| cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js |  104.17.25.14 | 200 OK | 28 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js IP104.17.25.14:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint64:3F:50:40:E0:BD:89:CB:A9:C8:BE:E5:74:F6:9E:D6:2E:1A:32:02 ValidityTue, 26 Nov 2024 07:25:18 GMT - Mon, 24 Feb 2025 07:25:17 GMT
File typeJavaScript source, ASCII text, with very long lines (65451) Hash220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: application/javascript; charset=utf-8
content-length: 27748
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-15851"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 879162
expires: Fri, 19 Dec 2025 16:36:32 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6HEIgCKgKGL%2FgmaITqH1THerQ3H5l0lVFSVA%2BSKvSZO%2BzFKCW3pU05w5cJU3Z3m%2FobwpoFn6%2Fy%2BdwjYd3aOAxXgQrlgjLLFA5GFCQw%2FqKxnzqzrXToa556ZgBikf7KfinBcsonwO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8f9b35a52c0e1c16-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js | 104.17.25.14 | 200 OK | 591 B |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js IP104.17.25.14:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint64:3F:50:40:E0:BD:89:CB:A9:C8:BE:E5:74:F6:9E:D6:2E:1A:32:02 ValidityTue, 26 Nov 2024 07:25:18 GMT - Mon, 24 Feb 2025 07:25:17 GMT
File typeJavaScript source, ASCII text, with very long lines (1266) Hash4412bf8023109ee9eb1f1f226d391329 c273960aa874a87dd022b5e597887142f1b8e34f d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
GET /ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: application/javascript; charset=utf-8
content-length: 591
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec1-514"
last-modified: Mon, 04 May 2020 16:11:45 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 733968
expires: Fri, 19 Dec 2025 16:36:32 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2FzkyRCilsVbh4xHBzSblCYUAipBDUPOMW8%2FWFJRQF8DFFmJcoUvzTNXUxctNp5tui0UC%2BhEQ4cDUHwpPAEI5d4c%2F9l14VmsK5KDWaesPvKMkG9jc49oVy3KBXVLiFXHC6TRMlVX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8f9b35a58cd31c16-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/Nwp5RitCm.jpg |  172.67.200.123 | 200 OK | 6.2 kB |
URL GET HTTP/2dx4.poopstream.co/Nwp5RitCm.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, baseline, precision 8, 320x168, components 3 Hashfe5285cd303e84076b6b0ea423585317 ced896902c4cba907d8da77538802c1041897359 1869b63ed5cc767246f41147f92eb7ef60bc2ab4bf5151e1d5d6f6e36876354f
GET /Nwp5RitCm.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 6181
etag: "fe5285cd303e84076b6b0ea423585317"
last-modified: Wed, 25 Dec 2024 06:02:48 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: HIT
age: 1207
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fbYVDb56ok%2FYYj5Ta5WyfrsQjI7mXDeo9QZ0okkZHfGIUPdjazM039sBKQffFUz%2BhRUbhMRDD05rY3cSGdNFaMQxMkQbs0yV0MZie12%2B25PTPN6hobsrrcHgQXOGq%2Bu5sjcqmw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebbab512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=658&min_rtt=468&rtt_var=243&sent=10&recv=22&lost=0&retrans=0&sent_bytes=3197&recv_bytes=1914&delivery_rate=3349267&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=74&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/b2Ss9rlFo.jpg | 172.67.200.123 | 200 OK | 9.7 kB |
URL GET HTTP/2dx4.poopstream.co/b2Ss9rlFo.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 240x519, components 3 Hash35b7dce6faa1f6fe640da81102b367cc b24d59ed9cf1191014e76cc405f40b6743cfc019 2438c599ac881f8ef2bb857b89ee262bd0e7b85752cc7b4a0872364b6bc775b6
GET /b2Ss9rlFo.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 9700
etag: "35b7dce6faa1f6fe640da81102b367cc"
last-modified: Sun, 29 Dec 2024 05:59:19 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: HIT
age: 2140
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vMWN4%2FgbBOegDCjG0FY5yf3%2FBH27LL1J8umDh%2B1ANmZ0a9dXYOCFwugUr5uB3MldY2wAtDfBzKFsCJZO%2FeimznFVatzkbS3HLAHmW3hPEhKPKKT5EJlM2ca6Sswp5AvKs7Azpg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5fbdbb512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=659&min_rtt=468&rtt_var=184&sent=17&recv=23&lost=0&retrans=0&sent_bytes=10199&recv_bytes=1914&delivery_rate=13025487&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=81&x=0"
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-RRBBHD087X | 142.250.74.168 | 200 OK | 110 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=G-RRBBHD087X IP142.250.74.168:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subject*.google-analytics.com FingerprintFA:A6:D6:5C:A6:DC:BE:D1:9A:34:42:70:3B:66:13:21:40:A4:C9:E4 ValidityMon, 02 Dec 2024 08:35:56 GMT - Mon, 24 Feb 2025 08:35:55 GMT
File typeJavaScript source, ASCII text, with very long lines (5945) Size110 kB (109870 bytes) Hash628222cfd6322a4b38c7652b570d2552 b1ea5c793e891d867f1fa7215ce699c46a98319a e3b1f5cc03c3b65f43ce47c4708fda79ae27de75b070641ac7d313453b156725
GET /gtag/js?id=G-RRBBHD087X HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 29 Dec 2024 16:36:32 GMT
expires: Sun, 29 Dec 2024 16:36:32 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
server: Google Tag Manager
content-length: 109870
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/YNNoMP8ZN.jpg | 172.67.200.123 | 200 OK | 6.6 kB |
URL GET HTTP/2dx4.poopstream.co/YNNoMP8ZN.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 240x427, components 3 Hash0f6968ec646c75925cc72a58c6da0e0a 9658b8e7f06851a3065932064ed3f555daf785ce e18f136a99960b190fafc25ab02d4dc94c7da799a048a777637176c5466d711f
GET /YNNoMP8ZN.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 6595
etag: "0f6968ec646c75925cc72a58c6da0e0a"
last-modified: Thu, 26 Dec 2024 03:45:35 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVdFAxXeaXO5ktGe1%2Fd11sGdgVU1TJBdh07PoGAIsYu%2BBjvjLeeRht0oI0ziuX3yLHrMJCsT1kY1IGah0GFkNoITX%2BzAOy5vaWO5zfBWiwjkyXu2zh2UMLhtIDL7TQYnYg%2Fvog%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebc1b512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1411&min_rtt=468&rtt_var=1417&sent=27&recv=25&lost=0&retrans=0&sent_bytes=20611&recv_bytes=1914&delivery_rate=13025487&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=360&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/6BHQKIkDn.jpg | 172.67.200.123 | 200 OK | 13 kB |
URL GET HTTP/2dx4.poopstream.co/6BHQKIkDn.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, baseline, precision 8, 288x640, components 3 Hashb3f71ee9e1cc522c51661d2552663ba3 608a137859ebc25ac326f8a146cb888a12fa9806 d19b2f89130832336133081a8c5454acf503f48f73bec832725cefaea3586236
GET /6BHQKIkDn.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 12710
accept-ranges: bytes
etag: "b3f71ee9e1cc522c51661d2552663ba3"
last-modified: Sat, 30 Nov 2024 04:06:52 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6tylt%2FE94jnnD1kWvLPlBvQhv0iXMrwK4CEZz6DBqNYuzYtnqKd5QSRLXX%2BdEpDRUh5IeiSs9Q4B8VEIkMd8F0zFk%2Bk%2F2%2FsKdEnyNhT6i1uw5PDk4HM7nOWQYPh4BsC9FMHMcA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebc4b512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1247&min_rtt=468&rtt_var=1079&sent=33&recv=27&lost=0&retrans=0&sent_bytes=27852&recv_bytes=1914&delivery_rate=13025487&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=367&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/uPnba.jpg | 172.67.200.123 | 200 OK | 7.8 kB |
URL GET HTTP/2dx4.poopstream.co/uPnba.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.54.100", baseline, precision 8, 240x426, components 3 Hash8e250f3ac77e1121ff903966501af0d1 cf478e7e4d8d7c9f31e9c710b9159ac90d8f2785 0b6b9382f491883d02e4ce313fac051f44083d2e32922fcc7055d9013f176816
GET /uPnba.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 7794
etag: "8e250f3ac77e1121ff903966501af0d1"
last-modified: Sat, 08 Jun 2024 23:20:12 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2FBb%2FHOhsgUmG35YOQo6y2mqEMuPYvvXDjr6fSGKAfYySsfkLjPOnYnU6t7oQ7At%2B3zNXGjVEEFParCPDOoBsIWIfAMKE1bmVa5JsKKfrmX79%2Fo9iydobDbpAJOJtUc6HsClNw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebc5b512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1066&min_rtt=468&rtt_var=733&sent=44&recv=30&lost=0&retrans=0&sent_bytes=41321&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=375&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/OCRY9.jpg | 172.67.200.123 | 200 OK | 12 kB |
URL GET HTTP/2dx4.poopstream.co/OCRY9.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 640x296, components 3 Hashfa037197b4bc2b5ba2caa42657b66ff6 f5f04e6f6ff50e6719d4bee794a1a2ca7cd7b9c6 6f43f17a6804c0f1cd7db0144e45531beb8e040e04813ef68e01321bb8234625
GET /OCRY9.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 12074
etag: "fa037197b4bc2b5ba2caa42657b66ff6"
last-modified: Fri, 02 Aug 2024 12:09:39 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYwWZ5w93uw8lWbHVMZroB3pRvKfEErpcr%2Bu70Rfy1NrVlEsKikjitlFZBmvOmdr%2B7XjeOdwLx72swPez6uIQv6ABWWuzjoM6FgLl6rBRFWwwCtlS2mqk7ynDEfaKiJQ1aby0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5fbdfb512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1000&min_rtt=468&rtt_var=682&sent=51&recv=31&lost=0&retrans=0&sent_bytes=49728&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=377&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/gvd5is2yl.jpg | 172.67.200.123 | 200 OK | 13 kB |
URL GET HTTP/2dx4.poopstream.co/gvd5is2yl.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 212x360, components 3 Hashf01d53a675f6192c82905b5f4a6632af c06e8e5cb5c5251ee876cdefc50bf1bb9ab76ba8 21ae4a66bf6061d91cd71527724817639fad126433544f482bd8c0739b4e010d
GET /gvd5is2yl.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 13005
etag: "f01d53a675f6192c82905b5f4a6632af"
last-modified: Thu, 19 Dec 2024 13:55:48 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eO1yo6PMTQZFvYgz%2FsPhZQ8xBEG9WcSSTztLA5ZbgKAJR10M6ZCcrFcUhBb3LzcPmEq9vCaB6zrBBUHiX5OLA4cdoWn0a6BVSn6q4ogLus9lRsRbEHUQielpFpJxebQV1BVNdw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5fbd4b512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1000&min_rtt=468&rtt_var=682&sent=62&recv=31&lost=0&retrans=0&sent_bytes=62545&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=377&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/V0tCI.jpg | 172.67.200.123 | 200 OK | 9.4 kB |
URL GET HTTP/2dx4.poopstream.co/V0tCI.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 24263x24222, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 202x360, components 3 Hash369a24957830ff93e33f20b284ded591 7bfd75828f5db7cb8b44f66143e3fafe88584aea fe40c449789ac3085c02f9e54c089385e9abc062f0d1e6f3dc332efeaa5384a5
GET /V0tCI.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 9413
etag: "369a24957830ff93e33f20b284ded591"
last-modified: Fri, 12 Jul 2024 09:46:00 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BmsaZ%2FYKpVE8UvhGyCZVyjLqUEn6GZ8l2jF%2Fl5MSaSgLn0YIDoF3p9beDVaQZQAk5jcX9ByeEkF9uL8hPTo2rKMYBDmyAJfAQvcmqFeqjL5ux09ZNwo%2B8MRq%2BCncVSdEzt4lPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebbdb512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1750&min_rtt=468&rtt_var=2011&sent=74&recv=32&lost=0&retrans=1&sent_bytes=76558&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=386&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/LWVcgZHOu.jpg | 172.67.200.123 | 200 OK | 5.8 kB |
URL GET HTTP/2dx4.poopstream.co/LWVcgZHOu.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, baseline, precision 8, 232x424, components 3 Hashdb0bd3b6d67cac0435cfbf7fe783668c 7de4bc7cca040847d27663eded0731c1b83b59ca 8bc3ecc90465da8367fa5ee4c5ddfc31d8c6261a2afd4f866cef4d45c9ab7ee9
GET /LWVcgZHOu.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 5827
etag: "db0bd3b6d67cac0435cfbf7fe783668c"
last-modified: Wed, 25 Dec 2024 11:11:00 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NeNKZ6n6rGZ9RUYvk1h6A%2BO8PFFVoPyLzZ1VTXxjqJTLb%2F12zRRSTum7g6HTHnJ6p7%2BAV60n%2BAXs8sigdgdIorVhG%2Fd%2Fg01mpl2TwlnEV7JG4pnpcP%2FcnsqMZuQtkQtoFwqQaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebb9b512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1024&min_rtt=468&rtt_var=601&sent=83&recv=41&lost=0&retrans=1&sent_bytes=86597&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=388&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/J99ejZ1Vo.jpg | 172.67.200.123 | 200 OK | 4.5 kB |
URL GET HTTP/2dx4.poopstream.co/J99ejZ1Vo.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 240x135, components 3 Hash5cfc702880c69378d6596820a1bf1e5e 245ea7ac1f931e9d04f077f8dff593a1c2797398 495ce00619aee2fb6f7783ab80f9a73e0781441ce3fc89add7c4f44fbffe10dc
GET /J99ejZ1Vo.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 4508
etag: "5cfc702880c69378d6596820a1bf1e5e"
last-modified: Mon, 23 Dec 2024 06:12:49 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Udnvoua9iqfouCgfvivB17b7rDu4RvnhpY8sM23Ri3i7ZoGbsm9Zcwu6pMEBZpL1Y8%2FqELNi%2BIqGPVlsHjzGLSc2A6KlWnJYdJXo15pdXfyT6her0s%2BrzMLp395jxWXUDg%2BpVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebbcb512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=775&min_rtt=468&rtt_var=291&sent=90&recv=48&lost=0&retrans=1&sent_bytes=92998&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=519&x=0"
X-Firefox-Spdy: h2
|
|
| dx4.poopstream.co/Lg9upjoq4.jpg | 172.67.200.123 | 200 OK | 9.4 kB |
URL GET HTTP/2dx4.poopstream.co/Lg9upjoq4.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 202x360, components 3 Hashd1cf61d5cff555ed57a3168439dcc954 1651865ac6dad88ea50fc0d456cd9f8ee5a2e0c7 a7a5b21e43d0c53b538075b2ffe4e085a5bbedd14490e05e9839615f1564c134
GET /Lg9upjoq4.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: image/jpeg
content-length: 9448
etag: "d1cf61d5cff555ed57a3168439dcc954"
last-modified: Mon, 23 Dec 2024 13:53:45 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gUfM2S4FNbqy2qcrP02cI28Rv4P0vbszC0XQlHih1DhqJUxx%2FvrqhkDsj%2FjG4DA8T5eFcewhbGDSYCdntNL2qHJi1VOwN9OdnLxmA036CKokJlAPDFbLvwV%2BA%2BbU0nzwvqoOhw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5fbd7b512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=680&min_rtt=468&rtt_var=168&sent=95&recv=53&lost=0&retrans=1&sent_bytes=98073&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=738&x=0"
X-Firefox-Spdy: h2
|
|
| ax4.poopstream.co/fonts/avertastd-regular-webfont.woff2 | 172.67.200.123 | 200 OK | 24 kB |
URL GET HTTP/2ax4.poopstream.co/fonts/avertastd-regular-webfont.woff2 IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectax4.poopstream.co Fingerprint2A:3B:7A:45:B3:66:2B:58:D6:9D:CD:11:2C:75:63:01:6D:0A:29:47 ValidityThu, 19 Dec 2024 09:08:50 GMT - Wed, 19 Mar 2025 10:08:49 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 23812, version 1.524 Hasheb586e5a1b86dbf1c866e3ed80f9d18e 280ee78d19c017ab9335f769595e5157d3c4a343 714e70103deac0d67f52a6285c5fabee6088ce4d710ce7e74353503837038baf
GET /fonts/avertastd-regular-webfont.woff2 HTTP/1.1
Host: ax4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://ax4.poopstream.co/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: font/woff2
content-length: 23812
access-control-allow-origin: https://poo.phd
etag: "eb586e5a1b86dbf1c866e3ed80f9d18e"
last-modified: Thu, 14 Mar 2024 17:32:25 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QLJQ79wa%2FMai6v65WdGav86HpDS0BoD5C0kszd2ZbsnlgqBTLTAftCrwmqu8hGG6bPZzy6VcAfullZkR%2BG3EG1TcqBXUZLShonMtnqcQ6y%2FKP3mnNbrxGmhvFK0Zhx9AhF0jkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a84bf60b41-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1051&min_rtt=522&rtt_var=622&sent=60&recv=20&lost=0&retrans=0&sent_bytes=70593&recv_bytes=1566&delivery_rate=5920945&cwnd=254&unsent_bytes=0&cid=44b9ee6d81b65ef8&ts=802&x=0"
X-Firefox-Spdy: h2
|
|
| ax4.poopstream.co/fonts/avertastd-bold-webfont.woff2 | 172.67.200.123 | 200 OK | 24 kB |
URL GET HTTP/2ax4.poopstream.co/fonts/avertastd-bold-webfont.woff2 IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectax4.poopstream.co Fingerprint2A:3B:7A:45:B3:66:2B:58:D6:9D:CD:11:2C:75:63:01:6D:0A:29:47 ValidityThu, 19 Dec 2024 09:08:50 GMT - Wed, 19 Mar 2025 10:08:49 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 23604, version 1.0 Hashe9133fd11f14c09a2e4556c395a0ef7d 00fad09605f3342df5c9aeba130156fe19ade8b0 06244cc9cd0c998581b1bf93f5222deee7d2d0b09299190e163961afa973ba91
GET /fonts/avertastd-bold-webfont.woff2 HTTP/1.1
Host: ax4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://ax4.poopstream.co/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: font/woff2
content-length: 23604
access-control-allow-origin: https://poo.phd
etag: "e9133fd11f14c09a2e4556c395a0ef7d"
last-modified: Thu, 14 Mar 2024 17:32:22 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Vf%2BEcHJup1ZjC2TTSocSmYOn23EZ7J9qTjLfRdpF2UWvvWw0z%2BNbZES1DwtS06F7MxYsMUfSMy3Ji9tBYua%2F7IVoYAKqOXRXAMN%2BZ9aydCWrgd%2F7jAGE%2BVZiiQAOei3exm0sw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a84bf70b41-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=830&min_rtt=522&rtt_var=157&sent=79&recv=29&lost=0&retrans=0&sent_bytes=95136&recv_bytes=1566&delivery_rate=31299203&cwnd=254&unsent_bytes=0&cid=44b9ee6d81b65ef8&ts=805&x=0"
X-Firefox-Spdy: h2
|
|
| poo.phd/favicon.ico | 104.21.48.1 | 301 Moved Permanently | 0 B |
IP104.21.48.1:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectpoo.phd FingerprintD6:36:DE:79:30:4A:6D:68:F7:8B:44:4B:F5:6B:48:0A:0F:05:B9:C0 ValidityFri, 20 Dec 2024 16:48:14 GMT - Thu, 20 Mar 2025 17:48:11 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: poo.phd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/top3?p=235
Cookie: _ga_RRBBHD087X=GS1.1.1735490192.1.0.1735490192.0.0.0; _ga=GA1.1.196203496.1735490193
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 301 Moved Permanently
date: Sun, 29 Dec 2024 16:36:33 GMT
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RC3PPXK04APk4h%2B1Iahhu3Dd3ezMOBR7%2Fxb2cGDbDwHrxLT9ttfPHcNG3FonLLE8U%2FXnGdcWGkPTMvcDzBhgT1T33bdIXGDqxo4cm9isJi2NSNfBIKBOTUfd"}],"group":"cf-nel","max_age":604800}
location: https://poo.phd/404
cf-ray: 8f9b35ab9df156c1-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
|
|
| fp.metricswpsh.com/fp?tag_id=114039 |  157.90.84.242 | 204 No Content | 0 B |
URL POST HTTP/1.1fp.metricswpsh.com/fp?tag_id=114039 IP157.90.84.242:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectnotification.tubecup.net FingerprintEE:9A:59:DB:A9:CD:73:0A:9C:87:AC:9F:FE:A1:90:AA:A1:7E:F8:D4 ValidityThu, 07 Nov 2024 10:40:28 GMT - Wed, 05 Feb 2025 10:40:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /fp?tag_id=114039 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://poo.phd/
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx/1.20.1
Date: Sun, 29 Dec 2024 16:36:33 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: https://poo.phd
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
|
|
| fp.metricswpsh.com/fp?tag_id=114039 | 157.90.84.242 | 500 Internal Server Error | 36 B |
URL POST HTTP/1.1fp.metricswpsh.com/fp?tag_id=114039 IP157.90.84.242:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectnotification.tubecup.net FingerprintEE:9A:59:DB:A9:CD:73:0A:9C:87:AC:9F:FE:A1:90:AA:A1:7E:F8:D4 ValidityThu, 07 Nov 2024 10:40:28 GMT - Wed, 05 Feb 2025 10:40:27 GMT
Hash0849660b654e3a313882a44c0e7dc08a b1493d6ce204eb99837d9b33849d1458093a6e6d 6e73b83ae8fcdaf81421a4236c9f817a9e4ea0fa931bf696f72872b266bd83e6
POST /fp?tag_id=114039 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 1948
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 500 Internal Server Error
Server: nginx/1.20.1
Date: Sun, 29 Dec 2024 16:36:33 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 36
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://poo.phd
Vary: Origin
|
|
| dx4.poopstream.co/sooUsSzjz.jpg | 172.67.200.123 | 200 OK | 13 kB |
URL GET HTTP/2dx4.poopstream.co/sooUsSzjz.jpg IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectdx4.poopstream.co FingerprintC4:6A:D4:A0:31:31:CD:0A:11:F1:11:D3:8B:8A:CC:C5:1B:9F:28:FC ValidityThu, 19 Dec 2024 08:02:41 GMT - Wed, 19 Mar 2025 09:02:38 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.134.100", baseline, precision 8, 427x240, components 3 Hash493777ea6b8a64d0ef254fd16c5fedd5 ec08155af4ca794078ecc56a939474b04a321b31 83f49995fcc6e55a65ad1e43cc1ac5d3ce050ef2ed455826cbc1aff4b841e514
GET /sooUsSzjz.jpg HTTP/1.1
Host: dx4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: image/jpeg
content-length: 12625
etag: "493777ea6b8a64d0ef254fd16c5fedd5"
last-modified: Fri, 20 Dec 2024 02:40:22 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TrruD3bgIlSOogJ0Xxt4ZP0ONW%2BzkFG2ZFQkRxWOdfJw%2FrxlBWLOm%2F9HRZoq0Hpsqr1O53FDmaLLDuQSH7O1W7r%2BDfuPgGcRvwExR022hk17bWuWTp2RrY70tVpnZYZQ68ti8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5ebbfb512-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=639&min_rtt=468&rtt_var=45&sent=104&recv=62&lost=0&retrans=1&sent_bytes=108265&recv_bytes=1914&delivery_rate=19786335&cwnd=254&unsent_bytes=0&cid=388ae3caef5a0ff7&ts=1396&x=0"
X-Firefox-Spdy: h2
|
|
| cb530ae596.66a5e92d66.com/a515e6c9347f685758684c0d7bcb7453.js | 45.133.44.52 | 200 OK | 31 kB |
URL GET HTTP/2cb530ae596.66a5e92d66.com/a515e6c9347f685758684c0d7bcb7453.js IP45.133.44.52:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectcb530ae596.66a5e92d66.com Fingerprint42:4B:A2:71:CF:CA:C4:37:5F:FA:2C:DE:68:F9:1D:80:57:61:11:11 ValidityThu, 26 Dec 2024 02:15:01 GMT - Wed, 26 Mar 2025 02:15:00 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashde644f1c86b24df53fd021f17f75ac2e 045c83a53bd32d3b059371255bf7b254f5a9233e e2169889c4ed69b44773f6b1bba57b4b49c2b62a7690d4ce66a192809fc90332
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /a515e6c9347f685758684c0d7bcb7453.js HTTP/1.1
Host: cb530ae596.66a5e92d66.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Wed, 11 Dec 2024 14:14:15 GMT
etag: W/"67599e37-1a372"
content-encoding: gzip
expires: Sun, 29 Dec 2024 16:41:33 GMT
cache-control: max-age=300
x-proxy-cache: HIT
x-cdn-host-id: ds8137
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| nereserv.com/in/dip?site=native-push&wl=1&event_id=221a5229-0726-4024-a812-ec9ba30908b3&subid=388464194&sid=398075959&spot_id=418776&created_at=2024-12-29&timezone=0&ver=7.370.0-b&is_native=1 | 116.202.204.105 | 200 OK | 0 B |
URL GET HTTP/2nereserv.com/in/dip?site=native-push&wl=1&event_id=221a5229-0726-4024-a812-ec9ba30908b3&subid=388464194&sid=398075959&spot_id=418776&created_at=2024-12-29&timezone=0&ver=7.370.0-b&is_native=1 IP116.202.204.105:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectnotification.tubecup.net FingerprintEE:9A:59:DB:A9:CD:73:0A:9C:87:AC:9F:FE:A1:90:AA:A1:7E:F8:D4 ValidityThu, 07 Nov 2024 10:40:28 GMT - Wed, 05 Feb 2025 10:40:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/dip?site=native-push&wl=1&event_id=221a5229-0726-4024-a812-ec9ba30908b3&subid=388464194&sid=398075959&spot_id=418776&created_at=2024-12-29&timezone=0&ver=7.370.0-b&is_native=1 HTTP/1.1
Host: nereserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.24.0
date: Sun, 29 Dec 2024 16:36:33 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| nereserv.com/in/dip?event_id=b56166d3-6cf6-4c5f-b711-924387823bfa&subid=500843478&spot_id=503362&created_at=2024-12-29&timezone=0&ver=1.158.2 | 116.202.204.105 | 200 OK | 0 B |
URL GET HTTP/2nereserv.com/in/dip?event_id=b56166d3-6cf6-4c5f-b711-924387823bfa&subid=500843478&spot_id=503362&created_at=2024-12-29&timezone=0&ver=1.158.2 IP116.202.204.105:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectnotification.tubecup.net FingerprintEE:9A:59:DB:A9:CD:73:0A:9C:87:AC:9F:FE:A1:90:AA:A1:7E:F8:D4 ValidityThu, 07 Nov 2024 10:40:28 GMT - Wed, 05 Feb 2025 10:40:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/dip?event_id=b56166d3-6cf6-4c5f-b711-924387823bfa&subid=500843478&spot_id=503362&created_at=2024-12-29&timezone=0&ver=1.158.2 HTTP/1.1
Host: nereserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.24.0
date: Sun, 29 Dec 2024 16:36:33 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/multy | 167.235.163.216 | 204 No Content | 0 B |
URL POST HTTP/23b71ae07b7.5bb3e0be1a.com/in/multy IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
OPTIONS /in/multy HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://poo.phd/
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:33 GMT
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/multy | 167.235.163.216 | 204 No Content | 0 B |
URL POST HTTP/23b71ae07b7.5bb3e0be1a.com/in/multy IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
OPTIONS /in/multy HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://poo.phd/
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:34 GMT
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| 42532fc91f.43512fee11.com/in/track?data=eyJ3bCI6MSwic3ViaWQiOjAsInVzZXJfaWQiOiI0NzczMDU3MTU4ODg4MjIzMDAwIiwidGltZXpvbmUiOjAsInZlciI6IjMuMTM2LjAiLCJ0YWdfaWQiOjExNDAzOSwic2NyZWVuX3Jlc29sdXRpb24iOiIxMjgweDEwMjQiLCJhZGJsb2NrIjowLCJ0aW1lem9uZV9vbHNvbiI6IlVUQyIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjE5LCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjB9 | 45.133.44.53 | 200 OK | 0 B |
URL GET HTTP/242532fc91f.43512fee11.com/in/track?data=eyJ3bCI6MSwic3ViaWQiOjAsInVzZXJfaWQiOiI0NzczMDU3MTU4ODg4MjIzMDAwIiwidGltZXpvbmUiOjAsInZlciI6IjMuMTM2LjAiLCJ0YWdfaWQiOjExNDAzOSwic2NyZWVuX3Jlc29sdXRpb24iOiIxMjgweDEwMjQiLCJhZGJsb2NrIjowLCJ0aW1lem9uZV9vbHNvbiI6IlVUQyIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjE5LCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjB9 IP45.133.44.53:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject42532fc91f.43512fee11.com FingerprintAE:18:5B:94:79:A3:AF:48:67:A5:FF:B2:66:A7:B3:CE:8B:93:D1:32 ValidityThu, 26 Dec 2024 02:47:59 GMT - Wed, 26 Mar 2025 02:47:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /in/track?data=eyJ3bCI6MSwic3ViaWQiOjAsInVzZXJfaWQiOiI0NzczMDU3MTU4ODg4MjIzMDAwIiwidGltZXpvbmUiOjAsInZlciI6IjMuMTM2LjAiLCJ0YWdfaWQiOjExNDAzOSwic2NyZWVuX3Jlc29sdXRpb24iOiIxMjgweDEwMjQiLCJhZGJsb2NrIjowLCJ0aW1lem9uZV9vbHNvbiI6IlVUQyIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjE5LCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjB9 HTTP/1.1
Host: 42532fc91f.43512fee11.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:34 GMT
content-length: 0
server: nginx/1.18.0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
x-cdn-host-id: ds8138
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Nunito:200,300,300i,400,600,600i,700,700i,800,900&display=swap | 142.250.74.106 | 200 OK | 1.3 kB |
URL GET HTTP/2fonts.googleapis.com/css?family=Nunito:200,300,300i,400,600,600i,700,700i,800,900&display=swap IP142.250.74.106:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint30:E5:7E:29:A5:A1:81:DB:C8:A8:49:80:67:40:12:AB:30:C0:34:8D ValidityMon, 02 Dec 2024 08:36:58 GMT - Mon, 24 Feb 2025 08:36:57 GMT
File typegzip compressed data, max compression Hashb8a5590939aed9a4d8e201c45e8ce654 4152cf79e088aec895aadc4ca16b0679be0166b0 b0c42df5538844d7da054f3169ed34ebe327d1a5408fa81955a36c54f62cfd7c
GET /css?family=Nunito:200,300,300i,400,600,600i,700,700i,800,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 29 Dec 2024 16:36:32 GMT
date: Sun, 29 Dec 2024 16:36:32 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube | 64.233.164.84 | 302 Found | 0 B |
URL GET HTTP/2accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube IP64.233.164.84:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:Z38jr4ifDRG1kZKGS035Pul3Y9WjbQ:je4EyKk1Okfjkmgi; Expires=Tue, 29-Dec-2026 16:36:34 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 29 Dec 2024 16:36:34 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP9-fpXPEQSUxV5so1EEkxbFmDsnuL29_xqvQRTw7mmcMMCt1X55oEMniojZCLCOwnMs2Tfm66Q
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'nonce-Fi9zwlljSszO2k8_TWmXXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-opener-policy: unsafe-none
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP9-fpXPEQSUxV5so1EEkxbFmDsnuL29_xqvQRTw7mmcMMCt1X55oEMniojZCLCOwnMs2Tfm66Q | 64.233.164.84 | 302 Found | 422 B |
URL GET HTTP/2accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP9-fpXPEQSUxV5so1EEkxbFmDsnuL29_xqvQRTw7mmcMMCt1X55oEMniojZCLCOwnMs2Tfm66Q IP64.233.164.84:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
File typeHTML document, ASCII text, with very long lines (393) Hashb4306a1f787c16e1a2254818bed4b263 cf377b7162d7c2e4fa22e4494ef02bb631edf1b0 4960eba6e90407ff3a2f78bf6197bcc9911b0cdea4d8d451eceec8281c884e62
GET /InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP9-fpXPEQSUxV5so1EEkxbFmDsnuL29_xqvQRTw7mmcMMCt1X55oEMniojZCLCOwnMs2Tfm66Q HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:6XGVuyepask3ph4-LFTyksy6wMztKQ:NYNidDZiyoMUczSd;Path=/;Expires=Tue, 29-Dec-2026 16:36:34 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 29 Dec 2024 16:36:34 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP98YXhaYf-9EXDu3jsNmuiXD4dj1SWItkEJnMQQy0vaLQkhHgYqLVhsa8C2bryvx95zGmcWo3Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1693746701%3A1735490194539257&ddm=1
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-Xdx6iQev0VU9hqRphLsSwA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 422
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/multy | 167.235.163.216 | 200 OK | 7.6 kB |
URL POST HTTP/23b71ae07b7.5bb3e0be1a.com/in/multy IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hash5bddba47162a488ff54b844333c5365d b0c353cf807b2fbaa8eba86a990f502ae07937aa 2439f9bdcdb7ce4c4ec2f131636a14ce95e284d3806fae81bf45143e8495fad0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /in/multy HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 1711
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: application/json
content-length: 7619
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| cb530ae596.66a5e92d66.com/e87454ed1c64bc1cf3034629a9c0ee6f.js | 45.133.44.52 | 200 OK | 139 kB |
URL GET HTTP/2cb530ae596.66a5e92d66.com/e87454ed1c64bc1cf3034629a9c0ee6f.js IP45.133.44.52:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectcb530ae596.66a5e92d66.com Fingerprint42:4B:A2:71:CF:CA:C4:37:5F:FA:2C:DE:68:F9:1D:80:57:61:11:11 ValidityThu, 26 Dec 2024 02:15:01 GMT - Wed, 26 Mar 2025 02:15:00 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators Size139 kB (138822 bytes) Hash5d3ab06c35229551faf7e6d25b181727 765dfaf68af4fbec99cb76a4097a8f58622d0c81 037a403ca83a38ca73a4215fd9d5a83222a79e85fb979d5b11cba52188d27ca7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /e87454ed1c64bc1cf3034629a9c0ee6f.js HTTP/1.1
Host: cb530ae596.66a5e92d66.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Sat, 28 Dec 2024 11:05:15 GMT
etag: W/"676fdb6b-86d8a"
content-encoding: gzip
expires: Sun, 29 Dec 2024 16:41:33 GMT
cache-control: max-age=300
x-proxy-cache: HIT
x-cdn-host-id: ds8137
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418776&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=388464194&sid=398075959&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418776&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=35.21306034194426&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D388464194%26spot_id%3D418776%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Ftrack-eu.trackingtraffo.com%2Fpop%2Fimp%3Fauth%3De28un1%26c%3Dx1oWIwIe1_yMAnfPs7XN_S5IVi1Z2Ep7r38XArOvWi4wEakJU36yerb-KXptrQTPZIjAjVWenpQYGlFFPqPc-C_rpW3qhwzb4HjVy71djfyGBuwcDYpsyUlhsN_k0eRMHSSf_JXM8D2AI5Q4Wv_ULgE1UOKrJLE8gFs-6cFlzR2WxAmT0W_UEPrcYzhHwMVeKc47k7R1XTIsPlussOj2dce3WWC0EbjSLr7WASVbqHjAl-cEjntC-H5Divam7Mla2KaFNwYlRcZ8bFGzJ4QEKJTJXMnmzLLJSQmcCmc2ci3ApTDvND-23cWb_Lr7Z5JGTWymG21LTtKltAtWu5CNms2sih6ISb0lCi5Vly0gdZJt0I-tyPLp8zmLuj2kV7RLFaEBhP64BL-5X97VM1YF2HLqmIjx1Bq9-KgPEaHNart1E29ox8T0BgTyj66DUntxY33HQDyhcnW5MTVK5GJ9VE-QZWEQydLT_JlmnzD-O9Oue51TP6xUkvvNCWWFwClB9ABK_GV0SPHxdxzZmEgDFfgpuzVLHiEWk040nHCFUseJ0Rp1bKXX7E9Pk3CF3evRVz4tyc0wDePYtViALnZskWVCpd6tDF6kgvOxIvDtJ219hoe86glEkA-YwQx2Veud8kwepveMC4iobaVCe3gg5oKFaiUP63nODWgdh0uq3zko5OTRcpd1YlfmUGJEWHD9LBUHKuJECowmyHLn&icons=tmC4ETDx1BXVYTjO9XaZZnrdTXVmn8cOJBEFIMpSZKO8ht0MZtjd18kQVPvM0_VbU17IYYFEVMm_d5xBxaUGhPRnb3qZ7F-XkEOG7t6IGtkFkaWgV3dVD9rEvlOL4c4FvxAwlTvfMulpoJYKNgPpjQ6n7Et0K2AaaJISury9FA2Lxykv4Q&ext_cid=0&px_id=121457705&min_cpm=0.02791226805292327&out_id=1&campaign_type=lq-pop&aid=3755&cid=19137&uniq=&mid=3274547384664732046&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.09590123777632953&cpm=0&verify_hash=2543a7f6d7a93126c3ff3c3e6d6f6e79&is_native=2&real_bid=0.002167020070552836&original_bid_usd=0.0027&original_bid=0.0027&show_type=0&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=20,27,150,70,108,0,4,89&need_redirect_show=0&applied_features=main-skins-settings,coef_095&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-adult&price=0.0027&hostname=auc-inpage-hz-9-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0.0000027000000000000004&ext_campaign_id_str=502&is_webview=0&client_price=0&direct_client_price=0&priority=0&client_payment_model=&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-b_l-body&mlf=1&mlc=1&st=0.02&cpa=3978687c-2b08-434d-b753-61625f04cf95&prev_step_diff=764 | 167.235.163.216 | 200 OK | 0 B |
URL GET HTTP/23b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418776&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=388464194&sid=398075959&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418776&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=35.21306034194426&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D388464194%26spot_id%3D418776%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Ftrack-eu.trackingtraffo.com%2Fpop%2Fimp%3Fauth%3De28un1%26c%3Dx1oWIwIe1_yMAnfPs7XN_S5IVi1Z2Ep7r38XArOvWi4wEakJU36yerb-KXptrQTPZIjAjVWenpQYGlFFPqPc-C_rpW3qhwzb4HjVy71djfyGBuwcDYpsyUlhsN_k0eRMHSSf_JXM8D2AI5Q4Wv_ULgE1UOKrJLE8gFs-6cFlzR2WxAmT0W_UEPrcYzhHwMVeKc47k7R1XTIsPlussOj2dce3WWC0EbjSLr7WASVbqHjAl-cEjntC-H5Divam7Mla2KaFNwYlRcZ8bFGzJ4QEKJTJXMnmzLLJSQmcCmc2ci3ApTDvND-23cWb_Lr7Z5JGTWymG21LTtKltAtWu5CNms2sih6ISb0lCi5Vly0gdZJt0I-tyPLp8zmLuj2kV7RLFaEBhP64BL-5X97VM1YF2HLqmIjx1Bq9-KgPEaHNart1E29ox8T0BgTyj66DUntxY33HQDyhcnW5MTVK5GJ9VE-QZWEQydLT_JlmnzD-O9Oue51TP6xUkvvNCWWFwClB9ABK_GV0SPHxdxzZmEgDFfgpuzVLHiEWk040nHCFUseJ0Rp1bKXX7E9Pk3CF3evRVz4tyc0wDePYtViALnZskWVCpd6tDF6kgvOxIvDtJ219hoe86glEkA-YwQx2Veud8kwepveMC4iobaVCe3gg5oKFaiUP63nODWgdh0uq3zko5OTRcpd1YlfmUGJEWHD9LBUHKuJECowmyHLn&icons=tmC4ETDx1BXVYTjO9XaZZnrdTXVmn8cOJBEFIMpSZKO8ht0MZtjd18kQVPvM0_VbU17IYYFEVMm_d5xBxaUGhPRnb3qZ7F-XkEOG7t6IGtkFkaWgV3dVD9rEvlOL4c4FvxAwlTvfMulpoJYKNgPpjQ6n7Et0K2AaaJISury9FA2Lxykv4Q&ext_cid=0&px_id=121457705&min_cpm=0.02791226805292327&out_id=1&campaign_type=lq-pop&aid=3755&cid=19137&uniq=&mid=3274547384664732046&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.09590123777632953&cpm=0&verify_hash=2543a7f6d7a93126c3ff3c3e6d6f6e79&is_native=2&real_bid=0.002167020070552836&original_bid_usd=0.0027&original_bid=0.0027&show_type=0&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=20,27,150,70,108,0,4,89&need_redirect_show=0&applied_features=main-skins-settings,coef_095&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-adult&price=0.0027&hostname=auc-inpage-hz-9-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0.0000027000000000000004&ext_campaign_id_str=502&is_webview=0&client_price=0&direct_client_price=0&priority=0&client_payment_model=&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-b_l-body&mlf=1&mlc=1&st=0.02&cpa=3978687c-2b08-434d-b753-61625f04cf95&prev_step_diff=764 IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /in/show/?tag_ab=c&site_id=31418776&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=388464194&sid=398075959&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418776&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=35.21306034194426&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D388464194%26spot_id%3D418776%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Ftrack-eu.trackingtraffo.com%2Fpop%2Fimp%3Fauth%3De28un1%26c%3Dx1oWIwIe1_yMAnfPs7XN_S5IVi1Z2Ep7r38XArOvWi4wEakJU36yerb-KXptrQTPZIjAjVWenpQYGlFFPqPc-C_rpW3qhwzb4HjVy71djfyGBuwcDYpsyUlhsN_k0eRMHSSf_JXM8D2AI5Q4Wv_ULgE1UOKrJLE8gFs-6cFlzR2WxAmT0W_UEPrcYzhHwMVeKc47k7R1XTIsPlussOj2dce3WWC0EbjSLr7WASVbqHjAl-cEjntC-H5Divam7Mla2KaFNwYlRcZ8bFGzJ4QEKJTJXMnmzLLJSQmcCmc2ci3ApTDvND-23cWb_Lr7Z5JGTWymG21LTtKltAtWu5CNms2sih6ISb0lCi5Vly0gdZJt0I-tyPLp8zmLuj2kV7RLFaEBhP64BL-5X97VM1YF2HLqmIjx1Bq9-KgPEaHNart1E29ox8T0BgTyj66DUntxY33HQDyhcnW5MTVK5GJ9VE-QZWEQydLT_JlmnzD-O9Oue51TP6xUkvvNCWWFwClB9ABK_GV0SPHxdxzZmEgDFfgpuzVLHiEWk040nHCFUseJ0Rp1bKXX7E9Pk3CF3evRVz4tyc0wDePYtViALnZskWVCpd6tDF6kgvOxIvDtJ219hoe86glEkA-YwQx2Veud8kwepveMC4iobaVCe3gg5oKFaiUP63nODWgdh0uq3zko5OTRcpd1YlfmUGJEWHD9LBUHKuJECowmyHLn&icons=tmC4ETDx1BXVYTjO9XaZZnrdTXVmn8cOJBEFIMpSZKO8ht0MZtjd18kQVPvM0_VbU17IYYFEVMm_d5xBxaUGhPRnb3qZ7F-XkEOG7t6IGtkFkaWgV3dVD9rEvlOL4c4FvxAwlTvfMulpoJYKNgPpjQ6n7Et0K2AaaJISury9FA2Lxykv4Q&ext_cid=0&px_id=121457705&min_cpm=0.02791226805292327&out_id=1&campaign_type=lq-pop&aid=3755&cid=19137&uniq=&mid=3274547384664732046&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.09590123777632953&cpm=0&verify_hash=2543a7f6d7a93126c3ff3c3e6d6f6e79&is_native=2&real_bid=0.002167020070552836&original_bid_usd=0.0027&original_bid=0.0027&show_type=0&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=20,27,150,70,108,0,4,89&need_redirect_show=0&applied_features=main-skins-settings,coef_095&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-adult&price=0.0027&hostname=auc-inpage-hz-9-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0.0000027000000000000004&ext_campaign_id_str=502&is_webview=0&client_price=0&direct_client_price=0&priority=0&client_payment_model=&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-b_l-body&mlf=1&mlc=1&st=0.02&cpa=3978687c-2b08-434d-b753-61625f04cf95&prev_step_diff=764 HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:34 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418776&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=388464194&sid=398075959&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418776&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=35.21306034194426&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D388464194%26spot_id%3D418776%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=1&resp_type=&crid=24406&crtid=788f015ade7a5a02de07cfccea6d71a8&url=https%3A%2F%2Fp.a64x.com%2Fin%2Ftip_clicks%2F%3Fkatds_ep%3DXzS8F1wlCRLMtFT8p9jqg20WYm6Hypppa89qtVmL2cNG3DOK8jZyYuLAVbstcq0svJ06FBMAS7rUo_t_DsXeWvlmX3O9gqXdQ_m72vlO2W4x5_zHbVl3qYqj0iyEM-KahaiODdoOZd0T1vzqrsqqtCZtT4VCBRZYHywGRYPn87delzuM9J75WQ7lwcVS5TI1UqxqFqqZBTbxMtl4bDlBRLz1Wo6plWAIiRRf77JHSY4he_Oj1Ub7GCuG6VWQK9vSQpp8vh-KjSXvk0DZwTCJQ84j3DT3_TuxYZo8OW3teDlFMxrHir4QeWTFET3eC69BJdXqK1RDM2v0mH-StEreGF2PzpYG0e7QL-3iRcdPedFyuLkH-w67XCZNdYSDNm-5W52nbjlAMnT35U8ijpOkC8SDnT_5CMlGy8OD-SieMARwcd7cJBhSOF6PapZdtFpE5nG90i1_TfdMVVpDmyEfA0m_9vrlLfzu0ytiNLoM5XEEAvbxlQEs4ZMDs_1zab3zDuY4v4lUQoEjXeJdRSIqVPLO8S2WzxEnPE3o6qQWOaoDLr6o8dt_h1P3w62tqjHeEdn8d6TtXYAsUCR_grGnUZ4kqgrBDfGBwJG2KXxkt1Nqy6JCvUj6xY6fG7FaEu8T53bIkUwXoW9vQDCqaPUh4UYxsuRMawhpCCF-q8B-1EQMtbF36DQKzMeFpOHSTVCLgDcp0XbJVqZ2dJb4ch_Z20cX3k6ZhOGSftLd5VKJInPODHcz4jPsQgpDkDn5KE80pCl95Ai_GFElNtPgCjXfaYqJUvDdIAjKl7DAYYBQkN6CLJIdkinKOuuXIeUw5PRlapUzjOqZqj65jZfSangr100Mqtvka8wKkkVVndgu4QL2CPJU5ZQ4eGCHiQItf9WIrS8i9GhY-N6opWPP3L910ywtoOvEKPk7lIyCyL1EJzPag3cT8Y90Y3BCRwP7-LiP11KWRoxZQepAvCojpAlDRWvSM8fMefLYhpg089clr2nhQkmmJTtLwWGUNAIIdeTTMnRZT8jtOqucKZ_X2QjiZtbrEn0CEiCgSNBtAfDGbPB95FNOgGjmD0MCxoG1BaypMt42goyD7lLcqWLJbRiI508H3WVTzxiQ59A-AVSXwcQioXP_1y_i8WgoqBamOWVLCLlPZNiwvsE_n0zw4Qjg9tJS9UQTMVhAPMdPnc5URr2c82T7wIWaA1cJw29GifPl-LcThe8E-RV_kiKK0esOg3ra9x0%26bid%3D0.10260885639060034&icons=i95udSUXjKNZxzAUSZ3pGddTTy7GtBTd1ZBh-0EY_RvyEk3uVcNbTbEdtII5AnMPOJGLyNuIkCvbrew0KphyzRvU-vzDucvKIEHF8iPDYUrMmvWp_42V9EfaRqaHrd3IdiKq6KhcWCntld02ENdWnCmZwNO5CQLmx4xIn1G0VFbXkna85YI4qwkR6du1R9w04TjKcHU7AsHLm9LDi2oy9GKgJwD48arjq06PdeOqk3ukt0OvmOyi2jRgPemRQCL-FKMbYQjjE5AjYgouIPjYTPt1I2JNMj81tsUDji79YMVP7BZjGkFbWbUQXzXsrxlsIDEUgYDedImmhOPw77yrZg0sH5WBkvvh9SrBWURyfpL640qKPVClYfipMR_aXEa-j9ovMHGjvvjNi3U7QglbDyYJJyeRO1NwvAcsPUynkoYgx2rclqo7aCCassF2Y2saWK0hJnn8tMyJcqsV-hORWUORqNm65VESiCcqpyT7sBsau2MNt1scBFammfsGxcsFq7MjhR5nIy1Ic_ZchxfYMPa5pIeO03J3AmW9L-70rBu7EPPpuvBrW0n_3UFWp5pOqruAkMb-ablX4XTniIQXv8luChjHuhaAxkFWtz_Lk12odsMD-xE1HanbfQuWgv0-hNqLag7bgFykgJov3PdQPMti_fTawXqyodcXX86INy9D--1w-uuUG8gTzGxmXZXX-cb0_KdHLOcNrYxSopXoXyj8yHerKVDHJt22G3q2NZCMGdOt8ygmJqW6Rh4mxW93Oe6Oll9QP-2688kcvO7MS2T38L8y9tHOX2HYJ2glWfGZ4Bu1q6wOQFvUPocJRQgLJfKehSgKJP9stBZANElI0RXcsSmPZGxVq7lsDF_2rfXXSR5uptkK8KDeBbmfiNbaV-HuMjzTLBo5LZ5WKUc3DxZDa_EQnqp8U2wBtryUqkMpaJfQUn3GWNsKNIYMvXgw1COm4bZVVD0bCOWTcrm0IrTviGGIEzuNerdWSK90NMDfYiOnO-VgpuwYP3vCI24MerBN6fEtFUuCaWtqFFK4w1s2LL_GRjXjsZUG1bEmg4juFsGtIbKxbBEatOfoaHIXBL4Cj47dntqnAx-08JdYAdfmHWvXTTctK8lK58Pa8EIoU_lljhOL21v8IgOXACdGbLxUYMIxxYcceWd-EZ9k3mE9hJOrfs40kIFEsVvX2rcn2bDqodPzsAeEZ9AR9WGanXHUwD3Vul99sF93KWwe321WXFbDm4tBRRyzwspheSkQvGzMYAETy2qxdhGDfWL9Rts2bR0uVxEMTwkO3uvz-6JzFgfHbVZwYwGD10bPSS482EQQ0S02ZCLet5nvJwmv9R-w-JnXbxNwqbyMqcfuMTcmBtpybeM-ICv_nXMATRiTUOh5s9bKUMjjanD6zZpfQZhasMtq5-TA3nvnif0Vw2Tml8O5NiHj&ext_cid=299547&px_id=73418776&min_cpm=0.002310380749834627&out_id=0&campaign_type=hq&aid=127&cid=12694&uniq=ac3453ce09538fe1d037a8c2f8b3ce2529c0ea68600fd53ab01b5ca4bd27fc9e&mid=3274547384664732046&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.12762036488021503&cpm=0.10260885639060034&verify_hash=a4ebec967c04a21fa8235b20949d19c1&is_native=1&real_bid=0.09863789523354169&original_bid_usd=0.1327581013514679&original_bid=0.1327581013514679&show_type=0&exp=1440&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=98,0,90,4,5,108&need_redirect_show=0&applied_features=coef_095,main-skins-settings&show_count=1&expiration_timestamp=1735662994&image_url=https%3A%2F%2Fgfxdn.pics%2Fm%2Fp%2F0%2F883%2F883207%2Fconversions%2F0OErF2ya-in-page-ad-images.jpg&site=native-push-adult&price=0&hostname=auc-inpage-hz-9-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0&ext_campaign_id_str=299547&is_webview=0&client_price=0.0288390004634856&direct_client_price=0&priority=0&client_payment_model=cpc&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-b_l-body&st=0.02&cpa=9365769e-6bd3-4cd7-86be-112f6957b380&prev_step_diff=764 | 167.235.163.216 | 200 OK | 0 B |
URL GET HTTP/23b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418776&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=388464194&sid=398075959&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418776&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=35.21306034194426&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D388464194%26spot_id%3D418776%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=1&resp_type=&crid=24406&crtid=788f015ade7a5a02de07cfccea6d71a8&url=https%3A%2F%2Fp.a64x.com%2Fin%2Ftip_clicks%2F%3Fkatds_ep%3DXzS8F1wlCRLMtFT8p9jqg20WYm6Hypppa89qtVmL2cNG3DOK8jZyYuLAVbstcq0svJ06FBMAS7rUo_t_DsXeWvlmX3O9gqXdQ_m72vlO2W4x5_zHbVl3qYqj0iyEM-KahaiODdoOZd0T1vzqrsqqtCZtT4VCBRZYHywGRYPn87delzuM9J75WQ7lwcVS5TI1UqxqFqqZBTbxMtl4bDlBRLz1Wo6plWAIiRRf77JHSY4he_Oj1Ub7GCuG6VWQK9vSQpp8vh-KjSXvk0DZwTCJQ84j3DT3_TuxYZo8OW3teDlFMxrHir4QeWTFET3eC69BJdXqK1RDM2v0mH-StEreGF2PzpYG0e7QL-3iRcdPedFyuLkH-w67XCZNdYSDNm-5W52nbjlAMnT35U8ijpOkC8SDnT_5CMlGy8OD-SieMARwcd7cJBhSOF6PapZdtFpE5nG90i1_TfdMVVpDmyEfA0m_9vrlLfzu0ytiNLoM5XEEAvbxlQEs4ZMDs_1zab3zDuY4v4lUQoEjXeJdRSIqVPLO8S2WzxEnPE3o6qQWOaoDLr6o8dt_h1P3w62tqjHeEdn8d6TtXYAsUCR_grGnUZ4kqgrBDfGBwJG2KXxkt1Nqy6JCvUj6xY6fG7FaEu8T53bIkUwXoW9vQDCqaPUh4UYxsuRMawhpCCF-q8B-1EQMtbF36DQKzMeFpOHSTVCLgDcp0XbJVqZ2dJb4ch_Z20cX3k6ZhOGSftLd5VKJInPODHcz4jPsQgpDkDn5KE80pCl95Ai_GFElNtPgCjXfaYqJUvDdIAjKl7DAYYBQkN6CLJIdkinKOuuXIeUw5PRlapUzjOqZqj65jZfSangr100Mqtvka8wKkkVVndgu4QL2CPJU5ZQ4eGCHiQItf9WIrS8i9GhY-N6opWPP3L910ywtoOvEKPk7lIyCyL1EJzPag3cT8Y90Y3BCRwP7-LiP11KWRoxZQepAvCojpAlDRWvSM8fMefLYhpg089clr2nhQkmmJTtLwWGUNAIIdeTTMnRZT8jtOqucKZ_X2QjiZtbrEn0CEiCgSNBtAfDGbPB95FNOgGjmD0MCxoG1BaypMt42goyD7lLcqWLJbRiI508H3WVTzxiQ59A-AVSXwcQioXP_1y_i8WgoqBamOWVLCLlPZNiwvsE_n0zw4Qjg9tJS9UQTMVhAPMdPnc5URr2c82T7wIWaA1cJw29GifPl-LcThe8E-RV_kiKK0esOg3ra9x0%26bid%3D0.10260885639060034&icons=i95udSUXjKNZxzAUSZ3pGddTTy7GtBTd1ZBh-0EY_RvyEk3uVcNbTbEdtII5AnMPOJGLyNuIkCvbrew0KphyzRvU-vzDucvKIEHF8iPDYUrMmvWp_42V9EfaRqaHrd3IdiKq6KhcWCntld02ENdWnCmZwNO5CQLmx4xIn1G0VFbXkna85YI4qwkR6du1R9w04TjKcHU7AsHLm9LDi2oy9GKgJwD48arjq06PdeOqk3ukt0OvmOyi2jRgPemRQCL-FKMbYQjjE5AjYgouIPjYTPt1I2JNMj81tsUDji79YMVP7BZjGkFbWbUQXzXsrxlsIDEUgYDedImmhOPw77yrZg0sH5WBkvvh9SrBWURyfpL640qKPVClYfipMR_aXEa-j9ovMHGjvvjNi3U7QglbDyYJJyeRO1NwvAcsPUynkoYgx2rclqo7aCCassF2Y2saWK0hJnn8tMyJcqsV-hORWUORqNm65VESiCcqpyT7sBsau2MNt1scBFammfsGxcsFq7MjhR5nIy1Ic_ZchxfYMPa5pIeO03J3AmW9L-70rBu7EPPpuvBrW0n_3UFWp5pOqruAkMb-ablX4XTniIQXv8luChjHuhaAxkFWtz_Lk12odsMD-xE1HanbfQuWgv0-hNqLag7bgFykgJov3PdQPMti_fTawXqyodcXX86INy9D--1w-uuUG8gTzGxmXZXX-cb0_KdHLOcNrYxSopXoXyj8yHerKVDHJt22G3q2NZCMGdOt8ygmJqW6Rh4mxW93Oe6Oll9QP-2688kcvO7MS2T38L8y9tHOX2HYJ2glWfGZ4Bu1q6wOQFvUPocJRQgLJfKehSgKJP9stBZANElI0RXcsSmPZGxVq7lsDF_2rfXXSR5uptkK8KDeBbmfiNbaV-HuMjzTLBo5LZ5WKUc3DxZDa_EQnqp8U2wBtryUqkMpaJfQUn3GWNsKNIYMvXgw1COm4bZVVD0bCOWTcrm0IrTviGGIEzuNerdWSK90NMDfYiOnO-VgpuwYP3vCI24MerBN6fEtFUuCaWtqFFK4w1s2LL_GRjXjsZUG1bEmg4juFsGtIbKxbBEatOfoaHIXBL4Cj47dntqnAx-08JdYAdfmHWvXTTctK8lK58Pa8EIoU_lljhOL21v8IgOXACdGbLxUYMIxxYcceWd-EZ9k3mE9hJOrfs40kIFEsVvX2rcn2bDqodPzsAeEZ9AR9WGanXHUwD3Vul99sF93KWwe321WXFbDm4tBRRyzwspheSkQvGzMYAETy2qxdhGDfWL9Rts2bR0uVxEMTwkO3uvz-6JzFgfHbVZwYwGD10bPSS482EQQ0S02ZCLet5nvJwmv9R-w-JnXbxNwqbyMqcfuMTcmBtpybeM-ICv_nXMATRiTUOh5s9bKUMjjanD6zZpfQZhasMtq5-TA3nvnif0Vw2Tml8O5NiHj&ext_cid=299547&px_id=73418776&min_cpm=0.002310380749834627&out_id=0&campaign_type=hq&aid=127&cid=12694&uniq=ac3453ce09538fe1d037a8c2f8b3ce2529c0ea68600fd53ab01b5ca4bd27fc9e&mid=3274547384664732046&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.12762036488021503&cpm=0.10260885639060034&verify_hash=a4ebec967c04a21fa8235b20949d19c1&is_native=1&real_bid=0.09863789523354169&original_bid_usd=0.1327581013514679&original_bid=0.1327581013514679&show_type=0&exp=1440&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=98,0,90,4,5,108&need_redirect_show=0&applied_features=coef_095,main-skins-settings&show_count=1&expiration_timestamp=1735662994&image_url=https%3A%2F%2Fgfxdn.pics%2Fm%2Fp%2F0%2F883%2F883207%2Fconversions%2F0OErF2ya-in-page-ad-images.jpg&site=native-push-adult&price=0&hostname=auc-inpage-hz-9-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0&ext_campaign_id_str=299547&is_webview=0&client_price=0.0288390004634856&direct_client_price=0&priority=0&client_payment_model=cpc&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-b_l-body&st=0.02&cpa=9365769e-6bd3-4cd7-86be-112f6957b380&prev_step_diff=764 IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /in/show/?tag_ab=c&site_id=31418776&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=388464194&sid=398075959&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418776&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=35.21306034194426&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D388464194%26spot_id%3D418776%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=1&resp_type=&crid=24406&crtid=788f015ade7a5a02de07cfccea6d71a8&url=https%3A%2F%2Fp.a64x.com%2Fin%2Ftip_clicks%2F%3Fkatds_ep%3DXzS8F1wlCRLMtFT8p9jqg20WYm6Hypppa89qtVmL2cNG3DOK8jZyYuLAVbstcq0svJ06FBMAS7rUo_t_DsXeWvlmX3O9gqXdQ_m72vlO2W4x5_zHbVl3qYqj0iyEM-KahaiODdoOZd0T1vzqrsqqtCZtT4VCBRZYHywGRYPn87delzuM9J75WQ7lwcVS5TI1UqxqFqqZBTbxMtl4bDlBRLz1Wo6plWAIiRRf77JHSY4he_Oj1Ub7GCuG6VWQK9vSQpp8vh-KjSXvk0DZwTCJQ84j3DT3_TuxYZo8OW3teDlFMxrHir4QeWTFET3eC69BJdXqK1RDM2v0mH-StEreGF2PzpYG0e7QL-3iRcdPedFyuLkH-w67XCZNdYSDNm-5W52nbjlAMnT35U8ijpOkC8SDnT_5CMlGy8OD-SieMARwcd7cJBhSOF6PapZdtFpE5nG90i1_TfdMVVpDmyEfA0m_9vrlLfzu0ytiNLoM5XEEAvbxlQEs4ZMDs_1zab3zDuY4v4lUQoEjXeJdRSIqVPLO8S2WzxEnPE3o6qQWOaoDLr6o8dt_h1P3w62tqjHeEdn8d6TtXYAsUCR_grGnUZ4kqgrBDfGBwJG2KXxkt1Nqy6JCvUj6xY6fG7FaEu8T53bIkUwXoW9vQDCqaPUh4UYxsuRMawhpCCF-q8B-1EQMtbF36DQKzMeFpOHSTVCLgDcp0XbJVqZ2dJb4ch_Z20cX3k6ZhOGSftLd5VKJInPODHcz4jPsQgpDkDn5KE80pCl95Ai_GFElNtPgCjXfaYqJUvDdIAjKl7DAYYBQkN6CLJIdkinKOuuXIeUw5PRlapUzjOqZqj65jZfSangr100Mqtvka8wKkkVVndgu4QL2CPJU5ZQ4eGCHiQItf9WIrS8i9GhY-N6opWPP3L910ywtoOvEKPk7lIyCyL1EJzPag3cT8Y90Y3BCRwP7-LiP11KWRoxZQepAvCojpAlDRWvSM8fMefLYhpg089clr2nhQkmmJTtLwWGUNAIIdeTTMnRZT8jtOqucKZ_X2QjiZtbrEn0CEiCgSNBtAfDGbPB95FNOgGjmD0MCxoG1BaypMt42goyD7lLcqWLJbRiI508H3WVTzxiQ59A-AVSXwcQioXP_1y_i8WgoqBamOWVLCLlPZNiwvsE_n0zw4Qjg9tJS9UQTMVhAPMdPnc5URr2c82T7wIWaA1cJw29GifPl-LcThe8E-RV_kiKK0esOg3ra9x0%26bid%3D0.10260885639060034&icons=i95udSUXjKNZxzAUSZ3pGddTTy7GtBTd1ZBh-0EY_RvyEk3uVcNbTbEdtII5AnMPOJGLyNuIkCvbrew0KphyzRvU-vzDucvKIEHF8iPDYUrMmvWp_42V9EfaRqaHrd3IdiKq6KhcWCntld02ENdWnCmZwNO5CQLmx4xIn1G0VFbXkna85YI4qwkR6du1R9w04TjKcHU7AsHLm9LDi2oy9GKgJwD48arjq06PdeOqk3ukt0OvmOyi2jRgPemRQCL-FKMbYQjjE5AjYgouIPjYTPt1I2JNMj81tsUDji79YMVP7BZjGkFbWbUQXzXsrxlsIDEUgYDedImmhOPw77yrZg0sH5WBkvvh9SrBWURyfpL640qKPVClYfipMR_aXEa-j9ovMHGjvvjNi3U7QglbDyYJJyeRO1NwvAcsPUynkoYgx2rclqo7aCCassF2Y2saWK0hJnn8tMyJcqsV-hORWUORqNm65VESiCcqpyT7sBsau2MNt1scBFammfsGxcsFq7MjhR5nIy1Ic_ZchxfYMPa5pIeO03J3AmW9L-70rBu7EPPpuvBrW0n_3UFWp5pOqruAkMb-ablX4XTniIQXv8luChjHuhaAxkFWtz_Lk12odsMD-xE1HanbfQuWgv0-hNqLag7bgFykgJov3PdQPMti_fTawXqyodcXX86INy9D--1w-uuUG8gTzGxmXZXX-cb0_KdHLOcNrYxSopXoXyj8yHerKVDHJt22G3q2NZCMGdOt8ygmJqW6Rh4mxW93Oe6Oll9QP-2688kcvO7MS2T38L8y9tHOX2HYJ2glWfGZ4Bu1q6wOQFvUPocJRQgLJfKehSgKJP9stBZANElI0RXcsSmPZGxVq7lsDF_2rfXXSR5uptkK8KDeBbmfiNbaV-HuMjzTLBo5LZ5WKUc3DxZDa_EQnqp8U2wBtryUqkMpaJfQUn3GWNsKNIYMvXgw1COm4bZVVD0bCOWTcrm0IrTviGGIEzuNerdWSK90NMDfYiOnO-VgpuwYP3vCI24MerBN6fEtFUuCaWtqFFK4w1s2LL_GRjXjsZUG1bEmg4juFsGtIbKxbBEatOfoaHIXBL4Cj47dntqnAx-08JdYAdfmHWvXTTctK8lK58Pa8EIoU_lljhOL21v8IgOXACdGbLxUYMIxxYcceWd-EZ9k3mE9hJOrfs40kIFEsVvX2rcn2bDqodPzsAeEZ9AR9WGanXHUwD3Vul99sF93KWwe321WXFbDm4tBRRyzwspheSkQvGzMYAETy2qxdhGDfWL9Rts2bR0uVxEMTwkO3uvz-6JzFgfHbVZwYwGD10bPSS482EQQ0S02ZCLet5nvJwmv9R-w-JnXbxNwqbyMqcfuMTcmBtpybeM-ICv_nXMATRiTUOh5s9bKUMjjanD6zZpfQZhasMtq5-TA3nvnif0Vw2Tml8O5NiHj&ext_cid=299547&px_id=73418776&min_cpm=0.002310380749834627&out_id=0&campaign_type=hq&aid=127&cid=12694&uniq=ac3453ce09538fe1d037a8c2f8b3ce2529c0ea68600fd53ab01b5ca4bd27fc9e&mid=3274547384664732046&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.12762036488021503&cpm=0.10260885639060034&verify_hash=a4ebec967c04a21fa8235b20949d19c1&is_native=1&real_bid=0.09863789523354169&original_bid_usd=0.1327581013514679&original_bid=0.1327581013514679&show_type=0&exp=1440&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=98,0,90,4,5,108&need_redirect_show=0&applied_features=coef_095,main-skins-settings&show_count=1&expiration_timestamp=1735662994&image_url=https%3A%2F%2Fgfxdn.pics%2Fm%2Fp%2F0%2F883%2F883207%2Fconversions%2F0OErF2ya-in-page-ad-images.jpg&site=native-push-adult&price=0&hostname=auc-inpage-hz-9-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0&ext_campaign_id_str=299547&is_webview=0&client_price=0.0288390004634856&direct_client_price=0&priority=0&client_payment_model=cpc&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-b_l-body&st=0.02&cpa=9365769e-6bd3-4cd7-86be-112f6957b380&prev_step_diff=764 HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:34 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418774&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=357529620&sid=7396243&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418774&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=34.2497673468025&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D357529620%26spot_id%3D418774%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Ftrack-eu.trackingtraffo.com%2Fpop%2Fimp%3Fauth%3De28un1%26c%3Ddt8dSiv_SCKy4nrBtKsmUdX4rRjDbLPZvQJd_Ql95OJh9ABTuimhN0XUCSTXl94h5OJmQzVzcPQ1uhpIPN_D2pddt3BzwOjU65x8wV-1vw7Sj6JrFTRD8BC6PNyn9UGR75aOLACgx0_mXi_zn5e72s4RYS71HcUM9zkFv8BTxoEqfVpV4i4sr_IhmhT8RSMzLcLemrt8km-2jaelTRGklj4YNqa7QdV5xaKFPUyadPW14NLmatJtPg15EujG34sTq7WmAiCKBSH0PhN1Sb2riytNyMfOtXNL-urjcEQ2dGDdoUZ8H7VbXG8kOp-OqHDjaQ62YAUQH39NPUYhPL03hRlg7S9qLUjmuQszllCXF9vpGNWFELoC1woIpo2Y16zmGmG_TIOfDOykfeL-MIgBK8fHlScMwanRAei4SAy35oWHstJwH0nW3dYEb05-b2zfPvSXBEEOcPxk7woGUabiKJs44ofh4xcO5CODcnB0I8h_RlwlKaZ5H3QtV98CgLTJXmfkpUDaNxZNAEiq_teMtFyDhakw6_iBroZRgY6Ox_mXfWrLyAwEwlC64Et3nNMt32AG5VV_FJtwH6i63ffUtdokOV3GfpBWMFe-jgAuWdibmucrxLqyb2xduNHd9PQDN0K15S9DyHuZsF7HgWG4YiEyRNvBv2_FzseCiLhKierbr4F3P6mk-U90thPFUOC7PGVB-tjmTeNtd5ad&icons=-Tq6_Cex7DzNPq9mTAqlJ6TGjBfy348G3oCyx8AA8nvg1WTiIK4pLcrhW7f0bc1BhRlned8e1lT5P4WqdkIJUEjhP0-fNzKik-5rvFb7FTbj-U2BpWzcmCn-n_K3TbpmQaybULMSiFAdtwlwVe1sKZk0Yth1yURPPxRdmynRRu1k4A1zPg&ext_cid=0&px_id=121457703&min_cpm=0.024801727435080106&out_id=1&campaign_type=lq-pop&aid=3755&cid=19137&uniq=&mid=935441019604838351&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.08521401254478957&cpm=0&verify_hash=5c0818a0f844ecafe8546d14ea58ec23&is_native=2&real_bid=0.002167020070552836&original_bid_usd=0.0027&original_bid=0.0027&show_type=0&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=0,89,4,20,27,150,70,108&need_redirect_show=0&applied_features=coef_095,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-adult&price=0.0027&hostname=auc-inpage-hz-11-c&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0.0000027000000000000004&ext_campaign_id_str=502&is_webview=0&client_price=0&direct_client_price=0&priority=0&client_payment_model=&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-t_r-body&mlf=1&mlc=1&st=0.02&cpa=fd8f1a0e-2b6f-4399-8919-cdba09ea6e2f&prev_step_diff=823 | 167.235.163.216 | 200 OK | 0 B |
URL GET HTTP/23b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418774&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=357529620&sid=7396243&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418774&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=34.2497673468025&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D357529620%26spot_id%3D418774%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Ftrack-eu.trackingtraffo.com%2Fpop%2Fimp%3Fauth%3De28un1%26c%3Ddt8dSiv_SCKy4nrBtKsmUdX4rRjDbLPZvQJd_Ql95OJh9ABTuimhN0XUCSTXl94h5OJmQzVzcPQ1uhpIPN_D2pddt3BzwOjU65x8wV-1vw7Sj6JrFTRD8BC6PNyn9UGR75aOLACgx0_mXi_zn5e72s4RYS71HcUM9zkFv8BTxoEqfVpV4i4sr_IhmhT8RSMzLcLemrt8km-2jaelTRGklj4YNqa7QdV5xaKFPUyadPW14NLmatJtPg15EujG34sTq7WmAiCKBSH0PhN1Sb2riytNyMfOtXNL-urjcEQ2dGDdoUZ8H7VbXG8kOp-OqHDjaQ62YAUQH39NPUYhPL03hRlg7S9qLUjmuQszllCXF9vpGNWFELoC1woIpo2Y16zmGmG_TIOfDOykfeL-MIgBK8fHlScMwanRAei4SAy35oWHstJwH0nW3dYEb05-b2zfPvSXBEEOcPxk7woGUabiKJs44ofh4xcO5CODcnB0I8h_RlwlKaZ5H3QtV98CgLTJXmfkpUDaNxZNAEiq_teMtFyDhakw6_iBroZRgY6Ox_mXfWrLyAwEwlC64Et3nNMt32AG5VV_FJtwH6i63ffUtdokOV3GfpBWMFe-jgAuWdibmucrxLqyb2xduNHd9PQDN0K15S9DyHuZsF7HgWG4YiEyRNvBv2_FzseCiLhKierbr4F3P6mk-U90thPFUOC7PGVB-tjmTeNtd5ad&icons=-Tq6_Cex7DzNPq9mTAqlJ6TGjBfy348G3oCyx8AA8nvg1WTiIK4pLcrhW7f0bc1BhRlned8e1lT5P4WqdkIJUEjhP0-fNzKik-5rvFb7FTbj-U2BpWzcmCn-n_K3TbpmQaybULMSiFAdtwlwVe1sKZk0Yth1yURPPxRdmynRRu1k4A1zPg&ext_cid=0&px_id=121457703&min_cpm=0.024801727435080106&out_id=1&campaign_type=lq-pop&aid=3755&cid=19137&uniq=&mid=935441019604838351&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.08521401254478957&cpm=0&verify_hash=5c0818a0f844ecafe8546d14ea58ec23&is_native=2&real_bid=0.002167020070552836&original_bid_usd=0.0027&original_bid=0.0027&show_type=0&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=0,89,4,20,27,150,70,108&need_redirect_show=0&applied_features=coef_095,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-adult&price=0.0027&hostname=auc-inpage-hz-11-c&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0.0000027000000000000004&ext_campaign_id_str=502&is_webview=0&client_price=0&direct_client_price=0&priority=0&client_payment_model=&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-t_r-body&mlf=1&mlc=1&st=0.02&cpa=fd8f1a0e-2b6f-4399-8919-cdba09ea6e2f&prev_step_diff=823 IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /in/show/?tag_ab=c&site_id=31418774&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=357529620&sid=7396243&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418774&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=34.2497673468025&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D357529620%26spot_id%3D418774%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Ftrack-eu.trackingtraffo.com%2Fpop%2Fimp%3Fauth%3De28un1%26c%3Ddt8dSiv_SCKy4nrBtKsmUdX4rRjDbLPZvQJd_Ql95OJh9ABTuimhN0XUCSTXl94h5OJmQzVzcPQ1uhpIPN_D2pddt3BzwOjU65x8wV-1vw7Sj6JrFTRD8BC6PNyn9UGR75aOLACgx0_mXi_zn5e72s4RYS71HcUM9zkFv8BTxoEqfVpV4i4sr_IhmhT8RSMzLcLemrt8km-2jaelTRGklj4YNqa7QdV5xaKFPUyadPW14NLmatJtPg15EujG34sTq7WmAiCKBSH0PhN1Sb2riytNyMfOtXNL-urjcEQ2dGDdoUZ8H7VbXG8kOp-OqHDjaQ62YAUQH39NPUYhPL03hRlg7S9qLUjmuQszllCXF9vpGNWFELoC1woIpo2Y16zmGmG_TIOfDOykfeL-MIgBK8fHlScMwanRAei4SAy35oWHstJwH0nW3dYEb05-b2zfPvSXBEEOcPxk7woGUabiKJs44ofh4xcO5CODcnB0I8h_RlwlKaZ5H3QtV98CgLTJXmfkpUDaNxZNAEiq_teMtFyDhakw6_iBroZRgY6Ox_mXfWrLyAwEwlC64Et3nNMt32AG5VV_FJtwH6i63ffUtdokOV3GfpBWMFe-jgAuWdibmucrxLqyb2xduNHd9PQDN0K15S9DyHuZsF7HgWG4YiEyRNvBv2_FzseCiLhKierbr4F3P6mk-U90thPFUOC7PGVB-tjmTeNtd5ad&icons=-Tq6_Cex7DzNPq9mTAqlJ6TGjBfy348G3oCyx8AA8nvg1WTiIK4pLcrhW7f0bc1BhRlned8e1lT5P4WqdkIJUEjhP0-fNzKik-5rvFb7FTbj-U2BpWzcmCn-n_K3TbpmQaybULMSiFAdtwlwVe1sKZk0Yth1yURPPxRdmynRRu1k4A1zPg&ext_cid=0&px_id=121457703&min_cpm=0.024801727435080106&out_id=1&campaign_type=lq-pop&aid=3755&cid=19137&uniq=&mid=935441019604838351&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.08521401254478957&cpm=0&verify_hash=5c0818a0f844ecafe8546d14ea58ec23&is_native=2&real_bid=0.002167020070552836&original_bid_usd=0.0027&original_bid=0.0027&show_type=0&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=0,89,4,20,27,150,70,108&need_redirect_show=0&applied_features=coef_095,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-adult&price=0.0027&hostname=auc-inpage-hz-11-c&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0.0000027000000000000004&ext_campaign_id_str=502&is_webview=0&client_price=0&direct_client_price=0&priority=0&client_payment_model=&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-t_r-body&mlf=1&mlc=1&st=0.02&cpa=fd8f1a0e-2b6f-4399-8919-cdba09ea6e2f&prev_step_diff=823 HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:34 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| 3b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418774&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=357529620&sid=7396243&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418774&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=34.2497673468025&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D357529620%26spot_id%3D418774%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=1&resp_type=&crid=24406&crtid=788f015ade7a5a02de07cfccea6d71a8&url=https%3A%2F%2Fp.a64x.com%2Fin%2Ftip_clicks%2F%3Fkatds_ep%3DgcHXGhWhHJ7MXErXt-LUdblp7ZsJV_RQvqE0_LzT268QBW54tmuKMOzP067epW7WtES2O4qGy0Vt9_LT8sd-JMuOuySxpYm8DS4Zkzsp6v7s-aKhp-A89AAA8hji2tmVhG2ixjxtxMM3AH38gmMaLOyCPlgBnnSmlMA5m6HAEPIBp5EG6p5nSFh4CD77kqsede68niEmlaNEIrPiiLGUEueIUl-6bel3g9h16zZaT9GuGILAbfLBs5yKJ6c14EnZQmZprkOqBlw_GVQmNRk0mYyXTA0SOgrIxukoSJlRSkydnwpXP6qKlLHfEgcMy7SkCiHt9Z3Oa1wNIb0h3ysoVdw3kVUkDX30M74EebdbpADCPN8z5MlFIo1EKmx--8hTw7we--0PoGXwwmK2T69Q1hfAhlmCWicnerfbEiG2LgEKtKBuMIFh8c6fhLqiHcOdBvdo4x1LeDKM6Vf83rQ5GsS6qY6719a8yhXF-QxKS5lktYxrS9YRMVUlCFXjvjQGxJL9minBb5R8xecJlvDijmFX20wcerhXxl5-N4pQNl6NZTEaoOVQ5ONMFEzDKY00QvViWMQpLAuNML2zms7-xPaxdbog38Jj8rk-K79t51vbvRoDXK_9RKzrxOLXv5qpw_gW4IvFLyGl6LWxp_VcEoUYmdIyylRzy23qEGdoIM60CGFcLslzxoblqdeExyzCS4gPXAYL0Om7QpnxcmaIt4euPKhOMp50zIGnzT9EsYQOriOHhhUiB2KKrZ75JQFHpFud8yhBZk8mUXTk04qwCAF6zOXIsxNrPwF_CZkyXv-lLT4ZU-xq0jdL71Qu7YyVkWnCOWTBDgl0b9RKxUq73qic1Ql0abnzxmjzS2qJgEjkE-yVZlt7ULv3IiPvlaeQfp4GDmwgkDS_gVysyypASgXCNZ2yZCz9jXGpENG_3W6jEYqFyaYjnrfZg-L3CqTTvI2U7jmXYsWGPpTOGqI-eSEEjkURvaziBBjTxU2k9HYkRuIVbwmFyS5Ysn_HtyY7wIytSnzqeoPExtWsQhlaHOI7hLZmRjVz8an9RPjeDSISvuZdFWLyy7Go-ssvghJUpN3hXWtZvWRNuuAnuK7SXtiIKD8KCSD5MeGyhAh5SCYY_N3kn0ZEb9tlquEwdhkoMU1zBr2gfGwm7_1DPqu17m_lhKwIdhHdNTLlF0RMIfsA42Vdyp5Rf_4wKAa38O3FOozW0jfwdPtXlPwVhFMJGbjRp6zb%26bid%3D0.08797579554225843&icons=crmTIVMd_haTy7XfgoSxEcuwkNq50WroJ2OQSexCojk54TIBjU614ioFx_-dA_Hcwo7G_w9etu58Gtv4WcOQkUhW6FtRn2t5PLEKtTQEVKyqT82cAUIcwJ1nrTaQ2ZCdx8NZ90dNcqij4ZpO62FGksmgymnTsrDRNbbJuLjJR3UXOcGlqbh1cj91fICeE0TFSsUQb-VOolZgeAa9LC-58uUub1dx8wEyFV7ztthjPlkihg5PDzRhS53IxLb3ncd0hSzUr0KYIzlrN_rf4DCBN60KETRdYStZB5YDRmiulGyLYo2_C_1tEBUwXJaKV-kO2e44ZDOdB8USgZDw__CoTVsgxFq87yaOcA2bwlHATGGmrJ_FuMnvRCikuw5n4K2XPoo8HlKR_7bVNg9h4rilRpR2WZ7r6i5F-Clc-aZHmBLUfodb15PAc1tuwOHCGkWcTTEcZs1G3-ZBwjA_W9uoWNImbMfNWY3Avbiunlg6i0CHMF5aHKjVMddb65OgzLvxVoJOr38pMbJ-5Tw87d3SDj_pjpEtyi0PQf5JpsdIajsa1WwlUDwU55M0rCVFEUd2ixRohFqa-QX7DfJd8DXkXjFT6KXUQxK_K7kkyJwm0NmS1NJENDmcNfkuGItV79IebCAT2ygP4gP62_cRlmPICZsxjYAXJ2-8QBTkefXBIJ34FnFFOyRQqyL3haRPGXZUJYL7sSbiV80jM0YbZ8Uf9lvU82BnLweld71ICClSsr9yTVslkjQMJPrx8Pv1DJ7rD-twZgBJ7BKg6TvEaFEkW_kB_Yy11XexWRQUn4ZZ9eO-ndZiJnxw8ccX4CWJ_QiArhCThwh9UDSwAprmPLvhLQGsGwCBPjQYEEwr1tIEx9dlyZeer5AKj55DGObCfezAI6-r4xEY4ZvAF9_dO_RW9BjbDqoeWrY6S1i6WMZE3j2SLwwFP1v31j1Rf-E-m8ON6MOKnL_7Cxo7uh8A_x4HmMO5MVxEVh4c6v5wjHlI-Q-n764ca_EaOfPXPkFZmcZqyJVfbs8NGoaDHO7n5K5EZJpbXS6tpPztaCX0_MwnSIKL-wHhoYJsVKdXKlDP61IJc5jv5AorrfYKg9K2on2MGyvKUwzehuO79aJEP0FyU-pw82JBVB9t1OqXYGMEuGnis1w8oyHq_0sbuxYH7-NdnDaScYcUzfyjN9akdTOC1r3wXzAsmI-mRzG6wumje24H50JVgCL4JnXogIzeh6she823cwEChtMCRaQYdhBZfVvSK-M5-DNj77y1jJCBCH4oKkPQGp1snh7bwwSimox8eQptd1l_BdKPORSzOXzBxoZz0Tu3Xa2AFWBr9_8UiFoboTM13_YU7VS9KPHcYLsKxc5FzoPac7C0-eL-X1QOGar1B1bRzK_fpDWindIoIt0kjt5SYrX5j1P5Ty0oc8npBH6S8yQkfTeXYQ&ext_cid=299547&px_id=73418774&min_cpm=0.001313583803106007&out_id=0&campaign_type=hq&aid=127&cid=12694&uniq=ac3453ce09538fe1d037a8c2f8b3ce2529c0ea68600fd53ab01b5ca4bd27fc9e&mid=935441019604838351&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.10704869954180099&cpm=0.08797579554225843&verify_hash=e827b4415531ffb3d55e516890b9a499&is_native=1&real_bid=0.08457113361395684&original_bid_usd=0.11135826258334472&original_bid=0.11135826258334472&show_type=0&exp=1440&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=0,4,90,5,98,108&need_redirect_show=0&applied_features=main-skins-settings,coef_095&show_count=1&expiration_timestamp=1735662994&image_url=https%3A%2F%2Fgfxdn.pics%2Fm%2Fp%2F0%2F883%2F883207%2Fconversions%2F0OErF2ya-in-page-ad-images.jpg&site=native-push-adult&price=0&hostname=auc-inpage-hz-11-c&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0&ext_campaign_id_str=299547&is_webview=0&client_price=0.0288390004634856&direct_client_price=0&priority=0&client_payment_model=cpc&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-t_r-body&st=0.02&cpa=d8bab007-80b1-4c3e-8d82-7d08cd6dec4e&prev_step_diff=823 | 167.235.163.216 | 200 OK | 0 B |
URL GET HTTP/23b71ae07b7.5bb3e0be1a.com/in/show/?tag_ab=c&site_id=31418774&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=357529620&sid=7396243&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418774&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=34.2497673468025&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D357529620%26spot_id%3D418774%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=1&resp_type=&crid=24406&crtid=788f015ade7a5a02de07cfccea6d71a8&url=https%3A%2F%2Fp.a64x.com%2Fin%2Ftip_clicks%2F%3Fkatds_ep%3DgcHXGhWhHJ7MXErXt-LUdblp7ZsJV_RQvqE0_LzT268QBW54tmuKMOzP067epW7WtES2O4qGy0Vt9_LT8sd-JMuOuySxpYm8DS4Zkzsp6v7s-aKhp-A89AAA8hji2tmVhG2ixjxtxMM3AH38gmMaLOyCPlgBnnSmlMA5m6HAEPIBp5EG6p5nSFh4CD77kqsede68niEmlaNEIrPiiLGUEueIUl-6bel3g9h16zZaT9GuGILAbfLBs5yKJ6c14EnZQmZprkOqBlw_GVQmNRk0mYyXTA0SOgrIxukoSJlRSkydnwpXP6qKlLHfEgcMy7SkCiHt9Z3Oa1wNIb0h3ysoVdw3kVUkDX30M74EebdbpADCPN8z5MlFIo1EKmx--8hTw7we--0PoGXwwmK2T69Q1hfAhlmCWicnerfbEiG2LgEKtKBuMIFh8c6fhLqiHcOdBvdo4x1LeDKM6Vf83rQ5GsS6qY6719a8yhXF-QxKS5lktYxrS9YRMVUlCFXjvjQGxJL9minBb5R8xecJlvDijmFX20wcerhXxl5-N4pQNl6NZTEaoOVQ5ONMFEzDKY00QvViWMQpLAuNML2zms7-xPaxdbog38Jj8rk-K79t51vbvRoDXK_9RKzrxOLXv5qpw_gW4IvFLyGl6LWxp_VcEoUYmdIyylRzy23qEGdoIM60CGFcLslzxoblqdeExyzCS4gPXAYL0Om7QpnxcmaIt4euPKhOMp50zIGnzT9EsYQOriOHhhUiB2KKrZ75JQFHpFud8yhBZk8mUXTk04qwCAF6zOXIsxNrPwF_CZkyXv-lLT4ZU-xq0jdL71Qu7YyVkWnCOWTBDgl0b9RKxUq73qic1Ql0abnzxmjzS2qJgEjkE-yVZlt7ULv3IiPvlaeQfp4GDmwgkDS_gVysyypASgXCNZ2yZCz9jXGpENG_3W6jEYqFyaYjnrfZg-L3CqTTvI2U7jmXYsWGPpTOGqI-eSEEjkURvaziBBjTxU2k9HYkRuIVbwmFyS5Ysn_HtyY7wIytSnzqeoPExtWsQhlaHOI7hLZmRjVz8an9RPjeDSISvuZdFWLyy7Go-ssvghJUpN3hXWtZvWRNuuAnuK7SXtiIKD8KCSD5MeGyhAh5SCYY_N3kn0ZEb9tlquEwdhkoMU1zBr2gfGwm7_1DPqu17m_lhKwIdhHdNTLlF0RMIfsA42Vdyp5Rf_4wKAa38O3FOozW0jfwdPtXlPwVhFMJGbjRp6zb%26bid%3D0.08797579554225843&icons=crmTIVMd_haTy7XfgoSxEcuwkNq50WroJ2OQSexCojk54TIBjU614ioFx_-dA_Hcwo7G_w9etu58Gtv4WcOQkUhW6FtRn2t5PLEKtTQEVKyqT82cAUIcwJ1nrTaQ2ZCdx8NZ90dNcqij4ZpO62FGksmgymnTsrDRNbbJuLjJR3UXOcGlqbh1cj91fICeE0TFSsUQb-VOolZgeAa9LC-58uUub1dx8wEyFV7ztthjPlkihg5PDzRhS53IxLb3ncd0hSzUr0KYIzlrN_rf4DCBN60KETRdYStZB5YDRmiulGyLYo2_C_1tEBUwXJaKV-kO2e44ZDOdB8USgZDw__CoTVsgxFq87yaOcA2bwlHATGGmrJ_FuMnvRCikuw5n4K2XPoo8HlKR_7bVNg9h4rilRpR2WZ7r6i5F-Clc-aZHmBLUfodb15PAc1tuwOHCGkWcTTEcZs1G3-ZBwjA_W9uoWNImbMfNWY3Avbiunlg6i0CHMF5aHKjVMddb65OgzLvxVoJOr38pMbJ-5Tw87d3SDj_pjpEtyi0PQf5JpsdIajsa1WwlUDwU55M0rCVFEUd2ixRohFqa-QX7DfJd8DXkXjFT6KXUQxK_K7kkyJwm0NmS1NJENDmcNfkuGItV79IebCAT2ygP4gP62_cRlmPICZsxjYAXJ2-8QBTkefXBIJ34FnFFOyRQqyL3haRPGXZUJYL7sSbiV80jM0YbZ8Uf9lvU82BnLweld71ICClSsr9yTVslkjQMJPrx8Pv1DJ7rD-twZgBJ7BKg6TvEaFEkW_kB_Yy11XexWRQUn4ZZ9eO-ndZiJnxw8ccX4CWJ_QiArhCThwh9UDSwAprmPLvhLQGsGwCBPjQYEEwr1tIEx9dlyZeer5AKj55DGObCfezAI6-r4xEY4ZvAF9_dO_RW9BjbDqoeWrY6S1i6WMZE3j2SLwwFP1v31j1Rf-E-m8ON6MOKnL_7Cxo7uh8A_x4HmMO5MVxEVh4c6v5wjHlI-Q-n764ca_EaOfPXPkFZmcZqyJVfbs8NGoaDHO7n5K5EZJpbXS6tpPztaCX0_MwnSIKL-wHhoYJsVKdXKlDP61IJc5jv5AorrfYKg9K2on2MGyvKUwzehuO79aJEP0FyU-pw82JBVB9t1OqXYGMEuGnis1w8oyHq_0sbuxYH7-NdnDaScYcUzfyjN9akdTOC1r3wXzAsmI-mRzG6wumje24H50JVgCL4JnXogIzeh6she823cwEChtMCRaQYdhBZfVvSK-M5-DNj77y1jJCBCH4oKkPQGp1snh7bwwSimox8eQptd1l_BdKPORSzOXzBxoZz0Tu3Xa2AFWBr9_8UiFoboTM13_YU7VS9KPHcYLsKxc5FzoPac7C0-eL-X1QOGar1B1bRzK_fpDWindIoIt0kjt5SYrX5j1P5Ty0oc8npBH6S8yQkfTeXYQ&ext_cid=299547&px_id=73418774&min_cpm=0.001313583803106007&out_id=0&campaign_type=hq&aid=127&cid=12694&uniq=ac3453ce09538fe1d037a8c2f8b3ce2529c0ea68600fd53ab01b5ca4bd27fc9e&mid=935441019604838351&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.10704869954180099&cpm=0.08797579554225843&verify_hash=e827b4415531ffb3d55e516890b9a499&is_native=1&real_bid=0.08457113361395684&original_bid_usd=0.11135826258334472&original_bid=0.11135826258334472&show_type=0&exp=1440&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=0,4,90,5,98,108&need_redirect_show=0&applied_features=main-skins-settings,coef_095&show_count=1&expiration_timestamp=1735662994&image_url=https%3A%2F%2Fgfxdn.pics%2Fm%2Fp%2F0%2F883%2F883207%2Fconversions%2F0OErF2ya-in-page-ad-images.jpg&site=native-push-adult&price=0&hostname=auc-inpage-hz-11-c&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0&ext_campaign_id_str=299547&is_webview=0&client_price=0.0288390004634856&direct_client_price=0&priority=0&client_payment_model=cpc&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-t_r-body&st=0.02&cpa=d8bab007-80b1-4c3e-8d82-7d08cd6dec4e&prev_step_diff=823 IP167.235.163.216:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subject5bb3e0be1a.com Fingerprint05:F7:92:48:13:AE:31:68:38:17:35:2A:0D:08:B3:07:C3:EF:79:4E ValidityWed, 25 Dec 2024 14:03:25 GMT - Tue, 25 Mar 2025 14:03:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /in/show/?tag_ab=c&site_id=31418774&adblock=0&testab=2&auction_host=apply&mm=0&yc=0&render_type=hq&pr=&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=all,dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fpoo.phd%2Ftop3%3Fp%3D235&refdom=poo.phd&auction_time=1735490194&subid=357529620&sid=7396243&tcid=0&ver=7.370.0-b&ver_c=&spot_id=418774&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-12-29&iabcat=IAB25-3&keywords=&user_fp=11170713576192219032&score=34.2497673468025&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D357529620%26spot_id%3D418774%26is_adult%3D1%26p%3Dhttps%253A%252F%252Fpoo.phd%252Ftop3%253Fp%253D235%26idzone%3D0%26sid%3D1886&is_cpm=1&resp_type=&crid=24406&crtid=788f015ade7a5a02de07cfccea6d71a8&url=https%3A%2F%2Fp.a64x.com%2Fin%2Ftip_clicks%2F%3Fkatds_ep%3DgcHXGhWhHJ7MXErXt-LUdblp7ZsJV_RQvqE0_LzT268QBW54tmuKMOzP067epW7WtES2O4qGy0Vt9_LT8sd-JMuOuySxpYm8DS4Zkzsp6v7s-aKhp-A89AAA8hji2tmVhG2ixjxtxMM3AH38gmMaLOyCPlgBnnSmlMA5m6HAEPIBp5EG6p5nSFh4CD77kqsede68niEmlaNEIrPiiLGUEueIUl-6bel3g9h16zZaT9GuGILAbfLBs5yKJ6c14EnZQmZprkOqBlw_GVQmNRk0mYyXTA0SOgrIxukoSJlRSkydnwpXP6qKlLHfEgcMy7SkCiHt9Z3Oa1wNIb0h3ysoVdw3kVUkDX30M74EebdbpADCPN8z5MlFIo1EKmx--8hTw7we--0PoGXwwmK2T69Q1hfAhlmCWicnerfbEiG2LgEKtKBuMIFh8c6fhLqiHcOdBvdo4x1LeDKM6Vf83rQ5GsS6qY6719a8yhXF-QxKS5lktYxrS9YRMVUlCFXjvjQGxJL9minBb5R8xecJlvDijmFX20wcerhXxl5-N4pQNl6NZTEaoOVQ5ONMFEzDKY00QvViWMQpLAuNML2zms7-xPaxdbog38Jj8rk-K79t51vbvRoDXK_9RKzrxOLXv5qpw_gW4IvFLyGl6LWxp_VcEoUYmdIyylRzy23qEGdoIM60CGFcLslzxoblqdeExyzCS4gPXAYL0Om7QpnxcmaIt4euPKhOMp50zIGnzT9EsYQOriOHhhUiB2KKrZ75JQFHpFud8yhBZk8mUXTk04qwCAF6zOXIsxNrPwF_CZkyXv-lLT4ZU-xq0jdL71Qu7YyVkWnCOWTBDgl0b9RKxUq73qic1Ql0abnzxmjzS2qJgEjkE-yVZlt7ULv3IiPvlaeQfp4GDmwgkDS_gVysyypASgXCNZ2yZCz9jXGpENG_3W6jEYqFyaYjnrfZg-L3CqTTvI2U7jmXYsWGPpTOGqI-eSEEjkURvaziBBjTxU2k9HYkRuIVbwmFyS5Ysn_HtyY7wIytSnzqeoPExtWsQhlaHOI7hLZmRjVz8an9RPjeDSISvuZdFWLyy7Go-ssvghJUpN3hXWtZvWRNuuAnuK7SXtiIKD8KCSD5MeGyhAh5SCYY_N3kn0ZEb9tlquEwdhkoMU1zBr2gfGwm7_1DPqu17m_lhKwIdhHdNTLlF0RMIfsA42Vdyp5Rf_4wKAa38O3FOozW0jfwdPtXlPwVhFMJGbjRp6zb%26bid%3D0.08797579554225843&icons=crmTIVMd_haTy7XfgoSxEcuwkNq50WroJ2OQSexCojk54TIBjU614ioFx_-dA_Hcwo7G_w9etu58Gtv4WcOQkUhW6FtRn2t5PLEKtTQEVKyqT82cAUIcwJ1nrTaQ2ZCdx8NZ90dNcqij4ZpO62FGksmgymnTsrDRNbbJuLjJR3UXOcGlqbh1cj91fICeE0TFSsUQb-VOolZgeAa9LC-58uUub1dx8wEyFV7ztthjPlkihg5PDzRhS53IxLb3ncd0hSzUr0KYIzlrN_rf4DCBN60KETRdYStZB5YDRmiulGyLYo2_C_1tEBUwXJaKV-kO2e44ZDOdB8USgZDw__CoTVsgxFq87yaOcA2bwlHATGGmrJ_FuMnvRCikuw5n4K2XPoo8HlKR_7bVNg9h4rilRpR2WZ7r6i5F-Clc-aZHmBLUfodb15PAc1tuwOHCGkWcTTEcZs1G3-ZBwjA_W9uoWNImbMfNWY3Avbiunlg6i0CHMF5aHKjVMddb65OgzLvxVoJOr38pMbJ-5Tw87d3SDj_pjpEtyi0PQf5JpsdIajsa1WwlUDwU55M0rCVFEUd2ixRohFqa-QX7DfJd8DXkXjFT6KXUQxK_K7kkyJwm0NmS1NJENDmcNfkuGItV79IebCAT2ygP4gP62_cRlmPICZsxjYAXJ2-8QBTkefXBIJ34FnFFOyRQqyL3haRPGXZUJYL7sSbiV80jM0YbZ8Uf9lvU82BnLweld71ICClSsr9yTVslkjQMJPrx8Pv1DJ7rD-twZgBJ7BKg6TvEaFEkW_kB_Yy11XexWRQUn4ZZ9eO-ndZiJnxw8ccX4CWJ_QiArhCThwh9UDSwAprmPLvhLQGsGwCBPjQYEEwr1tIEx9dlyZeer5AKj55DGObCfezAI6-r4xEY4ZvAF9_dO_RW9BjbDqoeWrY6S1i6WMZE3j2SLwwFP1v31j1Rf-E-m8ON6MOKnL_7Cxo7uh8A_x4HmMO5MVxEVh4c6v5wjHlI-Q-n764ca_EaOfPXPkFZmcZqyJVfbs8NGoaDHO7n5K5EZJpbXS6tpPztaCX0_MwnSIKL-wHhoYJsVKdXKlDP61IJc5jv5AorrfYKg9K2on2MGyvKUwzehuO79aJEP0FyU-pw82JBVB9t1OqXYGMEuGnis1w8oyHq_0sbuxYH7-NdnDaScYcUzfyjN9akdTOC1r3wXzAsmI-mRzG6wumje24H50JVgCL4JnXogIzeh6she823cwEChtMCRaQYdhBZfVvSK-M5-DNj77y1jJCBCH4oKkPQGp1snh7bwwSimox8eQptd1l_BdKPORSzOXzBxoZz0Tu3Xa2AFWBr9_8UiFoboTM13_YU7VS9KPHcYLsKxc5FzoPac7C0-eL-X1QOGar1B1bRzK_fpDWindIoIt0kjt5SYrX5j1P5Ty0oc8npBH6S8yQkfTeXYQ&ext_cid=299547&px_id=73418774&min_cpm=0.001313583803106007&out_id=0&campaign_type=hq&aid=127&cid=12694&uniq=ac3453ce09538fe1d037a8c2f8b3ce2529c0ea68600fd53ab01b5ca4bd27fc9e&mid=935441019604838351&skin_id=71&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.10704869954180099&cpm=0.08797579554225843&verify_hash=e827b4415531ffb3d55e516890b9a499&is_native=1&real_bid=0.08457113361395684&original_bid_usd=0.11135826258334472&original_bid=0.11135826258334472&show_type=0&exp=1440&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%3B%20rv%3A96.0%29%20Gecko%2F20100101%20Firefox%2F96.0&ip_mismatch=91.90.42.154&geo=NO&carrier=-&label_ids=0,4,90,5,98,108&need_redirect_show=0&applied_features=main-skins-settings,coef_095&show_count=1&expiration_timestamp=1735662994&image_url=https%3A%2F%2Fgfxdn.pics%2Fm%2Fp%2F0%2F883%2F883207%2Fconversions%2F0OErF2ya-in-page-ad-images.jpg&site=native-push-adult&price=0&hostname=auc-inpage-hz-11-c&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=UTC&topics=&historical_keywords=&pop_cpc=0&ext_campaign_id_str=299547&is_webview=0&client_price=0.0288390004634856&direct_client_price=0&priority=0&client_payment_model=cpc&is_in_app=0&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=gamblingBlueMessage-view-t_r-body&st=0.02&cpa=d8bab007-80b1-4c3e-8d82-7d08cd6dec4e&prev_step_diff=823 HTTP/1.1
Host: 3b71ae07b7.5bb3e0be1a.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 29 Dec 2024 16:36:34 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP98YXhaYf-9EXDu3jsNmuiXD4dj1SWItkEJnMQQy0vaLQkhHgYqLVhsa8C2bryvx95zGmcWo3Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1693746701%3A1735490194539257&ddm=1 | 64.233.164.84 | 403 Forbidden | 1.3 kB |
URL GET HTTP/2accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP98YXhaYf-9EXDu3jsNmuiXD4dj1SWItkEJnMQQy0vaLQkhHgYqLVhsa8C2bryvx95zGmcWo3Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1693746701%3A1735490194539257&ddm=1 IP64.233.164.84:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
File typegzip compressed data, max compression Hash608edc3c22d310606b025e9a8dbeee99 8238a5bf31b175483cdcb5334c479216c60c37c8 fe9ca73490c32fc015df596a82daefd48ea1fa86f151e01c177c2fb23a4b0346
GET /v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP98YXhaYf-9EXDu3jsNmuiXD4dj1SWItkEJnMQQy0vaLQkhHgYqLVhsa8C2bryvx95zGmcWo3Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1693746701%3A1735490194539257&ddm=1 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 29 Dec 2024 16:36:34 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-tK1dOA294x3vsvEnx5helw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/recaptcha/api.js https://translate.google.com/translate_a/element.js https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.1PNB2j8wR4U.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| static.bookmsg.com/creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790.webp | 45.133.44.25 | 200 OK | 1.1 kB |
URL GET HTTP/2static.bookmsg.com/creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790.webp IP45.133.44.25:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectstatic.bookmsg.com Fingerprint6B:98:BE:D7:28:05:BB:C1:1E:1B:28:3A:0F:F9:79:86:2D:94:63:BF ValiditySun, 01 Dec 2024 03:02:39 GMT - Sat, 01 Mar 2025 03:02:38 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 360x240, Scaling: [none]x[none], YUV color, decoders should clamp Hash2a11e13b2bd67bb9a6cb347d7c73df13 b85460a33f9b229f42c08a6a94ae433a4d5c32ab 1d0d6b5176d6a48b3042a107f929bbfcefd4a057273ac488bbb7f7affd909b56
GET /creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790.webp HTTP/1.1
Host: static.bookmsg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: image/webp
content-length: 1066
server: nginx/1.24.0
last-modified: Fri, 31 May 2024 10:56:43 GMT
etag: "6659aceb-42a"
expires: Mon, 29 Dec 2025 16:36:34 GMT
cache-control: max-age=31536000
x-proxy-cache: HIT
x-cdn-host-id: ds5058
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| p.a64x.com/in/tip_shows/?katds_ep=brSaIEFAF8IFS6_W5IigsEAnNY67OG2X37Xe5hiwTQoeKF42CrhQxZwJ7l0GmWOzTgyA_v7A-iWbkHh2eLnOn7tASp-xSCRCwDKyolyj5-JWrMToqG_H2OhnVubnE6hGyFx-cctn3h-uLobBWT8Lk8K1MSP7nNDuRTAdOs57e35hzeeq3_0tgaxyg2fzqPb_EDQynmAdH8kRbFnJqjX56S3T9qYliwo2WLDFTo24Q8MuXl1s5V1b-NIx1TL7so4lwGJw4Z2s8hT4nh0HrGxd7M99NixzBiN92NgvreIQKSr_wStVVWPyf-gEqoEZ9ID7ZySX-ECq2Wo-NXNBjxLK9JAti0jKaTza0X-WFTvhpugzYr6vf2R3usNt0y75YxBtd7xYN4KwWaruvUr6S-HM5ooFLv8gPSj7riO53vkSqGQ4ZboVzr0GbD6zYn64-03XdrdyaL1RLap8HghycCSIz93-quaa9a1yFhzYzOie-5cpboyDbFGw2InN09927xjTbsF0fWKvD550YKSTmLxHNbidLTf4ND1dFmykHbFS1yXMn6Ffn3lGrb5m0P6rTrsrn2mmwJZZ2ie6X3knv8_hhXbpuFOxmUG2Wygd3ZW0QlGJDQVuCYDJo69mvwQX68ZoMA4mSSwa7PTtG0cEZex4p0SPmul3QuBf4BP2McyJSdM9eYdWFLLBwBeKNQv464irya1aeMVDMU_xlDmWxLzBub3CJgwSmO1O_WgljXag3lNCGzPtbU856qmhfW-e_sxIJYCmgXl8oTrBSZeoT4TIGp88cCRkqiutulQX6LJxf5ahaC3pbrqvDvb5FoCgLbPIPFt6GV_MqHR-l8iS3tYwlBtkfkdhycnLXy0HdD5UoahyeeUdzGwKZhmjvxoHgdaQyLI-ZCSy_p8DdRnzZ9MvMjvXsQ9EQEYfRTEtphY0WZ__xwWhXQ2-ikd3jv-sx6xxBEUSsbJNDoNBWQ&bid=0.10260885639060034 | 104.21.19.82 | 302 Found | 0 B |
URL GET HTTP/2p.a64x.com/in/tip_shows/?katds_ep=brSaIEFAF8IFS6_W5IigsEAnNY67OG2X37Xe5hiwTQoeKF42CrhQxZwJ7l0GmWOzTgyA_v7A-iWbkHh2eLnOn7tASp-xSCRCwDKyolyj5-JWrMToqG_H2OhnVubnE6hGyFx-cctn3h-uLobBWT8Lk8K1MSP7nNDuRTAdOs57e35hzeeq3_0tgaxyg2fzqPb_EDQynmAdH8kRbFnJqjX56S3T9qYliwo2WLDFTo24Q8MuXl1s5V1b-NIx1TL7so4lwGJw4Z2s8hT4nh0HrGxd7M99NixzBiN92NgvreIQKSr_wStVVWPyf-gEqoEZ9ID7ZySX-ECq2Wo-NXNBjxLK9JAti0jKaTza0X-WFTvhpugzYr6vf2R3usNt0y75YxBtd7xYN4KwWaruvUr6S-HM5ooFLv8gPSj7riO53vkSqGQ4ZboVzr0GbD6zYn64-03XdrdyaL1RLap8HghycCSIz93-quaa9a1yFhzYzOie-5cpboyDbFGw2InN09927xjTbsF0fWKvD550YKSTmLxHNbidLTf4ND1dFmykHbFS1yXMn6Ffn3lGrb5m0P6rTrsrn2mmwJZZ2ie6X3knv8_hhXbpuFOxmUG2Wygd3ZW0QlGJDQVuCYDJo69mvwQX68ZoMA4mSSwa7PTtG0cEZex4p0SPmul3QuBf4BP2McyJSdM9eYdWFLLBwBeKNQv464irya1aeMVDMU_xlDmWxLzBub3CJgwSmO1O_WgljXag3lNCGzPtbU856qmhfW-e_sxIJYCmgXl8oTrBSZeoT4TIGp88cCRkqiutulQX6LJxf5ahaC3pbrqvDvb5FoCgLbPIPFt6GV_MqHR-l8iS3tYwlBtkfkdhycnLXy0HdD5UoahyeeUdzGwKZhmjvxoHgdaQyLI-ZCSy_p8DdRnzZ9MvMjvXsQ9EQEYfRTEtphY0WZ__xwWhXQ2-ikd3jv-sx6xxBEUSsbJNDoNBWQ&bid=0.10260885639060034 IP104.21.19.82:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjecta64x.com Fingerprint14:4A:89:A6:6E:5C:81:E6:3B:34:F1:EF:B2:AF:90:10:42:C3:17:7A ValiditySun, 10 Nov 2024 20:57:28 GMT - Sat, 08 Feb 2025 20:57:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/tip_shows/?katds_ep=brSaIEFAF8IFS6_W5IigsEAnNY67OG2X37Xe5hiwTQoeKF42CrhQxZwJ7l0GmWOzTgyA_v7A-iWbkHh2eLnOn7tASp-xSCRCwDKyolyj5-JWrMToqG_H2OhnVubnE6hGyFx-cctn3h-uLobBWT8Lk8K1MSP7nNDuRTAdOs57e35hzeeq3_0tgaxyg2fzqPb_EDQynmAdH8kRbFnJqjX56S3T9qYliwo2WLDFTo24Q8MuXl1s5V1b-NIx1TL7so4lwGJw4Z2s8hT4nh0HrGxd7M99NixzBiN92NgvreIQKSr_wStVVWPyf-gEqoEZ9ID7ZySX-ECq2Wo-NXNBjxLK9JAti0jKaTza0X-WFTvhpugzYr6vf2R3usNt0y75YxBtd7xYN4KwWaruvUr6S-HM5ooFLv8gPSj7riO53vkSqGQ4ZboVzr0GbD6zYn64-03XdrdyaL1RLap8HghycCSIz93-quaa9a1yFhzYzOie-5cpboyDbFGw2InN09927xjTbsF0fWKvD550YKSTmLxHNbidLTf4ND1dFmykHbFS1yXMn6Ffn3lGrb5m0P6rTrsrn2mmwJZZ2ie6X3knv8_hhXbpuFOxmUG2Wygd3ZW0QlGJDQVuCYDJo69mvwQX68ZoMA4mSSwa7PTtG0cEZex4p0SPmul3QuBf4BP2McyJSdM9eYdWFLLBwBeKNQv464irya1aeMVDMU_xlDmWxLzBub3CJgwSmO1O_WgljXag3lNCGzPtbU856qmhfW-e_sxIJYCmgXl8oTrBSZeoT4TIGp88cCRkqiutulQX6LJxf5ahaC3pbrqvDvb5FoCgLbPIPFt6GV_MqHR-l8iS3tYwlBtkfkdhycnLXy0HdD5UoahyeeUdzGwKZhmjvxoHgdaQyLI-ZCSy_p8DdRnzZ9MvMjvXsQ9EQEYfRTEtphY0WZ__xwWhXQ2-ikd3jv-sx6xxBEUSsbJNDoNBWQ&bid=0.10260885639060034 HTTP/1.1
Host: p.a64x.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: application/json
content-length: 0
location: https://gfxdn.pics/m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg
access-control-allow-credentials: true
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EcdqtmFggTLaqkCfV97LuO%2BxLOKHa2KmoGyNk6ETxKbK1zSiLqU12CkCMQmCTJaHFYLojB6XacWGh9pDSYfsVEZomoGVXQFLaK9YiSNotYE5oLQbsZDYLqKKWpnW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35b5af237128-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=997&min_rtt=526&rtt_var=958&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3263&recv_bytes=2858&delivery_rate=6435555&cwnd=252&unsent_bytes=0&cid=cc6de8d830ea628d&ts=95&x=0"
X-Firefox-Spdy: h2
|
|
| p.a64x.com/in/tip_shows/?katds_ep=sBaQ0i8oE5bMQSY9QhS8tTl7fu_vIq_hiaFI4q7RZpTj7hyaI1bHVGVRuqYgGZSdWhtSFlsW9NVkq6e7V3PAnWoYUvflNZok3omVZkUNVpuQngZJs3asc46CJ7Xkrw9e1wSEhKZ8QJMuZT5DjYdQD_XKrdBGHnyjDnHx1RRP3JKW1diD4JWrRXSKld0ufzwOwS5fXNkerTnvKtDUHG71CCBf0u4enPBBC3q1XPrUjpP8swYO1yDkneGhv_-k9x88Fj8rLDy7kpAHEVfHbseP18wiAAAeUlh6f3ipS_Oi6E9okIB9xMc55p82IYdYUCJf26tG82dVikMtqamr8RIPxcenXnSZ_pVlQfnOp-J_VB5pK8vTkq6VwsHbJivbiiNvXsGRR0h-wAd_TsaOuRk_amJibMbXftKaUX20bCo-ykgKn9ycV9E-ILKXcw9TeWvZZM1CRp8kTOb0DoBkJyPwaus3ki4jMtsQa9B6TbeLn9PYaGT87fmm2usztAXhEXSYlEUh6rYxkAEOswhopwcxgA2_-SHozIX08Fe6FhzzooAQGPQQr3B6LJA1Fzp7_XBjuJ_Nz6USZtCKk3a-1P0yho4Wt8whqF1rqgTm0A3mDgQ_o_YlpKq8tfaN4xapTa4-pfHSbUul9h5iufuCoBu2CjDOv4zQNyh608npXHPTIr-Gz6uS0tN6jwp74-0n0CoAim3uttxr8fAHeVvJKbuh81jBfafhqgKMRBHxcbU5NNeGReutyVet7iKnxj_x7UsJxf99TIVZdbjNoQLVtXgZDFfWanz_hz32sSwxsO55vnjl1hi7W0CsKYtfywZ5TIfog6K3ykKtmLZUdmCSiQ7zUE3K6t12ElNJpHqw5nifknVFB2-MLhsko6XvWjFthVm0ObVp2lEUuazLJWby2upwmiZ7eWkE7ZlXVEG7whMAho6VkTP4sEC8t5SEBYmORUy0omGYvPKYFSO9PeI&bid=0.08797579554225843 | 104.21.19.82 | 302 Found | 0 B |
URL GET HTTP/2p.a64x.com/in/tip_shows/?katds_ep=sBaQ0i8oE5bMQSY9QhS8tTl7fu_vIq_hiaFI4q7RZpTj7hyaI1bHVGVRuqYgGZSdWhtSFlsW9NVkq6e7V3PAnWoYUvflNZok3omVZkUNVpuQngZJs3asc46CJ7Xkrw9e1wSEhKZ8QJMuZT5DjYdQD_XKrdBGHnyjDnHx1RRP3JKW1diD4JWrRXSKld0ufzwOwS5fXNkerTnvKtDUHG71CCBf0u4enPBBC3q1XPrUjpP8swYO1yDkneGhv_-k9x88Fj8rLDy7kpAHEVfHbseP18wiAAAeUlh6f3ipS_Oi6E9okIB9xMc55p82IYdYUCJf26tG82dVikMtqamr8RIPxcenXnSZ_pVlQfnOp-J_VB5pK8vTkq6VwsHbJivbiiNvXsGRR0h-wAd_TsaOuRk_amJibMbXftKaUX20bCo-ykgKn9ycV9E-ILKXcw9TeWvZZM1CRp8kTOb0DoBkJyPwaus3ki4jMtsQa9B6TbeLn9PYaGT87fmm2usztAXhEXSYlEUh6rYxkAEOswhopwcxgA2_-SHozIX08Fe6FhzzooAQGPQQr3B6LJA1Fzp7_XBjuJ_Nz6USZtCKk3a-1P0yho4Wt8whqF1rqgTm0A3mDgQ_o_YlpKq8tfaN4xapTa4-pfHSbUul9h5iufuCoBu2CjDOv4zQNyh608npXHPTIr-Gz6uS0tN6jwp74-0n0CoAim3uttxr8fAHeVvJKbuh81jBfafhqgKMRBHxcbU5NNeGReutyVet7iKnxj_x7UsJxf99TIVZdbjNoQLVtXgZDFfWanz_hz32sSwxsO55vnjl1hi7W0CsKYtfywZ5TIfog6K3ykKtmLZUdmCSiQ7zUE3K6t12ElNJpHqw5nifknVFB2-MLhsko6XvWjFthVm0ObVp2lEUuazLJWby2upwmiZ7eWkE7ZlXVEG7whMAho6VkTP4sEC8t5SEBYmORUy0omGYvPKYFSO9PeI&bid=0.08797579554225843 IP104.21.19.82:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjecta64x.com Fingerprint14:4A:89:A6:6E:5C:81:E6:3B:34:F1:EF:B2:AF:90:10:42:C3:17:7A ValiditySun, 10 Nov 2024 20:57:28 GMT - Sat, 08 Feb 2025 20:57:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/tip_shows/?katds_ep=sBaQ0i8oE5bMQSY9QhS8tTl7fu_vIq_hiaFI4q7RZpTj7hyaI1bHVGVRuqYgGZSdWhtSFlsW9NVkq6e7V3PAnWoYUvflNZok3omVZkUNVpuQngZJs3asc46CJ7Xkrw9e1wSEhKZ8QJMuZT5DjYdQD_XKrdBGHnyjDnHx1RRP3JKW1diD4JWrRXSKld0ufzwOwS5fXNkerTnvKtDUHG71CCBf0u4enPBBC3q1XPrUjpP8swYO1yDkneGhv_-k9x88Fj8rLDy7kpAHEVfHbseP18wiAAAeUlh6f3ipS_Oi6E9okIB9xMc55p82IYdYUCJf26tG82dVikMtqamr8RIPxcenXnSZ_pVlQfnOp-J_VB5pK8vTkq6VwsHbJivbiiNvXsGRR0h-wAd_TsaOuRk_amJibMbXftKaUX20bCo-ykgKn9ycV9E-ILKXcw9TeWvZZM1CRp8kTOb0DoBkJyPwaus3ki4jMtsQa9B6TbeLn9PYaGT87fmm2usztAXhEXSYlEUh6rYxkAEOswhopwcxgA2_-SHozIX08Fe6FhzzooAQGPQQr3B6LJA1Fzp7_XBjuJ_Nz6USZtCKk3a-1P0yho4Wt8whqF1rqgTm0A3mDgQ_o_YlpKq8tfaN4xapTa4-pfHSbUul9h5iufuCoBu2CjDOv4zQNyh608npXHPTIr-Gz6uS0tN6jwp74-0n0CoAim3uttxr8fAHeVvJKbuh81jBfafhqgKMRBHxcbU5NNeGReutyVet7iKnxj_x7UsJxf99TIVZdbjNoQLVtXgZDFfWanz_hz32sSwxsO55vnjl1hi7W0CsKYtfywZ5TIfog6K3ykKtmLZUdmCSiQ7zUE3K6t12ElNJpHqw5nifknVFB2-MLhsko6XvWjFthVm0ObVp2lEUuazLJWby2upwmiZ7eWkE7ZlXVEG7whMAho6VkTP4sEC8t5SEBYmORUy0omGYvPKYFSO9PeI&bid=0.08797579554225843 HTTP/1.1
Host: p.a64x.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: application/json
content-length: 0
location: https://gfxdn.pics/m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg
access-control-allow-credentials: true
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5FgJeY9MPyYhw%2BbqytRE1UyMwPlHzJg9TWIXORe5A6g1I3FZo7Jb4ya3oeHyG9aiJdxT%2FFKVY1qpbrqE5Bm7J%2BDJ1UvS4Zt%2FH0kJMT875rlYymJhfFS4bOF0H6V"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35b5bf297128-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=997&min_rtt=526&rtt_var=958&sent=9&recv=12&lost=0&retrans=0&sent_bytes=3928&recv_bytes=2858&delivery_rate=6435555&cwnd=252&unsent_bytes=0&cid=cc6de8d830ea628d&ts=98&x=0"
X-Firefox-Spdy: h2
|
|
| gfxdn.pics/m/p/0/883/883207/conversions/0OErF2ya-in-page-ad-images.jpg | 45.133.44.25 | 200 OK | 5.6 kB |
URL GET HTTP/2gfxdn.pics/m/p/0/883/883207/conversions/0OErF2ya-in-page-ad-images.jpg IP45.133.44.25:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectgfxdn.pics Fingerprint21:74:CD:9F:28:AA:F9:B6:D0:A3:4E:41:31:4F:C8:D7:50:66:7D:0A ValiditySat, 30 Nov 2024 03:02:24 GMT - Fri, 28 Feb 2025 03:02:23 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 20", baseline, precision 8, 360x240, components 3 Hash49edcb1387f03075c9f1e3e5e25ff5a7 299775f4f77915c558373858740cae04d40ddaf6 912b34b348bb51e6ef8520a0410eba101754583caffb323b9c929cb29ba539d6
GET /m/p/0/883/883207/conversions/0OErF2ya-in-page-ad-images.jpg HTTP/1.1
Host: gfxdn.pics
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: image/jpeg
content-length: 5614
server: nginx
last-modified: Tue, 27 Aug 2024 06:56:18 GMT
etag: "66cd7892-15ee"
x-request-id: ba8e33e3821218f5e3fe021d3d1fac04
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache, no-cache
expires: 0
x-proxy-cache: REVALIDATED, HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| gfxdn.pics/m/p/0/883/883207/conversions/0OErF2ya-in-page-ad-images.jpg | 45.133.44.25 | 200 OK | 5.6 kB |
URL GET HTTP/2gfxdn.pics/m/p/0/883/883207/conversions/0OErF2ya-in-page-ad-images.jpg IP45.133.44.25:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectgfxdn.pics Fingerprint21:74:CD:9F:28:AA:F9:B6:D0:A3:4E:41:31:4F:C8:D7:50:66:7D:0A ValiditySat, 30 Nov 2024 03:02:24 GMT - Fri, 28 Feb 2025 03:02:23 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 20", baseline, precision 8, 360x240, components 3 Hash49edcb1387f03075c9f1e3e5e25ff5a7 299775f4f77915c558373858740cae04d40ddaf6 912b34b348bb51e6ef8520a0410eba101754583caffb323b9c929cb29ba539d6
GET /m/p/0/883/883207/conversions/0OErF2ya-in-page-ad-images.jpg HTTP/1.1
Host: gfxdn.pics
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: image/jpeg
content-length: 5614
server: nginx
last-modified: Tue, 27 Aug 2024 06:56:18 GMT
etag: "66cd7892-15ee"
x-request-id: ba8e33e3821218f5e3fe021d3d1fac04
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache, no-cache
expires: 0
x-proxy-cache: REVALIDATED, HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| ax4.poopstream.co/style.css | 172.67.200.123 | 200 OK | 38 kB |
URL GET HTTP/2ax4.poopstream.co/style.css IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectax4.poopstream.co Fingerprint2A:3B:7A:45:B3:66:2B:58:D6:9D:CD:11:2C:75:63:01:6D:0A:29:47 ValidityThu, 19 Dec 2024 09:08:50 GMT - Wed, 19 Mar 2025 10:08:49 GMT
File typeASCII text, with very long lines (65465) Hash040e80c238371d4172a34a4fb5b24fd3 92ccd50c595590d8b8a4b71275ed15ae25eb8120 b5d197171351e1ddaebb1bfe4f70c9103109d98395ff67c3aac7064ac474a22c
GET /style.css HTTP/1.1
Host: ax4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=259373
etag: W/"f94acf4d0db64b4a710fc6fce3bc2a49"
last-modified: Thu, 14 Mar 2024 17:13:04 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: HIT
age: 1391
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c3LLtTh9cbZS2nrtQ4I6kVuWaqO0N3M%2BO6H3DNJ2PGJ1UnFBXCjJY0FE%2FY3UZBj16VhR4x8WTBwqVOLZFSu3CmxE%2BPhmoPsU%2B%2FRaC0i7Ex9u409u9HHzFRTi0t7uWGUuuEKkSA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5d9170b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=933&min_rtt=522&rtt_var=783&sent=30&recv=12&lost=0&retrans=0&sent_bytes=31889&recv_bytes=1272&delivery_rate=6161702&cwnd=254&unsent_bytes=0&cid=44b9ee6d81b65ef8&ts=111&x=0"
X-Firefox-Spdy: h2
|
|
| poo.phd/cdn-cgi/rum? | 104.21.48.1 | 204 No Content | 0 B |
IP104.21.48.1:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectpoo.phd FingerprintD6:36:DE:79:30:4A:6D:68:F7:8B:44:4B:F5:6B:48:0A:0F:05:B9:C0 ValidityFri, 20 Dec 2024 16:48:14 GMT - Thu, 20 Mar 2025 17:48:11 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/rum? HTTP/1.1
Host: poo.phd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
content-type: application/json
Content-Length: 1254
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/top3?p=235
Cookie: _ga_RRBBHD087X=GS1.1.1735490192.1.0.1735490192.0.0.0; _ga=GA1.1.196203496.1735490193
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Sun, 29 Dec 2024 16:36:35 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://poo.phd
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 8f9b35b6de2456c1-OSL
x-frame-options: DENY
|
|
| gfxdn.pics/m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg | 45.133.44.25 | 200 OK | 1.7 kB |
URL GET HTTP/2gfxdn.pics/m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg IP45.133.44.25:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectgfxdn.pics Fingerprint21:74:CD:9F:28:AA:F9:B6:D0:A3:4E:41:31:4F:C8:D7:50:66:7D:0A ValiditySat, 30 Nov 2024 03:02:24 GMT - Fri, 28 Feb 2025 03:02:23 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 20", baseline, precision 8, 100x100, components 3 Hash6ce48d48d7798585f330c367851312c8 27e36324113480d6ad69ea0b6be5230987a3eefc 3abd3bcb6f6074a158ed763d91471a96a4204361f534f0465117b82735f7e4ed
GET /m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg HTTP/1.1
Host: gfxdn.pics
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:35 GMT
content-type: image/jpeg
content-length: 1681
server: nginx
last-modified: Tue, 27 Aug 2024 06:56:14 GMT
etag: "66cd788e-691"
x-request-id: c59dcd8e8ed68008e60741db0eed9407
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache, no-cache
expires: 0
x-proxy-cache: HIT, HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| gfxdn.pics/m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg | 45.133.44.25 | 200 OK | 1.7 kB |
URL GET HTTP/2gfxdn.pics/m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg IP45.133.44.25:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectgfxdn.pics Fingerprint21:74:CD:9F:28:AA:F9:B6:D0:A3:4E:41:31:4F:C8:D7:50:66:7D:0A ValiditySat, 30 Nov 2024 03:02:24 GMT - Fri, 28 Feb 2025 03:02:23 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 20", baseline, precision 8, 100x100, components 3 Hash6ce48d48d7798585f330c367851312c8 27e36324113480d6ad69ea0b6be5230987a3eefc 3abd3bcb6f6074a158ed763d91471a96a4204361f534f0465117b82735f7e4ed
GET /m/p/0/883/883208/conversions/M4Y7kv1Z-in-page-ad-icons.jpg HTTP/1.1
Host: gfxdn.pics
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:35 GMT
content-type: image/jpeg
content-length: 1681
server: nginx
last-modified: Tue, 27 Aug 2024 06:56:14 GMT
etag: "66cd788e-691"
x-request-id: c59dcd8e8ed68008e60741db0eed9407
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache, no-cache
expires: 0
x-proxy-cache: HIT, HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| cb530ae596.66a5e92d66.com/e87454ed1c64bc1cf3034629a9c0ee6f.js | 45.133.44.52 | 200 OK | 148 kB |
URL GET HTTP/2cb530ae596.66a5e92d66.com/e87454ed1c64bc1cf3034629a9c0ee6f.js IP45.133.44.52:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectcb530ae596.66a5e92d66.com Fingerprint42:4B:A2:71:CF:CA:C4:37:5F:FA:2C:DE:68:F9:1D:80:57:61:11:11 ValidityThu, 26 Dec 2024 02:15:01 GMT - Wed, 26 Mar 2025 02:15:00 GMT
File typegzip compressed data, from Unix Size148 kB (147484 bytes) Hasheedc2b821e12f0d2ed6e069a38fa7ef2 ba7dd9f09a245a42e84bf268a3ac541699dd7bc7 c91bdc3a499ccc645af432acf44c666b71e59a2508b2055c2e88701e1d6eb07f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /e87454ed1c64bc1cf3034629a9c0ee6f.js HTTP/1.1
Host: cb530ae596.66a5e92d66.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Sat, 28 Dec 2024 11:05:15 GMT
etag: W/"676fdb6b-86d8a"
content-encoding: gzip
expires: Sun, 29 Dec 2024 16:41:33 GMT
cache-control: max-age=300
x-proxy-cache: HIT
x-cdn-host-id: ds8137
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| nereserv.com/in/dip?site=native-push&wl=1&event_id=63b5c021-81c8-4386-a779-13122f7e8202&subid=357529620&sid=7396243&spot_id=418774&created_at=2024-12-29&timezone=0&ver=7.370.0-b&is_native=1 | 116.202.204.105 | 200 OK | 0 B |
URL GET HTTP/2nereserv.com/in/dip?site=native-push&wl=1&event_id=63b5c021-81c8-4386-a779-13122f7e8202&subid=357529620&sid=7396243&spot_id=418774&created_at=2024-12-29&timezone=0&ver=7.370.0-b&is_native=1 IP116.202.204.105:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectnotification.tubecup.net FingerprintEE:9A:59:DB:A9:CD:73:0A:9C:87:AC:9F:FE:A1:90:AA:A1:7E:F8:D4 ValidityThu, 07 Nov 2024 10:40:28 GMT - Wed, 05 Feb 2025 10:40:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/dip?site=native-push&wl=1&event_id=63b5c021-81c8-4386-a779-13122f7e8202&subid=357529620&sid=7396243&spot_id=418774&created_at=2024-12-29&timezone=0&ver=7.370.0-b&is_native=1 HTTP/1.1
Host: nereserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.24.0
date: Sun, 29 Dec 2024 16:36:33 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| enrtx.com/get/ | 94.130.197.239 | 200 OK | 15 kB |
IP94.130.197.239:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectpuwpush.com Fingerprint61:BC:31:65:90:EA:DD:3B:91:05:29:93:84:00:89:BB:11:CB:81:2F ValidityWed, 30 Oct 2024 10:28:34 GMT - Tue, 28 Jan 2025 10:28:33 GMT
Hash4168f869686f8016d513ca7612c86247 db76c783687490d1643d4f6814c0b4bd2d64f0b1 93969be6a37beb157b1bb8d3f91a0a9634ed8faaaf679ceda095bdf393a1ebb1
POST /get/ HTTP/1.1
Host: enrtx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://poo.phd/
Content-Type: text/plain;charset=UTF-8
Content-Length: 1042
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.16.0
date: Sun, 29 Dec 2024 16:36:35 GMT
content-type: application/json
content-length: 14604
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
|
|
| cb530ae596.66a5e92d66.com/72efa6d051903f0cdc3fc802fb972499/114039?version_name=c&domain=poo.phd | 45.133.44.52 | 200 OK | 3.7 kB |
URL GET HTTP/2cb530ae596.66a5e92d66.com/72efa6d051903f0cdc3fc802fb972499/114039?version_name=c&domain=poo.phd IP45.133.44.52:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectcb530ae596.66a5e92d66.com Fingerprint42:4B:A2:71:CF:CA:C4:37:5F:FA:2C:DE:68:F9:1D:80:57:61:11:11 ValidityThu, 26 Dec 2024 02:15:01 GMT - Wed, 26 Mar 2025 02:15:00 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (4203), with no line terminators Hash59545dd4527a435b2abf540db4bdeddc a35dbe900f7c1078a6fea45aa0895c4ab0656439 de87996d30ecf0ec769af94f6eaba099bccfdf695f1a91dc9e0e7d052a9d13e3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /72efa6d051903f0cdc3fc802fb972499/114039?version_name=c&domain=poo.phd HTTP/1.1
Host: cb530ae596.66a5e92d66.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: application/json
server: nginx/1.18.0
cache-control: max-age=300
expires: Sun, 29 Dec 2024 16:41:33 GMT
x-proxy-cache: HIT
x-cdn-host-id: ds8137
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| poo.phd/404 | 104.21.48.1 | 200 OK | 4.5 kB |
IP104.21.48.1:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectpoo.phd FingerprintD6:36:DE:79:30:4A:6D:68:F7:8B:44:4B:F5:6B:48:0A:0F:05:B9:C0 ValidityFri, 20 Dec 2024 16:48:14 GMT - Thu, 20 Mar 2025 17:48:11 GMT
File typeHTML document, ASCII text, with very long lines (4633), with no line terminators Hash68a9661da1339c84148fafd857c96f54 f68d0dae798f76273603184a8c6ff35e00c8a2de 6f12a57767aacc2d61f88d924e7864c5df81bb93a4c64d8833898a68accf7185
GET /404 HTTP/1.1
Host: poo.phd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://poo.phd/top3?p=235
DNT: 1
Connection: keep-alive
Cookie: _ga_RRBBHD087X=GS1.1.1735490192.1.0.1735490192.0.0.0; _ga=GA1.1.196203496.1735490193
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: text/html;charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3XSJMfwihWMnWUZSKhZN2dZLEDemOWOREALAzGMSgbO3Tayeosqb3IbKITNQyYH7APFqpleLKIa9lu4hzAn1bM8nBF4Ml6k99M6JzoAap%2BZyKM9C6QYOjW4S"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=3600, must-revalidate
content-encoding: br
cf-ray: 8f9b35b30e0c56c1-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
|
|
| cb530ae596.66a5e92d66.com/21a9e36a91710a8570bef915f473fb65.js | 45.133.44.52 | 200 OK | 122 kB |
URL GET HTTP/2cb530ae596.66a5e92d66.com/21a9e36a91710a8570bef915f473fb65.js IP45.133.44.52:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectcb530ae596.66a5e92d66.com Fingerprint42:4B:A2:71:CF:CA:C4:37:5F:FA:2C:DE:68:F9:1D:80:57:61:11:11 ValidityThu, 26 Dec 2024 02:15:01 GMT - Wed, 26 Mar 2025 02:15:00 GMT
Size122 kB (122015 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /21a9e36a91710a8570bef915f473fb65.js HTTP/1.1
Host: cb530ae596.66a5e92d66.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Thu, 05 Dec 2024 14:47:03 GMT
etag: W/"6751bce7-1dc9f"
content-encoding: gzip
expires: Sun, 29 Dec 2024 16:41:33 GMT
cache-control: max-age=300
x-proxy-cache: HIT
x-cdn-host-id: ds8137
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| static.bookmsg.com/creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790_icon.webp | 45.133.44.25 | 200 OK | 486 B |
URL GET HTTP/2static.bookmsg.com/creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790_icon.webp IP45.133.44.25:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectstatic.bookmsg.com Fingerprint6B:98:BE:D7:28:05:BB:C1:1E:1B:28:3A:0F:F9:79:86:2D:94:63:BF ValiditySun, 01 Dec 2024 03:02:39 GMT - Sat, 01 Mar 2025 03:02:38 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp Hashceeb4e8840c24621c0e0352b42b38a5b 03cbceb0134a39267014595938705e2916580644 50cb77ae9715629235f102dd53a68559df1b64416f71179dbb4aa942725790b3
GET /creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790_icon.webp HTTP/1.1
Host: static.bookmsg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:34 GMT
content-type: image/webp
content-length: 486
server: nginx/1.24.0
last-modified: Fri, 31 May 2024 10:56:43 GMT
etag: "6659aceb-1e6"
expires: Mon, 29 Dec 2025 16:36:34 GMT
cache-control: max-age=31536000
x-proxy-cache: HIT
x-cdn-host-id: ds5058
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| | 104.21.48.1 | 200 OK | 15 kB |
URL User Request GET HTTP/2IP104.21.48.1:443
CertificateIssuerGoogle Trust Services Subjectpoo.phd FingerprintD6:36:DE:79:30:4A:6D:68:F7:8B:44:4B:F5:6B:48:0A:0F:05:B9:C0 ValidityFri, 20 Dec 2024 16:48:14 GMT - Thu, 20 Mar 2025 17:48:11 GMT
File typeJavaScript source, ASCII text, with very long lines (6442) Hash29246157395d9312c0684f6fa493b87f 2e329205938367648221b24d951d6e03f2bd3fae c67316f3ec3b3b18ff012894901dfd21351c4fc1d925b47509d7afafd118d1e2
GET /top3?p=235 HTTP/1.1
Host: poo.phd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:31 GMT
content-type: text/html;charset=UTF-8
cache-control: public, max-age=3600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5OFei%2BipOT%2FHILiaSGcow0nzWGOmOYNTgNDq6tKnb6Liz0gd3I20sfOhZDwgQRvWZMMWSsT9CUOPbCuZZCYqVU%2ByFY7nAmzDGBqJh9sUb%2FRUXmQxuMziV%2BK7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f9b35a00896b50c-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6331&min_rtt=476&rtt_var=11729&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3192&recv_bytes=1119&delivery_rate=7264214&cwnd=254&unsent_bytes=0&cid=2710e8db791c16e6&ts=596&x=0"
X-Firefox-Spdy: h2
|
|
| ax4.poopstream.co/bootstrap.min.css | 172.67.200.123 | 200 OK | 209 kB |
URL GET HTTP/2ax4.poopstream.co/bootstrap.min.css IP172.67.200.123:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectax4.poopstream.co Fingerprint2A:3B:7A:45:B3:66:2B:58:D6:9D:CD:11:2C:75:63:01:6D:0A:29:47 ValidityThu, 19 Dec 2024 09:08:50 GMT - Wed, 19 Mar 2025 10:08:49 GMT
File typeASCII text, with very long lines (625) Size209 kB (208810 bytes) Hash3ad35d9c124d6c7d13f776dde0df9286 1bfc432b338ca01be6b05ab8e87f4a63caa8d82b 10c142c79bbbfe42ce677eedeee70f918de0e759feabc175f423543aee886a6b
GET /bootstrap.min.css HTTP/1.1
Host: ax4.poopstream.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: text/css
etag: W/"3ad35d9c124d6c7d13f776dde0df9286"
last-modified: Thu, 14 Mar 2024 17:13:03 GMT
vary: Accept-Encoding
cache-control: max-age=1200
cf-cache-status: HIT
age: 5121
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9XB9c%2FYKoAJK7tcnDmyz2WzsV1r8j%2FBLxg8W4QLFXfMHn3s1GHd4uCVhrPAyCzBQgGmkMkS2PdduWG12CFsYNY2kX8pwyRYIkUY3%2BzlQ6Pzbbu3v5tqB%2FZ6A1vXpxGZOVWGs5A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35a5c9030b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=933&min_rtt=522&rtt_var=783&sent=7&recv=12&lost=0&retrans=0&sent_bytes=3270&recv_bytes=1272&delivery_rate=6161702&cwnd=254&unsent_bytes=0&cid=44b9ee6d81b65ef8&ts=110&x=0"
X-Firefox-Spdy: h2
|
|
| static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 | 104.16.80.73 | 200 OK | 20 kB |
URL GET HTTP/2static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 IP104.16.80.73:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectcloudflareinsights.com FingerprintA3:1D:4E:72:41:6A:D8:04:03:98:90:E7:8B:07:8D:A6:88:FE:B6:A3 ValidityFri, 01 Nov 2024 08:16:38 GMT - Thu, 30 Jan 2025 08:16:37 GMT
File typeJavaScript source, ASCII text, with very long lines (19948), with no line terminators Hashec18af6d41f6f278b6aed3bdabffa7bc 62c9e2cab76b888829f3c5335e91c320b22329ae 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://poo.phd
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:32 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.6.1"
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f9b35a5d90f56ba-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| storage.multstorage.com/log/count.html | 104.21.30.242 | 200 OK | 882 B |
URL GET HTTP/2storage.multstorage.com/log/count.html IP104.21.30.242:443
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerGoogle Trust Services Subjectmultstorage.com Fingerprint96:2B:62:41:7C:56:AE:E2:BF:91:30:F3:03:0A:B7:E6:EC:70:67:7B ValidityFri, 08 Nov 2024 05:42:46 GMT - Thu, 06 Feb 2025 05:42:45 GMT
File typeHTML document, ASCII text, with very long lines (919), with no line terminators Hash053b1fe641da8057571d40ebaf1624ab 09b2648b7d08c84621298f0b939cea5170a65022 6606334874a3edb8295831f41d3684433e4553ffe0a72e58c90926e00f39c6a4
GET /log/count.html HTTP/1.1
Host: storage.multstorage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: text/html
last-modified: Mon, 18 Sep 2023 14:39:06 GMT
vary: Accept-Encoding
x-request-id: ad95fc96e29c6ec4c435379e9bab6dff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O9%2FJ7Og9Aq70WA0mLZZHhBewUAGw3rJPI8Y1ePSYDWM7TaBK9rVqHXjLzThl8FSqTjQKAxmgeL5rm6SsO0zOQ8ecytkswWHIRUmShpP5i5m2hVY136k0hbdmndxpObR%2BBhBcmuiM1lDKVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f9b35ad9bd2b51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=823&min_rtt=517&rtt_var=356&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3204&recv_bytes=1145&delivery_rate=7841155&cwnd=253&unsent_bytes=0&cid=ea9636abfb7d2bd2&ts=62&x=0"
X-Firefox-Spdy: h2
|
|
| cb530ae596.66a5e92d66.com/e61c4f1a27f3e1b700e4ffd531a98d5f.js | 45.133.44.52 | 200 OK | 190 kB |
URL GET HTTP/2cb530ae596.66a5e92d66.com/e61c4f1a27f3e1b700e4ffd531a98d5f.js IP45.133.44.52:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://poo.phd/top3?p=235 CertificateIssuerLet's Encrypt Subjectcb530ae596.66a5e92d66.com Fingerprint42:4B:A2:71:CF:CA:C4:37:5F:FA:2C:DE:68:F9:1D:80:57:61:11:11 ValidityThu, 26 Dec 2024 02:15:01 GMT - Wed, 26 Mar 2025 02:15:00 GMT
Size190 kB (190355 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /e61c4f1a27f3e1b700e4ffd531a98d5f.js HTTP/1.1
Host: cb530ae596.66a5e92d66.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://poo.phd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 29 Dec 2024 16:36:33 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Sat, 28 Dec 2024 11:05:19 GMT
etag: W/"676fdb6f-2e793"
content-encoding: gzip
expires: Sun, 29 Dec 2024 16:41:33 GMT
cache-control: max-age=300
x-proxy-cache: HIT
x-cdn-host-id: ds8137
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|