache-Status: HIT
Timing-Allow-Origin: *

img0.baidu.com/it/u=1089538976,1066714642&fm=253&app=120&f=JPEG?w=1280&h=800

180.97.66.35

200 OK

141 kB

URL HTTP/1.1
img0.baidu.com/it/u=1089538976,1066714642&fm=253&app=120&f=JPEG?w=1280&h=800
IP
180.97.66.35:0
ASN
#140292 CHINATELECOM Jiangsu province Suzhou 5G network

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x800, components 3\012- data
Size
141 kB (140822 bytes)
Hash
8e54f7fb8d7e45693e47a4ffa0b78b49
cc52352aea8ff27aadf47e515dfc80465944b0b8
6ad36af3d6d54b0f31aa5b900f128f32a2f9e720212cddcf9241288848e7d766

HTTP Headers

GET /it/u=1089538976,1066714642&fm=253&app=120&f=JPEG?w=1280&h=800 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 140822
Connection: keep-alive
Expires: Fri, 10 Feb 2023 07:13:08 GMT
Last-Modified: Fri, 16 Jan 1970 00:00:00 GMT
ETag: 8e54f7fb8d7e45693e47a4ffa0b78b49
Age: 478816
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Wed, 11 Jan 2023 07:13:07 GMT
Ohc-Cache-HIT: suz2ct69 [4], bdix116 [4]
Ohc-File-Size: 140822
X-Cache-Status: HIT

img0.baidu.com/it/u=260464696,3372985220&fm=253&fmt=auto&app=138&f=JPEG?w=400&h=710

111.170.27.1

200 OK

44 kB

URL HTTP/2
img0.baidu.com/it/u=260464696,3372985220&fm=253&fmt=auto&app=138&f=JPEG?w=400&h=710
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 400x710, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
44 kB (44094 bytes)
Hash
ad75707b5d5a0d077a5ddd14ba3a5c2e
ffd14b44e8f0c4214cf2ec61ef04c08faeb08b29
b84e6c414a2dddd0f1d2ba16b14da48c372e081f52ba4c6d2db4a5d78ba26c45

HTTP Headers

GET /it/u=260464696,3372985220&fm=253&fmt=auto&app=138&f=JPEG?w=400&h=710 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 44094
expires: Fri, 24 Feb 2023 09:59:23 GMT
last-modified: Wed, 07 Jan 1970 00:00:00 GMT
etag: ad75707b5d5a0d077a5ddd14ba3a5c2e
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Wed, 25 Jan 2023 09:59:23 GMT
ohc-cache-hit: xiangfct74 [1], wzix74 [2]
ohc-file-size: 44094
x-cache-status: MISS
X-Firefox-Spdy: h2

img1.baidu.com/it/u=1963733748,2400176741&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=818

111.170.27.1

200 OK

49 kB

URL HTTP/2
img1.baidu.com/it/u=1963733748,2400176741&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=818
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 500x818, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
49 kB (48720 bytes)
Hash
1e7df0527867f0f821b5da7e3000b0a6
f73c95fc2f1a3d877550637b62716d46c802e391
7fbfd4236e291035b0318b843cad202a35087ef306aeebf9ba28dd2cb532a423

HTTP Headers

GET /it/u=1963733748,2400176741&fm=253&fmt=auto&app=138&f=JPEG?w=500&h=818 HTTP/1.1
Host: img1.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:16 GMT
content-type: image/webp
content-length: 48720
expires: Sun, 05 Feb 2023 13:08:09 GMT
last-modified: Thu, 08 Jan 1970 00:00:00 GMT
etag: 1e7df0527867f0f821b5da7e3000b0a6
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Fri, 06 Jan 2023 13:08:09 GMT
ohc-cache-hit: xiangfct73 [1], csix73 [4]
ohc-file-size: 48720
x-cache-status: MISS
X-Firefox-Spdy: h2

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&lt=1675498311&rnd=935914686&si=dd9836db2e433f487a0aa434b7b3deb7&v=1.3.0&lv=2&sn=30501&r=0&ww=1280&u=http%3A%2F%2F19147.url.tudown.com%2Fxiaz%2Foffice2016%25E6%25BF%2580%25E6%25B4%25BB%25E5%25B7%25A5%25E5%2585%25B7kms%40418_71364.exe&tt=%E4%BA%9A%E5%8D%9A%E4%B9%B0%E5%BD%A9-%E6%9C%89%E4%BF%9D%E9%9A%9C(%E4%B8%AD%E5%9B%BD)%E5%AE%98%E6%96%B9%E7%BD%91%E7%AB%99v5.5.31

103.235.46.191

200 OK

43 B

URL HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&lt=1675498311&rnd=935914686&si=dd9836db2e433f487a0aa434b7b3deb7&v=1.3.0&lv=2&sn=30501&r=0&ww=1280&u=http%3A%2F%2F19147.url.tudown.com%2Fxiaz%2Foffice2016%25E6%25BF%2580%25E6%25B4%25BB%25E5%25B7%25A5%25E5%2585%25B7kms%40418_71364.exe&tt=%E4%BA%9A%E5%8D%9A%E4%B9%B0%E5%BD%A9-%E6%9C%89%E4%BF%9D%E9%9A%9C(%E4%B8%AD%E5%9B%BD)%E5%AE%98%E6%96%B9%E7%BD%91%E7%AB%99v5.5.31
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&lt=1675498311&rnd=935914686&si=dd9836db2e433f487a0aa434b7b3deb7&v=1.3.0&lv=2&sn=30501&r=0&ww=1280&u=http%3A%2F%2F19147.url.tudown.com%2Fxiaz%2Foffice2016%25E6%25BF%2580%25E6%25B4%25BB%25E5%25B7%25A5%25E5%2585%25B7kms%40418_71364.exe&tt=%E4%BA%9A%E5%8D%9A%E4%B9%B0%E5%BD%A9-%E6%9C%89%E4%BF%9D%E9%9A%9C(%E4%B8%AD%E5%9B%BD)%E5%AE%98%E6%96%B9%E7%BD%91%E7%AB%99v5.5.31 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://19147.url.tudown.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Sat, 04 Feb 2023 08:11:16 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=A9E8DCD88D9C5171; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

img2.baidu.com/it/u=3792422041,3447389939&fm=253&app=120&f=JPEG?w=1280&h=800

111.170.27.1

200 OK

190 kB

URL HTTP/1.1
img2.baidu.com/it/u=3792422041,3447389939&fm=253&app=120&f=JPEG?w=1280&h=800
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x800, components 3\012- data
Size
190 kB (189790 bytes)
Hash
b8da2eb9e0a37665182b2bf315255bba
144b9d16a635f6a0b070087bb24a5a386bc40079
d0b03160d35869f3438341ef81fc1ab4368a7052f0480bf0a103ab45f9e4dbb0

HTTP Headers

GET /it/u=3792422041,3447389939&fm=253&app=120&f=JPEG?w=1280&h=800 HTTP/1.1
Host: img2.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:15 GMT
Content-Type: image/jpeg
Content-Length: 189790
Connection: keep-alive
Expires: Tue, 28 Feb 2023 03:15:54 GMT
Last-Modified: Thu, 08 Jan 1970 00:00:00 GMT
ETag: b8da2eb9e0a37665182b2bf315255bba
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Sun, 29 Jan 2023 03:15:54 GMT
Ohc-Cache-HIT: xiangfct65 [2], xaix239 [4]
Ohc-File-Size: 189790
X-Cache-Status: MISS

img0.baidu.com/it/u=3695460795,2785799515&fm=253&fmt=auto&app=138&f=JPEG?w=889&h=500

111.170.27.1

200 OK

72 kB

URL HTTP/2
img0.baidu.com/it/u=3695460795,2785799515&fm=253&fmt=auto&app=138&f=JPEG?w=889&h=500
IP
111.170.27.1:0
ASN
#4134 Chinanet

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 889x500, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
72 kB (72544 bytes)
Hash
23f8946680056d579a182d5ab8d8e259
03768c783635e3c3a1cd18ba72d89a45be2d44a2
53f25549e82cdbec69d17d70b466c340ae10bd0231c88b677943d9e10dbebc39

HTTP Headers

GET /it/u=3695460795,2785799515&fm=253&fmt=auto&app=138&f=JPEG?w=889&h=500 HTTP/1.1
Host: img0.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://19147.url.tudown.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: JSP3/2.0.14
date: Sat, 04 Feb 2023 08:11:15 GMT
content-type: image/webp
content-length: 72544
expires: Sun, 05 Mar 2023 13:25:02 GMT
last-modified: Sun, 04 Jan 1970 00:00:00 GMT
etag: 23f8946680056d579a182d5ab8d8e259
age: 67573
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
ohc-global-saved-time: Fri, 03 Feb 2023 13:25:02 GMT
ohc-cache-hit: xiangfct87 [4], csix87 [1]
ohc-file-size: 72544
x-cache-status: HIT
X-Firefox-Spdy: h2

19147.url.tudown.com/favicon.ico

154.218.151.71

200 OK

0 B

URL HTTP/1.1
19147.url.tudown.com/favicon.ico
IP
154.218.151.71:0
ASN
#137951 Clayer Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 19147.url.tudown.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://19147.url.tudown.com/xiaz/office2016%E6%BF%80%E6%B4%BB%E5%B7%A5%E5%85%B7kms@418_71364.exe
Cookie: Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381; Hm_lvt_dd9836db2e433f487a0aa434b7b3deb7=1675497381,1675498311; Hm_lpvt_dd9836db2e433f487a0aa434b7b3deb7=1675498311

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 08:11:16 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Tue, 30 Jul 2019 15:51:36 GMT
Connection: keep-alive
ETag: "5d406788-0"
Accept-Ranges: bytes

t13.baidu.com/it/u=1746895854,3109469754&fm=224&app=112&f=JPEG?w=500&h=500

185.10.104.124

200 OK

42 kB

URL HTTP/1.1
t13.baidu.com/it/u=1746895854,3109469754&fm=224&app=112&f=JPEG?w=500&h=500
IP
185.10.104.124:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 500x500, components 3\012- data
Size
42 kB (41669 bytes)
Hash
87a11642df02e8382c83ab89b8d63a6c
0b5e4662af8f5c2d97f9a9ef8791afdb658a4d69
ac2bce823f505e5b01d4808bfb0f0568e42b9e96ee7b9be47b9b4228fedd54f8

HTTP Headers

GET /it/u=1746895854,3109469754&fm=224&app=112&f=JPEG?w=500&h=500 HTTP/1.1
Host: t13.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://19147.url.tudown.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sat, 04 Feb 2023 08:11:16 GMT
Content-Type: image/jpeg
Content-Length: 41669
Connection: keep-alive
Expires: Sun, 05 Feb 2023 06:32:38 GMT
Last-Modified: Sun, 11 Jan 1970 00:00:00 GMT
ETag: 87a11642df02e8382c83ab89b8d63a6c
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Ohc-Global-Saved-Time: Fri, 06 Jan 2023 06:32:37 GMT
Ohc-Upstream-Trace: 113.142.198.217; 58.20.204.55
Ohc-Cache-HIT: fra01-sys-jomo3.fra01.baidu.com [1], zhuzuncache55 [1], xaix217 [4]
Ohc-Response-Time: 1 0 0 0 384 384
Ohc-File-Size: 41669
X-Cache-Status: MISS
Timing-Allow-Origin: *

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (17)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML