Report - lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8

Report Overview

Submitted URL
lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
IP
46.21.30.90
ASN
#203639 Tekka Digital SA
Submitted
2022-10-06 19:06:19
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
static.hotjar.com	641	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	371 B	12 kB	54.230.111.113
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	34.160.144.191
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
www.google.no	25607	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	475 B	694 B	142.250.74.3
www.gstatic.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	760 B	18 kB	142.250.74.163
www.googletagmanager.com	75	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	375 B	66 kB	142.250.74.168
script.hotjar.com	887	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	378 B	67 kB	54.230.111.73
vars.hotjar.com	1014	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	499 B	1.7 kB	54.230.111.85
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	54.230.111.35
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.3 kB	7.0 kB	142.250.74.3
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.3 kB	6.2 kB	23.36.76.226
lander.xxxfucktor.com	162082	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	24 kB	332 kB	46.21.30.90
www.google-analytics.com	40	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	366 B	21 kB	142.250.74.174
www.google.com	7	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	512 B	694 B	142.250.74.164
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.6 kB	46 kB	34.120.237.76
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	54.186.209.73
region1.analytics.google.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	738 B	568 B	216.239.32.36
stats.g.doubleclick.net	96	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.1 kB	1.3 kB	173.194.73.154

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-06	medium	lander.xxxfucktor.com/css/common/WL/WL-XF.min.css?v=1.13	Phishing
2022-10-06	medium	lander.xxxfucktor.com/css/model/0519/TF_discover_def.min.css?v=1.11	Phishing
2022-10-06	medium	lander.xxxfucktor.com/css/common/main.min.css?v=1.11	Phishing
2022-10-06	medium	lander.xxxfucktor.com/js/model/0519/TF_discover_def.min.js?v=1.2	Phishing
2022-10-06	medium	lander.xxxfucktor.com/css/common/parent/parent-XF.min.css?v=1.11	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	www.googletagmanager.com/gtag/js?id=G-HP4Q1W4KPP&l=dataLayer&cx=c	213 kB	2023-03-08	2023-03-08
Pretty URL www.googletagmanager.com/gtag/js?id=G-HP4Q1W4KPP&l=dataLayer&cx=c IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:41:06 Last Seen2023-03-08 07:41:06 Times Seen1 Hash 5bdfe58e201c62ad6856ba365018ba95 05c9e59f2ffc3c56bdc627bd7edb09fb40703cc6 da5a97bdc33f83691b2c8f6c0d83d15f7b999702d12974b76a89a5d9b696373e Loading...

	lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8	312 B	2023-03-08	2023-03-11
Pretty URL lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8 IP 46.21.30.90 ASN #203639 Tekka Digital SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 00:54:46 Last Seen2023-03-11 09:59:08 Times Seen1 Hash 0b251559bad72f84ec1d2b122aa603a3 f03b7d5575c853ba2940fa05af74695e6628d3e6 249874794903ab7e20d10d2982ba198d7f0016a7920b4318de7a23d8d8c2b54d Loading...

	www.google-analytics.com/analytics.js	50 kB	2023-03-08	2024-04-20
Pretty URL www.google-analytics.com/analytics.js IP 142.250.74.174 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 05:22:31 Last Seen2024-04-20 17:36:09 Times Seen1522 Hash fda30e8a22c9bcd954fd8d0fadd0e77c ae47cd34cbde081a48d7f92fc80aaf06a1381193 b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Loading...

	static.hotjar.com/c/hotjar-2057278.js?sv=7	4.6 kB	2023-03-08	2023-03-08
Pretty URL static.hotjar.com/c/hotjar-2057278.js?sv=7 IP 54.230.111.113 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:41:06 Last Seen2023-03-08 07:41:06 Times Seen1 Hash ee7f9c0e6b15f6bb966285e3b4acac2a dfd305098982082eb42d8cfe4c4a8ca5b17159d6 67ccc4459b681aa439db5f4a3e3f4cff6d10cd0030e1186b1b3773bcf75b84c9 Loading...

	lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8	341 B	2023-03-07	2024-02-27
Pretty URL lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8 IP 46.21.30.90 ASN #203639 Tekka Digital SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:21:52 Last Seen2024-02-27 04:34:04 Times Seen2 Hash 6decd3ee51043166e731dfc6a9ba56d2 8f51604cc798b66ce0d2f180f4e32a3a4d31b19a 473092793d44d9e8ddb3db540b601e9126899d22a1e7303a4bed5452df3a22b7 Loading...

	www.gstatic.com/firebasejs/7.2.1/firebase-messaging.js	46 kB	2023-03-07	2024-02-27
Pretty URL www.gstatic.com/firebasejs/7.2.1/firebase-messaging.js IP 142.250.74.163 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:21:52 Last Seen2024-02-27 04:34:04 Times Seen57 Hash f8b71cf0c077f0a5bf7858234e65b3b8 dc079fba8dc4d7281554497e6d98956157e29223 390daf9f5b019e519db0d85f1851e77094b49e4dc3225e8ba51fffe784385103 Loading...

	unknown	0 B	2023-03-07	2024-04-24
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-24 10:56:04 Times Seen37037441 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	lander.xxxfucktor.com/js/model/0519/TF_discover_def.min.js?v=1.2	176 kB	2023-03-08	2023-03-11
Pretty URL lander.xxxfucktor.com/js/model/0519/TF_discover_def.min.js?v=1.2 IP 46.21.30.90 ASN #203639 Tekka Digital SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 00:54:46 Last Seen2023-03-11 09:59:08 Times Seen1 Hash 5152e53d94bc891c3a412663ff680ad9 92aaf43c23d47df6ca149c9ad129e266f9a506cb 88bfe3ba70b636698350bb72d88f4b620cfda2977bf7870d8ee072d84517d59c Loading...

	vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html	2.3 kB	2023-03-07	2023-03-17
Pretty URL vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html IP 54.230.111.85 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:20:41 Last Seen2023-03-17 12:55:02 Times Seen1 Hash d92066afca578ed14865977d9feac035 2272d154325335dd33ffed8b26929039c6561771 fc200422a2125ba3391e529347524b6596dc8eb4cbb545e7db65ecde73f5bb28 Loading...

	www.gstatic.com/firebasejs/7.2.1/firebase-app.js	12 kB	2023-03-07	2024-02-27
Pretty URL www.gstatic.com/firebasejs/7.2.1/firebase-app.js IP 142.250.74.163 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:21:52 Last Seen2024-02-27 04:34:04 Times Seen766 Hash 170c843998ef9b51412647e1da277add 4293ddf36fc955c6cd9a1a4b6b8afc516aa1d693 7a6f852b691424bdbbfaee511953ed55b379e220e489008e8536310f0d6d4fdf Loading...

HTTP Transactions (53)

URL IP Response Size

firefox.settings.services.mozilla.com/v1/

54.230.111.35

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
54.230.111.35:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
2d12f67fe57a87e7366b662d153a5582
d7b02d81cc74f24a251d9363e0f4b0a149264ec1
73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=259200
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Wed, 05 Oct 2022 15:47:18 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 db0992ba349fc51d5151ec8330e36c28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: x4MipejHLUwHnEAv-zvgTn-88hL3Vk7TxNk81p89ODi69KabTgxNsQ==
Age: 98330

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
282f6e1328452c1cb41f6a6272fff757
20b9ff1b5f4f81b645769bd4b4cf7bf7dfc16262
6a8070ebe51259cb11db68cca2c81f3c7408fad481d8c14cc1c38912442c63f4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A8070EBE51259CB11DB68CCA2C81F3C7408FAD481D8C14CC1C38912442C63F4"
Last-Modified: Wed, 05 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4134
Expires: Thu, 06 Oct 2022 20:15:02 GMT
Date: Thu, 06 Oct 2022 19:06:08 GMT
Connection: keep-alive

lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8

46.21.30.90

301 Moved Permanently

178 B

URL HTTP/1.1
lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

HTTP Headers

GET /?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 06 Oct 2022 19:06:08 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
94a09d62ab3057cda67a091c8d7478f5
b1c9d223a951d0bc9f17c9f3b84501266a552b58
582364f9f6014520c269f1f794e7c34027bd2697b53e5d02fad43e74a735e471

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "582364F9F6014520C269F1F794E7C34027BD2697B53E5D02FAD43E74A735E471"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4556
Expires: Thu, 06 Oct 2022 20:22:04 GMT
Date: Thu, 06 Oct 2022 19:06:08 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: pcWvgEhXSwi5XiLtO6LrG6hwoX88/g3FxtIthhRBTWEGglIPxqDJ5loeTnFz40wMAEUYuT0DrGs=
x-amz-request-id: D19XZXCDGDV10HV4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 06 Oct 2022 18:30:53 GMT
age: 2115
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 06 Oct 2022 19:06:08 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

54.230.111.35

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
54.230.111.35:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Pragma, Content-Length, Backoff, Last-Modified, Cache-Control, Content-Type, Retry-After, ETag, Expires, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Thu, 06 Oct 2022 18:29:41 GMT
Expires: Thu, 06 Oct 2022 19:07:03 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 e2f427863e6bdb72ad8bed72b596d81e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 8zQkyo4Iq5wxKoHWk1tWTzisDwKXb7qTkJbdnD80Pi85yv6grthNmQ==
Age: 2187

lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8

46.21.30.90

200 OK

6.0 kB

URL HTTP/1.1
lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (534)
Size
6.0 kB (6022 bytes)
Hash
40118b7177d89e2366a5e033d6ee6a51
55cee960bd4f13ab6135bf7c09c75d216b43f50f
a29955e051719c0582d26d04b35f28cfa4ad2c18c39984461be4b5288e66c437

HTTP Headers

GET /?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/7.2.17
Cache-Control: private, must-revalidate
pragma: no-cache
expires: -1
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; expires=Thu, 06-Oct-2022 21:06:08 GMT; Max-Age=7200; path=/
laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; expires=Thu, 06-Oct-2022 21:06:08 GMT; Max-Age=7200; path=/; httponly
landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9; expires=Fri, 07-Oct-2022 19:06:08 GMT; Max-Age=86400; path=/; httponly
Content-Encoding: gzip
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
8be5570b9a5ca76c580da007a824b029
38840f2ac6476bdd5608121c5653e338c7ad9715
0b94e05080ef85432b1815eb3c6c7594c9613cfde1b51eeabee46d0d9fde64b2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3402
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:09 GMT
Last-Modified: Thu, 06 Oct 2022 18:09:27 GMT
Server: ECS (ska/F70A)
X-Cache: HIT
Content-Length: 471

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
ff5f22aafa6751c60631736c305a4c7c
278b89e5c1a978e070be4b66bb780862894b8504
b501664d7591e6dfe95c8641e0020e04b76f16f5cb80a7fc0ee0b36af60a6382

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
ff5f22aafa6751c60631736c305a4c7c
278b89e5c1a978e070be4b66bb780862894b8504
b501664d7591e6dfe95c8641e0020e04b76f16f5cb80a7fc0ee0b36af60a6382

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f763a685d14b05b6ced9792151da30b8
b25be5359245be857ffa1bddcb197cb771a36a45
505ad6dc6417d58207f0d68862c4423f4611660ccc6afe165fd3ec2ccb1c893d

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.gstatic.com/firebasejs/7.2.1/firebase-app.js

142.250.74.163

200 OK

4.1 kB

URL HTTP/2
www.gstatic.com/firebasejs/7.2.1/firebase-app.js
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (12024)
Size
4.1 kB (4111 bytes)
Hash
03f0707e570ee43e974fbe5fb05f3278
0bf15028f931f36198da99527933a43641da2729
4ccac2d12a88ad1a834e9a3fa9d4c1c465b1360b765d3fc8c04e8d096f207bb1

HTTP Headers

GET /firebasejs/7.2.1/firebase-app.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 4111
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 06 Oct 2022 18:08:17 GMT
expires: Fri, 06 Oct 2023 18:08:17 GMT
cache-control: public, max-age=31536000
age: 3472
last-modified: Wed, 16 Oct 2019 19:09:14 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

www.gstatic.com/firebasejs/7.2.1/firebase-messaging.js

142.250.74.163

200 OK

12 kB

URL HTTP/2
www.gstatic.com/firebasejs/7.2.1/firebase-messaging.js
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (46118)
Size
12 kB (11948 bytes)
Hash
5d82797c5bee20fe207577d4ce966e7c
d724449c78fe740560f5731ba7d0678ae46ffce1
0163aff308be61967fdf8269324e19dc297aa79b6c4389197126e1c44876ec46

HTTP Headers

GET /firebasejs/7.2.1/firebase-messaging.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 11948
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 30 Sep 2022 03:01:44 GMT
expires: Sat, 30 Sep 2023 03:01:44 GMT
cache-control: public, max-age=31536000
age: 576265
last-modified: Wed, 16 Oct 2019 19:09:15 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

www.googletagmanager.com/gtm.js?id=GTM-MMJF4JG

142.250.74.168

200 OK

65 kB

URL HTTP/2
www.googletagmanager.com/gtm.js?id=GTM-MMJF4JG
IP
142.250.74.168:0
ASN
#15169 GOOGLE

File type
Unicode text, UTF-8 text, with very long lines (6459)
Size
65 kB (64763 bytes)
Hash
edf69d6b25646a3a8de36671126d9c90
4d4e6c19cb7ab1bf7117b7db7dc8d13111448d2f
ec4b181e86f8222c5fc89095c598fca8a4c5621a4add4041dbd86c6d7b4cd073

HTTP Headers

GET /gtm.js?id=GTM-MMJF4JG HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 06 Oct 2022 19:06:09 GMT
expires: Thu, 06 Oct 2022 19:06:09 GMT
cache-control: private, max-age=900
last-modified: Thu, 06 Oct 2022 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 64763
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f763a685d14b05b6ced9792151da30b8
b25be5359245be857ffa1bddcb197cb771a36a45
505ad6dc6417d58207f0d68862c4423f4611660ccc6afe165fd3ec2ccb1c893d

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

lander.xxxfucktor.com/css/common/WL/WL-XF.min.css?v=1.13

46.21.30.90

200 OK

1.1 kB

URL HTTP/1.1
lander.xxxfucktor.com/css/common/WL/WL-XF.min.css?v=1.13
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
ASCII text, with very long lines (3908)
Size
1.1 kB (1093 bytes)
Hash
dbf01fb04746aea5ee1084cd89733a17
3e4c9076f33f848e7654a37828937255545957dc
aa2b62a47c8a8c1b61eba9ac69f79fac7d379c0c32054c2aaf90cfb630bee072

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /css/common/WL/WL-XF.min.css?v=1.13 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: close
Last-Modified: Tue, 15 Mar 2022 15:46:08 GMT
ETag: W/"6230b4c0-f70"
Content-Encoding: gzip
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/css/model/0519/TF_discover_def.min.css?v=1.11

46.21.30.90

200 OK

1.3 kB

URL HTTP/1.1
lander.xxxfucktor.com/css/model/0519/TF_discover_def.min.css?v=1.11
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
ASCII text, with very long lines (4653)
Size
1.3 kB (1275 bytes)
Hash
1ee724d47b9a1d742ed9f36798a2a93f
2f8e83d98d80a6c15780add82c95887fe1f5016d
fb74c8119c6b9b17dfe2ad2bd53761764eff03593a53569cd086a686f8a210d8

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /css/model/0519/TF_discover_def.min.css?v=1.11 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: close
Last-Modified: Wed, 22 May 2019 13:04:53 GMT
ETag: W/"5ce548f5-1263"
Content-Encoding: gzip
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/css/common/main.min.css?v=1.11

46.21.30.90

200 OK

3.1 kB

URL HTTP/1.1
lander.xxxfucktor.com/css/common/main.min.css?v=1.11
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
ASCII text, with very long lines (11036)
Size
3.1 kB (3095 bytes)
Hash
7613e0fa6b60edf3add9dc06cedc1cf8
161e9a5033ec665064ba9bccf65b517237c7303e
4d99d66f978ebfd5de2cf338b1006643c3f2e4531ba3adaa16c84d66b6ca0d4b

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /css/common/main.min.css?v=1.11 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: close
Last-Modified: Tue, 08 Jun 2021 13:52:20 GMT
ETag: W/"60bf7614-2b47"
Content-Encoding: gzip
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

push.services.mozilla.com/

54.186.209.73

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.186.209.73:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: mOmdacu2KBk9Csn9BOjkQg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: fII7FtF61DXxpTiyTDjW5kqR5P4=

lander.xxxfucktor.com/js/model/0519/TF_discover_def.min.js?v=1.2

46.21.30.90

200 OK

176 kB

URL HTTP/1.1
lander.xxxfucktor.com/js/model/0519/TF_discover_def.min.js?v=1.2
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Size
176 kB (175662 bytes)
Hash
5152e53d94bc891c3a412663ff680ad9
92aaf43c23d47df6ca149c9ad129e266f9a506cb
88bfe3ba70b636698350bb72d88f4b620cfda2977bf7870d8ee072d84517d59c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/model/0519/TF_discover_def.min.js?v=1.2 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: application/javascript
Content-Length: 175662
Connection: close
Last-Modified: Tue, 19 Nov 2019 14:09:58 GMT
ETag: "5dd3f7b6-2ae2e"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/css/common/parent/parent-XF.min.css?v=1.11

46.21.30.90

200 OK

465 B

URL HTTP/1.1
lander.xxxfucktor.com/css/common/parent/parent-XF.min.css?v=1.11
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
ASCII text, with very long lines (1055)
Size
465 B (465 bytes)
Hash
52bcc610bec21b7e06c6a518fff296e5
f3ed1a4ba1ff76a742feec0e3909d604b78df9f2
336f720b9b29ee233c74d64fe0084a1f26fbdcde7997198ab0842ef317f2450a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /css/common/parent/parent-XF.min.css?v=1.11 HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: close
Last-Modified: Wed, 08 Jul 2020 07:43:28 GMT
ETag: W/"5f057920-44f"
Content-Encoding: gzip
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/images/common/WL/XF/18.png

46.21.30.90

200 OK

3.6 kB

URL HTTP/1.1
lander.xxxfucktor.com/images/common/WL/XF/18.png
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced\012- data
Size
3.6 kB (3568 bytes)
Hash
11db584942bbac0ba52bb1b4e5624c0e
73ab836d58232545e97d3f7d13d7f29dc134758b
63b3181309738dc0de1e5b44b4c76088b5f15f63cb66e13864bb164446dbe86e

HTTP Headers

GET /images/common/WL/XF/18.png HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: image/png
Content-Length: 3568
Connection: close
Last-Modified: Thu, 31 Jan 2019 14:32:56 GMT
ETag: "5c530718-df0"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/images/main/cardsImg.png

46.21.30.90

200 OK

4.1 kB

URL HTTP/1.1
lander.xxxfucktor.com/images/main/cardsImg.png
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
PNG image data, 147 x 26, 8-bit/color RGBA, non-interlaced\012- data
Size
4.1 kB (4077 bytes)
Hash
f5de15fadf47e207c917f08fda647e6f
dd3bf1e832521e0ed0cb074d605987a7545b02c3
286d9c03ffc56817354bca04e51c8cac2028e440862f3775c5c2926ea9b8b31f

HTTP Headers

GET /images/main/cardsImg.png HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: image/png
Content-Length: 4077
Connection: close
Last-Modified: Tue, 15 Mar 2022 15:46:08 GMT
ETag: "6230b4c0-fed"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/images/common/WL/XF/logo2.png

46.21.30.90

200 OK

6.8 kB

URL HTTP/1.1
lander.xxxfucktor.com/images/common/WL/XF/logo2.png
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
PNG image data, 185 x 29, 8-bit/color RGBA, non-interlaced\012- data
Size
6.8 kB (6779 bytes)
Hash
db4862e3b60fe2bbefdf1108031a89e4
51f0b4d1e8287c06f0043092108f956c38778702
0ec071a718f148dfe6222b858954c200990fa998474bc973bce0edf6e0f670e0

HTTP Headers

GET /images/common/WL/XF/logo2.png HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/css/common/WL/WL-XF.min.css?v=1.13
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9; _ga_HP4Q1W4KPP=GS1.1.1665083169.1.0.1665083169.60.0.0; _ga=GA1.1.1233812568.1665083169
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: image/png
Content-Length: 6779
Connection: close
Last-Modified: Thu, 31 Jan 2019 14:32:56 GMT
ETag: "5c530718-1a7b"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/images/main/close-icon-white.png

46.21.30.90

200 OK

24 kB

URL HTTP/1.1
lander.xxxfucktor.com/images/main/close-icon-white.png
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
PNG image data, 1120 x 1120, 8-bit/color RGBA, non-interlaced\012- data
Size
24 kB (23788 bytes)
Hash
0b0cc59513ce1d60b35573d6a3dfb70a
b05ce8178089eed9aca902d101866f8109df75ec
8df93291467752b70db1a46b7361d09c0f4634c0db10be1b385e7b924edca2ba

HTTP Headers

GET /images/main/close-icon-white.png HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/css/common/main.min.css?v=1.11
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9; _ga_HP4Q1W4KPP=GS1.1.1665083169.1.0.1665083169.60.0.0; _ga=GA1.1.1233812568.1665083169
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: image/png
Content-Length: 23788
Connection: close
Last-Modified: Mon, 25 Mar 2019 13:27:18 GMT
ETag: "5c98d736-5cec"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

lander.xxxfucktor.com/images/model/0519/TF_discover_def/desktop.jpg

46.21.30.90

200 OK

99 kB

URL HTTP/1.1
lander.xxxfucktor.com/images/model/0519/TF_discover_def/desktop.jpg
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1400x900, components 3\012- data
Size
99 kB (98944 bytes)
Hash
d2f06885004c4dba19b985b8d7eb2fb4
e5bbfad71f37b69bfc44e1e1e375c8e4944ec332
5de0c87d590e772192cae2ccaeddace2754bb5fc78af4cb725a4e3d18413c3f1

HTTP Headers

GET /images/model/0519/TF_discover_def/desktop.jpg HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/css/model/0519/TF_discover_def.min.css?v=1.11
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9; _ga_HP4Q1W4KPP=GS1.1.1665083169.1.0.1665083169.60.0.0; _ga=GA1.1.1233812568.1665083169
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:09 GMT
Content-Type: image/jpeg
Content-Length: 98944
Connection: close
Last-Modified: Wed, 22 May 2019 13:04:53 GMT
ETag: "5ce548f5-18280"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

www.google-analytics.com/analytics.js

142.250.74.174

200 OK

20 kB

URL HTTP/2
www.google-analytics.com/analytics.js
IP
142.250.74.174:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (1325)
Size
20 kB (20039 bytes)
Hash
47e6f374ca946fddd5b59871b325736c
baa9282efc8785e84d247c3bff518eaa45f101c4
16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e

HTTP Headers

GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Thu, 06 Oct 2022 18:41:09 GMT
expires: Thu, 06 Oct 2022 20:41:09 GMT
cache-control: public, max-age=7200
age: 1501
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
1d4c3917173bd92c4b3208cdf2c7c345
726a9aa16eef5844afde825f9faf1b505d31e69b
572eebfaf735eb8aa1b3563d0317d52f5d22e9e83e5f5b6723f65da83fb15f22

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HP4Q1W4KPP&cid=1233812568.1665083169&gtm=2oea50&aip=1&z=791490898

142.250.74.3

200 OK

42 B

URL HTTP/2
www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HP4Q1W4KPP&cid=1233812568.1665083169&gtm=2oea50&aip=1&z=791490898
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

HTTP Headers

GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HP4Q1W4KPP&cid=1233812568.1665083169&gtm=2oea50&aip=1&z=791490898 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 19:06:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

script.hotjar.com/modules.cbd9768ba80ba0be5b17.js

54.230.111.73

200 OK

66 kB

URL HTTP/2
script.hotjar.com/modules.cbd9768ba80ba0be5b17.js
IP
54.230.111.73:0
ASN
#16509 AMAZON-02

File type
Unicode text, UTF-8 text, with very long lines (48714)
Size
66 kB (66229 bytes)
Hash
483a48bedf96c50163b542fb95446039
c724132c8b3b31f2938c84af7ced2b69b66bf5fe
5ea4d712f01c7b6f1c523834934ce998e251048ab6b5a1f82aa1cc00280843cb

HTTP Headers

GET /modules.cbd9768ba80ba0be5b17.js HTTP/1.1
Host: script.hotjar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: application/javascript
content-length: 66229
date: Tue, 04 Oct 2022 18:47:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "483a48bedf96c50163b542fb95446039"
last-modified: Tue, 04 Oct 2022 18:46:48 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 09ae414c9d6c5323d5147457ada70ec6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 9GHvUUU70jyELC6eQFBBIDa4UYrxP05saoM87gimf6ZYD_hsaZSseA==
age: 173944
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
1d4c3917173bd92c4b3208cdf2c7c345
726a9aa16eef5844afde825f9faf1b505d31e69b
572eebfaf735eb8aa1b3563d0317d52f5d22e9e83e5f5b6723f65da83fb15f22

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

region1.analytics.google.com/g/collect?v=2&tid=G-HP4Q1W4KPP&gtm=2oea50&_p=1278971872&_gaz=1&cid=1233812568.1665083169&ul=en-us&sr=1280x1024&_s=1&sid=1665083169&sct=1&seg=0&dl=https%3A%2F%2Flander.xxxfucktor.com%2F%3Fca%3D2%26p%3D129%26affid%3Drot_184043%26mediavars%3D2ac8e8b28ef746fe99283675ae001963163c8&dt=xxxFucktor&en=page_view&_fv=1&_nsi=1&_ss=1

216.239.32.36

204 No Content

0 B

URL HTTP/2
region1.analytics.google.com/g/collect?v=2&tid=G-HP4Q1W4KPP&gtm=2oea50&_p=1278971872&_gaz=1&cid=1233812568.1665083169&ul=en-us&sr=1280x1024&_s=1&sid=1665083169&sct=1&seg=0&dl=https%3A%2F%2Flander.xxxfucktor.com%2F%3Fca%3D2%26p%3D129%26affid%3Drot_184043%26mediavars%3D2ac8e8b28ef746fe99283675ae001963163c8&dt=xxxFucktor&en=page_view&_fv=1&_nsi=1&_ss=1
IP
216.239.32.36:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /g/collect?v=2&tid=G-HP4Q1W4KPP&gtm=2oea50&_p=1278971872&_gaz=1&cid=1233812568.1665083169&ul=en-us&sr=1280x1024&_s=1&sid=1665083169&sct=1&seg=0&dl=https%3A%2F%2Flander.xxxfucktor.com%2F%3Fca%3D2%26p%3D129%26affid%3Drot_184043%26mediavars%3D2ac8e8b28ef746fe99283675ae001963163c8&dt=xxxFucktor&en=page_view&_fv=1&_nsi=1&_ss=1 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://lander.xxxfucktor.com
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

HTTP/2 204 No Content
access-control-allow-origin: https://lander.xxxfucktor.com
date: Thu, 06 Oct 2022 19:06:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
05cdf02bcbbeed0122679c1118a350ce
b5311d6866b69206bec8f67a19cfeeefed233ef1
4b7235ec2ca2295957e75e79fdc718fbacc13bfd5674d1aeb7cbe5bed9fe9ead

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html

54.230.111.85

200 OK

1.0 kB

URL HTTP/2
vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html
IP
54.230.111.85:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2431), with no line terminators
Size
1.0 kB (1044 bytes)
Hash
f6a9ca04b0687ea3c0d98e8430c8c77b
35503b2deb23091a9a9c6c68d4020dbdf879588e
8e4328ecb6b395499567369e3c227231dbdaf361f43ce315934d7a2a3abbed41

HTTP Headers

GET /box-69edcc3187336f9b0a3fbb4c73be9fe6.html HTTP/1.1
Host: vars.hotjar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: text/html
content-length: 1044
date: Tue, 04 Oct 2022 09:28:08 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "f6a9ca04b0687ea3c0d98e8430c8c77b"
last-modified: Tue, 04 Oct 2022 07:09:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: vbCzxtQV08yE5rFqJ9ooqT1BJJd4S84FLgYjMk3DiamPpBPbH-_dSw==
age: 207482
X-Firefox-Spdy: h2

stats.g.doubleclick.net/g/collect?v=2&tid=G-HP4Q1W4KPP&cid=1233812568.1665083169&gtm=2oea50&aip=1

173.194.73.154

204 No Content

0 B

URL HTTP/2
stats.g.doubleclick.net/g/collect?v=2&tid=G-HP4Q1W4KPP&cid=1233812568.1665083169&gtm=2oea50&aip=1
IP
173.194.73.154:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /g/collect?v=2&tid=G-HP4Q1W4KPP&cid=1233812568.1665083169&gtm=2oea50&aip=1 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://lander.xxxfucktor.com
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

HTTP/2 204 No Content
access-control-allow-origin: https://lander.xxxfucktor.com
date: Thu, 06 Oct 2022 19:06:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

lander.xxxfucktor.com/images/common/WL/XF/favicon.ico

46.21.30.90

200 OK

1.2 kB

URL HTTP/1.1
lander.xxxfucktor.com/images/common/WL/XF/favicon.ico
IP
46.21.30.90:0
ASN
#203639 Tekka Digital SA

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size
1.2 kB (1150 bytes)
Hash
63277cad9918142e173f1f63dd2e4799
2a41f0e93550d36465d0c7a67f3dda35e3162dfe
d20c82c7bf5cdf2db5e2f2c7cb2fc0b0922559f6539c6fc0beb41059cb9b9952

HTTP Headers

GET /images/common/WL/XF/favicon.ico HTTP/1.1
Host: lander.xxxfucktor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/?ca=2&p=129&affid=rot_184043&mediavars=2ac8e8b28ef746fe99283675ae001963163c8
Cookie: XSRF-TOKEN=eyJpdiI6ImxVZXFtbXVHZFA4aFdRdDhZRjFkSEE9PSIsInZhbHVlIjoiSW5lbWwwdklSdXlRRTBBTUxmbGNrbFV3ME9namE0Ymp3OGtWUHFDeDNqYUd6eWxXR0Z5YTFvaTMreGdSeE5pSyIsIm1hYyI6IjI0ZTdhNDI1MDhhN2FhMDAxNWQyNTQ1OTM0N2NiOTUwMjk5ZTVmZWMxZjgyZDVkM2U5OWEwYzc2NWM0NTllZGEifQ%3D%3D; laravel=Vu5GCLgAUP8kKd4KrvhspTk80oSu2dMkkN8m5ARn; landdata=eyJpdiI6ImRndEk2Wlp1SmtiOGZBKzg1R1wvbCtnPT0iLCJ2YWx1ZSI6Imh2ZTY5MnkrbHE5Qkg0Z0JyZTFaU3JVM3F6dWVjXC9iQ0g4V2M4Q1VaaVwvSExiUVwvQWpyMVlGWjUrWHA2TVwvNzROK2tVSHUwK2FJRHBKYVFUcFp5TTdTXC93VFdmRXJnR2E4NlFyM2djM2lydys3cjNuWjZ1OGVTT1VFZFNsWmhteUVPK3RqTlBXVXFzRmY0c1RzTFJuaWpWekJnTjVRd0N5NVYydDl4YjUyOE05bXlsUE5heUIwdktlTkVMWEN0andSS3dOdkdER0kxWXFKQlY4UVM4U1JRNXA4UTBaMUErOHFpRWZ1dW00UFwvdDc2UFNtTHVSOEZTalpwemtSQnR3d1VUQVNmdDRvazRIQTVscEUxQWREZ0NYY0tVQU9qS0FvaHdxdmFqN2t6eUJGMDUwTWxrcXl4c25PKzNGQll4UXcwMG5XYU5odlNkSXk1eTdpZ2lzMmhMUlgxcFh2UGw3cW80d2NEdzZkZzVcL2pkY3RkVW1jblIwZVN1NEUweGZxY0FcL2JTenZqSDR3U092d1wvajRncXYyZFkyK1wvVFcyMXZpQ3ZXNEVqVWRaUVBNZTU4RDNmbXhzTUJVbjdMc252SlpEeFd3VXdyZ2Jtd2lUYWszZWNcL1ZLK1ZkNzZTYlpkajF5bkpjM1lmNGpCRHNcL0IyRkh2clRMNU9rbDRMR3ZZYWQ4eDgyNnlHRlwvUDczcjk2ZVwvWkpIaHN1NHlnQkxPVTdhQ3dVRnRqQlhrUW5VZGd3eHVoQ1BVMURFRzE1amxHcFJvdWt1dHBYQlB2dHhBSXNNZ1QwRHFxRSthQlJIT0huRmU4bVNXalwvcFk0MmZKUXNjWTdcL0o3VzVzY3ZqU21xNGEzN0lPbnhKNkJUcHhqN2k4K0hBSEQ4QTVJZ2dGMUM4QmxiSzhFMzV5eE9PeXAzRlFHWmttU2lER0FGd1RaRGNZWHo4ZDc1ejJCRXBYbEcyZ2NiU0NkNGphY0k4bDJreDhvaVAzcHRtdkVxMUp4SFhBR1V2dStBWEY5ZGhLXC9jQUZXekQ1SmZibnBJQ0U3a0JBR1RZbGFaZz09IiwibWFjIjoiNjk1ZjIyNzIzYjIwYzZjNzJhZTk0Nzc1NTgyMmU2YTk4MWM3NWYxYjRlMWVlMTc0NjczMGRkOWY1NjM1ZmRhYSJ9; _ga_HP4Q1W4KPP=GS1.1.1665083169.1.0.1665083169.60.0.0; _ga=GA1.1.1233812568.1665083169
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Oct 2022 19:06:10 GMT
Content-Type: image/x-icon
Content-Length: 1150
Connection: close
Last-Modified: Thu, 31 Jan 2019 14:32:56 GMT
ETag: "5c530718-47e"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Frame-Options: ALLOW-FROM xxxfucktor.com

stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-141641820-1&cid=1233812568.1665083169&jid=1924998019&gjid=243633881&_gid=552493372.1665083170&_u=YADAAEAAAAAAACAAI~&z=1433639597

173.194.73.154

200 OK

4 B

URL HTTP/2
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-141641820-1&cid=1233812568.1665083169&jid=1924998019&gjid=243633881&_gid=552493372.1665083170&_u=YADAAEAAAAAAACAAI~&z=1433639597
IP
173.194.73.154:0
ASN
#15169 GOOGLE

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
48c0473b7821185d937e685216e2168b
3743e47f8a429a5e87b86cb582d78940733d9d2e
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a

HTTP Headers

POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-141641820-1&cid=1233812568.1665083169&jid=1924998019&gjid=243633881&_gid=552493372.1665083170&_u=YADAAEAAAAAAACAAI~&z=1433639597 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://lander.xxxfucktor.com
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: https://lander.xxxfucktor.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 06 Oct 2022 19:06:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
eac86f868b3967f1946c7f5fc712b25f
e2ae8eb09715a0af0791c085eb35bf66e0548e30
bceb14e7a478c0e34a0f1d8286eb954566c62051e996bc36189de922a76a6e06

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
40a4de06678d96242b71d5318f2fd4ef
546a7d1d92df81916f14155943427b5453ae3924
aed9af25ae57c181702a137d48cb00f5b30297180161451de3b628359dc9ec6f

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-141641820-1&cid=1233812568.1665083169&jid=1924998019&_u=YADAAEAAAAAAACAAI~&z=1811216511

142.250.74.164

200 OK

42 B

URL HTTP/2
www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-141641820-1&cid=1233812568.1665083169&jid=1924998019&_u=YADAAEAAAAAAACAAI~&z=1811216511
IP
142.250.74.164:0
ASN
#15169 GOOGLE

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

HTTP Headers

GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-141641820-1&cid=1233812568.1665083169&jid=1924998019&_u=YADAAEAAAAAAACAAI~&z=1811216511 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 19:06:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f9371f81e2eeeead7fe351a49f3b1c40
ae23d6c6c57dd7cf568c3a74594c377b7bb7df43
03c4ba0faa3199d061d1bb37df5d48ba6d81f77a83e243922075efc4d4acf456

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 19:06:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3352
Expires: Thu, 06 Oct 2022 20:02:02 GMT
Date: Thu, 06 Oct 2022 19:06:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3352
Expires: Thu, 06 Oct 2022 20:02:02 GMT
Date: Thu, 06 Oct 2022 19:06:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3352
Expires: Thu, 06 Oct 2022 20:02:02 GMT
Date: Thu, 06 Oct 2022 19:06:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3352
Expires: Thu, 06 Oct 2022 20:02:02 GMT
Date: Thu, 06 Oct 2022 19:06:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3352
Expires: Thu, 06 Oct 2022 20:02:02 GMT
Date: Thu, 06 Oct 2022 19:06:10 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2ecef3b6-b278-4a22-86dd-6a19875e1cc1.jpeg

34.120.237.76

200 OK

7.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2ecef3b6-b278-4a22-86dd-6a19875e1cc1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.5 kB (7511 bytes)
Hash
9e520f87cae411cfc2ed1c8a14184385
69ad212cb7ae309d4f02019552887135bfae67da
723b10bfbcde201b5811e3bd0560f02f90775e4d18b28d19e6c814899f2da71a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2ecef3b6-b278-4a22-86dd-6a19875e1cc1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7511
x-amzn-requestid: 995b51dd-5484-4b4c-ad40-550f7fd85930
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZjO6uG70IAMFjBw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633df844-70f17f6f24dce0003d03902a;Sampled=0
x-amzn-remapped-date: Wed, 05 Oct 2022 21:33:56 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: BddSUzh-PKiFmfw2p9gPW-B0qtrXWxCXfee29Pk-wLqN7RO21Yic6g==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 f7283f3fe2c258cf54f8b7d3dd272e0e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 05 Oct 2022 21:37:06 GMT
age: 77344
etag: "69ad212cb7ae309d4f02019552887135bfae67da"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd38ec9d6-fb69-4c6e-aae2-136fd254ae50.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.3 kB (7270 bytes)
Hash
e238ccaa3b9fa88476a8514855e8232f
447cbf348ef10d0136a1811e843c46937defbba1
43dce3c1eb388dfaddca4176acb6eb32f76fc4c03fca18e7a315c9ddb43d2b02

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd38ec9d6-fb69-4c6e-aae2-136fd254ae50.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7270
x-amzn-requestid: e5d0bb7a-b9d5-49b1-b51c-8db019da641f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZjQOGEQloAMFjgw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633dfa5a-519d91fb0b83920960da479d;Sampled=0
x-amzn-remapped-date: Wed, 05 Oct 2022 21:42:50 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: l1HGT5ycH36vVojsOPFptRSU1YJFvLbBsgiWJqzRlRIGgm2o5vf6jg==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 34c44cb7892e57a3b6c51812bcf68ee4.cloudfront.net (CloudFront), 1.1 google
date: Wed, 05 Oct 2022 21:58:56 GMT
etag: "447cbf348ef10d0136a1811e843c46937defbba1"
content-type: image/jpeg
age: 76034
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ca20164-9b52-49c5-9e63-1fc0ae719f45.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10158 bytes)
Hash
4fc2ddd86450d64d3fb659ab4e78be58
bbe71936b78a8c34d03ab87948dc840b35c6948f
84a760397a5912bd05f61bc8a953c13a88a677e2d17fbbf74bdf7d7ff4d3942f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ca20164-9b52-49c5-9e63-1fc0ae719f45.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10158
x-amzn-requestid: def1fc7e-8008-466f-9271-20fa1ab0fa5a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZaqZCH7doAMFcPQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633a8aa0-7fd2fb1249366f2277d719d6;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 07:09:20 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: aeOU8fGkf5uHuYZ79k17EzxiFnwm0_z7SeZJElgwECzRyhR2N_SYJA==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 b8c4a4ca04bb1976e020396d211bc8dc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 03:50:38 GMT
age: 54932
etag: "bbe71936b78a8c34d03ab87948dc840b35c6948f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fac259b-7a22-4aa2-ba3f-682cb749091c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11080 bytes)
Hash
2277f8f2d93b4bc3b05d348343177892
531d9e4ec9078cd2d7376a19fcb287084af36c82
62907648de4a2ed390232a71ab7dce49f1e9c3363cde6a2f30ecae10ab67f93a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fac259b-7a22-4aa2-ba3f-682cb749091c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11080
x-amzn-requestid: 8fa4d19d-87a5-46c5-96c5-4aec793daad9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZjO7xE5eoAMFQLw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633df84b-5c422c7a168c014f57559037;Sampled=0
x-amzn-remapped-date: Wed, 05 Oct 2022 21:34:03 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: LySueW1si-yWLwecUILV1s57IEV2FdcQ9_pH1Aoe4AYISi7QXXfd3A==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 34c44cb7892e57a3b6c51812bcf68ee4.cloudfront.net (CloudFront), 1.1 google
date: Wed, 05 Oct 2022 21:39:28 GMT
age: 77202
etag: "531d9e4ec9078cd2d7376a19fcb287084af36c82"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ce3d070-3bf1-47cd-bdd7-2bda7b826976.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.1 kB (4140 bytes)
Hash
dbba56f647bf5989ca51863632bbebfc
26694f34166345ee5693653e0101db6b910e68ba
ec5cc38f2a77e8e655aeeb7a376cf882ccb7163e4ef9d1ce4633ab4754e48765

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ce3d070-3bf1-47cd-bdd7-2bda7b826976.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4140
x-amzn-requestid: f3cb33c4-26b6-4fd8-9293-dfb42be34600
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZjOZiEZ4IAMFvLg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633df770-424459547db8b3d721d75e54;Sampled=0
x-amzn-remapped-date: Wed, 05 Oct 2022 21:30:24 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: q70sezhl0h-lASzUDh5_WQ6KraRa3fWYl_tO0iuE0CpbJ5GeiihgMw==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 95785220a566cd050f3ad80928463374.cloudfront.net (CloudFront), 1.1 google
date: Wed, 05 Oct 2022 21:37:06 GMT
etag: "26694f34166345ee5693653e0101db6b910e68ba"
content-type: image/jpeg
age: 77344
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

static.hotjar.com/c/hotjar-2057278.js?sv=7

54.230.111.113

200 OK

11 kB

URL HTTP/2
static.hotjar.com/c/hotjar-2057278.js?sv=7
IP
54.230.111.113:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (3790)
Size
11 kB (11445 bytes)
Hash
90edc287f65f6b80b772487bdc4578e6
0a16fa88f8ed764465b2c25bafa30e475326901d
1a400682c4837b1540d6399fdc24f8b28aa799b463b08c9ec63dd089291fd750

HTTP Headers

GET /c/hotjar-2057278.js?sv=7 HTTP/1.1
Host: static.hotjar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lander.xxxfucktor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
date: Thu, 06 Oct 2022 19:06:10 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
etag: W/ee7f9c0e6b15f6bb966285e3b4acac2a
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 09ae414c9d6c5323d5147457ada70ec6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: t25mPBsCKiwY92Y1UhJ3Ip2nGC7CwcgUcco_GKMf0JKED2niWXcq-A==
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP