flowhot.cc/wp-content/uploads/2019/11/promo.jpeg
200 OK 161 kB URL GET HTTP/3 flowhot.cc/wp-content/uploads/2019/11/promo.jpeg
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Macintosh), datetime=2019:11:21 20:13:11], progressive, precision 8, 900x250, components 3\012- data
Size 161 kB (160863 bytes)
Hash f66cbb86803abd9d9f37a1588f14d5fd
c38f678cea2edc798d223b0c57f3b6c6b4acb008
ee089d909a7461ab0f483151883331e191c18f0a1db138a4bba12d82330287a1
GET /wp-content/uploads/2019/11/promo.jpeg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: image/jpeg
content-length: 160863
cache-control: public, max-age=31536000
expires: Sat, 30 Dec 2023 05:45:23 GMT
last-modified: Fri, 22 Nov 2019 02:34:58 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 730187
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hNQ%2Fn4WhmhuA11XcJ%2FssZH5b4OBTkErnZTyGSpsnxpvRX9l53qHw9z0eTTdlNpOgJb5%2FGXTvQ72zhwSXqElrqTzbvsPSOr7lMaMAAma8v8ez%2F08pEHK9e1spe6J8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b879da556a9-OSL
alt-svc: h3=":443"; ma=86400
code.jquery.com/jquery-3.4.1.js
200 OK 83 kB URL GET HTTP/2 code.jquery.com/jquery-3.4.1.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
Hash 11c05eb286ed576526bf4543760785b9
7faa15a054093f3b5d674e63b6567c835a6fa217
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
GET /jquery-3.4.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4472c"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 08 Dec 2023 16:35:10 GMT
age: 7251110
x-served-by: cache-lga21923-LGA, cache-bma1664-BMA
x-cache: HIT, HIT
x-cache-hits: 18, 26456
x-timer: S1702053311.739894,VS0,VE0
vary: Accept-Encoding
content-length: 82889
X-Firefox-Spdy: h2
flowhot.cc/wp-content/uploads/2022/12/Karol%20G%20%E2%80%93%20La%20Vida%20Es%20Una%20(From%20Puss%20in%20Boots%20The%20Last%20Wish)-300x300.jpg
200 OK 26 kB URL GET HTTP/3 flowhot.cc/wp-content/uploads/2022/12/Karol%20G%20%E2%80%93%20La%20Vida%20Es%20Una%20(From%20Puss%20in%20Boots%20The%20Last%20Wish)-300x300.jpg
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 300x300, components 3\012- data
Hash 057e20cee06139512df03fe4aaa644ec
5c6d6f7c2868f33c96dcc4592bb3b1e087ac1868
55529a4e8a46471993b282687aec11ccc30589e23fe7a9515ed5319fd0f49198
GET /wp-content/uploads/2022/12/Karol%20G%20%E2%80%93%20La%20Vida%20Es%20Una%20(From%20Puss%20in%20Boots%20The%20Last%20Wish)-300x300.jpg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: image/jpeg
content-length: 25707
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 16:35:09 GMT
last-modified: Fri, 09 Dec 2022 02:18:25 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7i5HQdpdGAsbFLe7kauYkrvzSgipC%2FKVWZPkVEF28jrJvITe%2FXmBM5rU7lzkpHgH0KHVfA2g8b6Jvssr1NvLAc%2F0%2BL31inN1ybiKAvfuKQTTgmF4tqvJDvvp%2BnlP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b879da656a9-OSL
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=UA-922266-5
200 OK 69 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=UA-922266-5
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Hash 86a5824e2c19e177a8e3682c14e66c1b
d7f8bc42588d47294335867ef441a97c83be3af8
55ab3fdea383a14bd5764a6680c2a7c1a5cf528cee25757f56147bbd43fddeb4
GET /gtag/js?id=UA-922266-5 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 08 Dec 2023 16:35:10 GMT
expires: Fri, 08 Dec 2023 16:35:10 GMT
cache-control: private, max-age=900
last-modified: Fri, 08 Dec 2023 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 68943
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c
200 OK 81 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash 2fa0591c6395dabaa938f3a432f6fa66
9751cefcb96b308afba649d3558df88978880df4
98df27f58585b84df26b2e6ad799a860a3ec41e16d187384f423b7d13b1ca097
GET /gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 08 Dec 2023 16:35:11 GMT
expires: Fri, 08 Dec 2023 16:35:11 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 81203
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js
200 OK 15 kB URL GET HTTP/1.1 finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectfinallytrained.com
Fingerprint8F:A1:2B:2D:3A:32:A7:71:00:73:CC:06:43:01:E1:62:6F:57:F2:4F
ValiditySat, 04 Nov 2023 06:34:02 GMT - Fri, 02 Feb 2024 06:34:01 GMT
File type ASCII text, with very long lines (42321), with no line terminators
Hash ca95dcfb9f7e3b4d3169c94cc8418ed0
786fdd11b4e4e2cc09ac76813253764a2f0b3608
fadd43b9568b05e9624e05d4b2816ba504c4e187d726c11963ae5fd6d18dea6c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /06/33/56/0633569b5e7b7ced877cf02d43663712.js HTTP/1.1
Host: finallytrained.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 08 Dec 2023 16:35:11 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2ad89020779e7f6b0ddc792a005c6670
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 68a70c671b663e5a3cfda95ba4a0b692
d3e39f6d6fedb7a73eecfd726c5d4ec2117043f2
9b9fef9807ad7ed8d24220574864637cd77b085b45bbc5b8e1e6faf41213aaa5
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 08 Dec 2023 16:35:11 GMT
Last-Modified: Fri, 08 Dec 2023 16:05:09 GMT
Server: ECAcc (ska/F73A)
X-Cache: Miss from cloudfront
Via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: mT1_9YWqbm3aLfYkuPIgYfl7Giz2pP7WHEgpBPtjmcJKWzMSjxTMmQ==
Age: 1803
proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 7a39a27bd7c87229032e8f4f1f610b77
147eff7d64bf4949fc94467918bf1ea71b177f89
d2de7c498cc8ae0d2d79e2f97af19c9cc3b58cc2e8784d2244fc0c0ca781bd15
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://635382.flowhot.cc
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=c8904b37-49f4-4bf5-b037-452908cbcbf9:1:1; expires=Mon, 05 Dec 2033 16:35:11 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
200 OK 77 kB URL GET HTTP/3 maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Hash af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
GET /font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://maxcdn.bootstrapcdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: font/woff2
content-length: 77160
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "af7ae505a9eed503f8b8e6982036873e"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 19:08:24
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 752
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 7f959dca0c1d99563811e2361cc8130b
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 83266b8f7ac6712e-OSL
alt-svc: h3=":443"; ma=86400
635382.flowhot.cc/dectector.js
404 Not Found 19 kB URL GET HTTP/3 635382.flowhot.cc/dectector.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash e00762520e4ab4b33624eaa8ad271f53
7a41deabed370ebe3a80f9bca5f7394693495b8a
c36d24216ab2a409590f390838c3950da222f30e6ce7399f009a66446de4e3f2
GET /dectector.js HTTP/1.1
Host: 635382.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1702053318.1.0.1702053318.0.0.0; _ga=GA1.1.1797832012.1702053318
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ohtSLSexbMmqHWeiNFygVpbpv98wB4z1vSQvSg%2FJh2ZAvvTPZMPaUr1Aef5G%2FG2fV6QVzEHMZuaIZGUVM9ndyqMcuq7O2%2B4LMB5OQiZy5PbLK%2BgHjCl7PAR%2BFDliWa2fleBgng%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b8ecd5156a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
flowhot.cc/wp-content/themes/flowhot/style.css?ver=1702052969
200 OK 7.8 kB URL GET HTTP/3 flowhot.cc/wp-content/themes/flowhot/style.css?ver=1702052969
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with very long lines (4468)
Hash 4c1717ce0a000bdbf8af2b620be2b465
9398d9ac4a1f37374cc187f5a1e3d6dc69f2a208
25f469c98011ebbf04fe876c4a5732b88c74bf48dfc6b03f8fa7d68b34657404
GET /wp-content/themes/flowhot/style.css?ver=1702052969 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 16:35:09 GMT
last-modified: Fri, 19 Jun 2020 18:37:30 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EMtpulNdYDNUAFXV53r8quw8soZZ7kNcL2BnFL5O%2ByTkToKycuPCibNgEbx7fV9QzaJWuQIPTea1yLg4F3lVVxYB6rb06U%2Fsar2DKGTGda9JFBaaKm5YOSWMhxvU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 83266b879da356a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
skiofficerdemote.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js
200 OK 25 kB URL GET HTTP/1.1 skiofficerdemote.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectskiofficerdemote.com
FingerprintB4:6F:3A:BD:FF:FE:15:51:53:8C:D2:EB:9B:13:BE:14:D1:BC:BD:EE
ValidityTue, 28 Nov 2023 11:02:22 GMT - Mon, 26 Feb 2024 11:02:21 GMT
File type ASCII text, with very long lines (62374)
Hash 1aaadca287a35c078fdd8bb626759bc7
df99274eb67e4d840597411897dc61f3332bab78
ce4995f7f2a48eb780fc735bafded7825a67974927ddf6d14021661b96b0d4af
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js HTTP/1.1
Host: skiofficerdemote.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:12 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: 4b4e7ab587d59b22ad7bcd2439afc363_CF-2805_1=0; expires=Tue, 12 Dec 2023 00:35:12 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 220f09f82d8b296b4916b0084477b67a
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
skiofficerdemote.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9%3A1%3A1
200 OK 4.5 kB URL GET HTTP/1.1 skiofficerdemote.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9%3A1%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectskiofficerdemote.com
FingerprintB4:6F:3A:BD:FF:FE:15:51:53:8C:D2:EB:9B:13:BE:14:D1:BC:BD:EE
ValidityTue, 28 Nov 2023 11:02:22 GMT - Mon, 26 Feb 2024 11:02:21 GMT
File type JSON data\012- , ASCII text, with very long lines (6232), with no line terminators
Hash 3642d52900790f128c1ed85a86d72e55
d505433b9c9f0d01002140785b9c3937c756f8b6
40578e281a3a0e421ab33a70f226c094fab417f0a7f352809b908f9314c9655e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9%3A1%3A1 HTTP/1.1
Host: skiofficerdemote.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:12 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://635382.flowhot.cc
Access-Control-Allow-Origin: https://635382.flowhot.cc
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=19408177; expires=Sat, 09 Dec 2023 16:35:12 GMT; secure; SameSite=None
uid_id2=c8904b37-49f4-4bf5-b037-452908cbcbf9:1:1; expires=Fri, 15 Dec 2023 16:35:12 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 09 Dec 2023 16:35:12 GMT; secure; SameSite=None
uncs=1; expires=Sat, 09 Dec 2023 16:35:12 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sat, 09 Dec 2023 16:35:12 GMT; secure; SameSite=None
uncs29=1; expires=Sat, 09 Dec 2023 16:35:12 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: dbce4a70cbb586b7bc926e97e1246878
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
skiofficerdemote.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuTtaTIPjjIirMQTGCme2e7t6ZNodoTCKLazYkkZzrV8%2BWW93VVHVPT%2Ba0GJDcHG8ee7%2FZZNFEMVdBCLNeZEHIeJA9uBf%2FgwgBwYPMZGD1QdV7r75X8H3vvS92q2MSoKJHVz8xI6U1XY3bfuvMTZULU7vWlRutwG%2F751o3Vb4WnWsN55cdvBf4cdt%2Fp%2FWR5NtmteMHvh%2F4QeuysjI1w9UFClU8SIJ24rejTjuIIwzt%2F3NXeXDUgxgck5egxOy5rV8eQvEp8uyHi9Jtl6Z491JWaVoai4HY%2FzTfzk2dIzsJU%2BshzfeX1TBuRsjXp2Dy%2FaUCmMHeXAGYmhHv9wAs31%2FSBBvcfcaUacgcTDyPejCF1FMoOgU3t6HEYwJwgSubyLN7V4yt6a1nKJ2jM7Ly9C%2BoekZW%2FngFefb9Ba2GretGV6UyucMwbaCGU6j%2BFEV1gHLkQdUH4OXnUOJXsvp0A3m2t%2Bm0gRJHb%2FJe4kcs7J6NkjQ6G7E0Psv8eRp3Er%2FHGWdpsmiRUlOodAotx6DOQzU%2FykOVeqgKD5k4atE4SX2%2Fm7I0DHsR5zwMOY97ayIWYdRLfVR8rmGMshiD6zG43UFhd7CtxrDVI7itBk54cCXBQDSoJUHtCGpKUCuCuiSoB81doV3HNfeEdhULlr6z9GEzMWV%2Fl941ZV%2FmBNSOd4tj8uK8ed6ZtwJsy6OWvxaG8VrCYtllXS5Fr9vlqd8RUbi2FnaDDpxqoNyphdSRmpG3X19BoR6%2FnIPRAzh9AK480OoN0HrS7figW5Oo52OU36ejQmrl2txkEKZBUa6gvOXt6mPy6mKC65vfQfLD83%2BGCwO3DQrb4DP1M0Ff35lcMzXZu2ZqRx5uFqXK1IjOp3u9pKU8%2Fe3H8lZtrFi%2F6MbffMDnwDx8cEO6coPmQuV9R%2B5fUEJIe9lYLslP6%2B6mZFcrt3WhsnlVbFz98PJ6VljpnDL5FHS%2BqU8suJqRF167sdjcMz9uQNkpbNUgqw7J0qDMFLzYgStO%2BDtDYPVJDSs81FUzsR128qjVjFz85wm0PDy%2F%2F%2F7O319OalDWwMn%2FfDyJd90d9K0HWt5GnjUY2AYD3YDqMVx1elIW9vD8b0sCTHsTpq23x7TVXz1rsFNHLRmnfir9jmRpwtIu9UWSRgmjSSC7LKYBSjeT7tKjfwEAAP%2F%2FAQAA%2F%2F9oC83ElQQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 skiofficerdemote.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuTtaTIPjjIirMQTGCme2e7t6ZNodoTCKLazYkkZzrV8%2BWW93VVHVPT%2Ba0GJDcHG8ee7%2FZZNFEMVdBCLNeZEHIeJA9uBf%2FgwgBwYPMZGD1QdV7r75X8H3vvS92q2MSoKJHVz8xI6U1XY3bfuvMTZULU7vWlRutwG%2F751o3Vb4WnWsN55cdvBf4cdt%2Fp%2FWR5NtmteMHvh%2F4QeuysjI1w9UFClU8SIJ24rejTjuIIwzt%2F3NXeXDUgxgck5egxOy5rV8eQvEp8uyHi9Jtl6Z491JWaVoai4HY%2FzTfzk2dIzsJU%2BshzfeX1TBuRsjXp2Dy%2FaUCmMHeXAGYmhHv9wAs31%2FSBBvcfcaUacgcTDyPejCF1FMoOgU3t6HEYwJwgSubyLN7V4yt6a1nKJ2jM7Ly9C%2BoekZW%2FngFefb9Ba2GretGV6UyucMwbaCGU6j%2BFEV1gHLkQdUH4OXnUOJXsvp0A3m2t%2Bm0gRJHb%2FJe4kcs7J6NkjQ6G7E0Psv8eRp3Er%2FHGWdpsmiRUlOodAotx6DOQzU%2FykOVeqgKD5k4atE4SX2%2Fm7I0DHsR5zwMOY97ayIWYdRLfVR8rmGMshiD6zG43UFhd7CtxrDVI7itBk54cCXBQDSoJUHtCGpKUCuCuiSoB81doV3HNfeEdhULlr6z9GEzMWV%2Fl941ZV%2FmBNSOd4tj8uK8ed6ZtwJsy6OWvxaG8VrCYtllXS5Fr9vlqd8RUbi2FnaDDpxqoNyphdSRmpG3X19BoR6%2FnIPRAzh9AK480OoN0HrS7figW5Oo52OU36ejQmrl2txkEKZBUa6gvOXt6mPy6mKC65vfQfLD83%2BGCwO3DQrb4DP1M0Ff35lcMzXZu2ZqRx5uFqXK1IjOp3u9pKU8%2Fe3H8lZtrFi%2F6MbffMDnwDx8cEO6coPmQuV9R%2B5fUEJIe9lYLslP6%2B6mZFcrt3WhsnlVbFz98PJ6VljpnDL5FHS%2BqU8suJqRF167sdjcMz9uQNkpbNUgqw7J0qDMFLzYgStO%2BDtDYPVJDSs81FUzsR128qjVjFz85wm0PDy%2F%2F%2F7O319OalDWwMn%2FfDyJd90d9K0HWt5GnjUY2AYD3YDqMVx1elIW9vD8b0sCTHsTpq23x7TVXz1rsFNHLRmnfir9jmRpwtIu9UWSRgmjSSC7LKYBSjeT7tKjfwEAAP%2F%2FAQAA%2F%2F9oC83ElQQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectskiofficerdemote.com
FingerprintB4:6F:3A:BD:FF:FE:15:51:53:8C:D2:EB:9B:13:BE:14:D1:BC:BD:EE
ValidityTue, 28 Nov 2023 11:02:22 GMT - Mon, 26 Feb 2024 11:02:21 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuTtaTIPjjIirMQTGCme2e7t6ZNodoTCKLazYkkZzrV8%2BWW93VVHVPT%2Ba0GJDcHG8ee7%2FZZNFEMVdBCLNeZEHIeJA9uBf%2FgwgBwYPMZGD1QdV7r75X8H3vvS92q2MSoKJHVz8xI6U1XY3bfuvMTZULU7vWlRutwG%2F751o3Vb4WnWsN55cdvBf4cdt%2Fp%2FWR5NtmteMHvh%2F4QeuysjI1w9UFClU8SIJ24rejTjuIIwzt%2F3NXeXDUgxgck5egxOy5rV8eQvEp8uyHi9Jtl6Z491JWaVoai4HY%2FzTfzk2dIzsJU%2BshzfeX1TBuRsjXp2Dy%2FaUCmMHeXAGYmhHv9wAs31%2FSBBvcfcaUacgcTDyPejCF1FMoOgU3t6HEYwJwgSubyLN7V4yt6a1nKJ2jM7Ly9C%2BoekZW%2FngFefb9Ba2GretGV6UyucMwbaCGU6j%2BFEV1gHLkQdUH4OXnUOJXsvp0A3m2t%2Bm0gRJHb%2FJe4kcs7J6NkjQ6G7E0Psv8eRp3Er%2FHGWdpsmiRUlOodAotx6DOQzU%2FykOVeqgKD5k4atE4SX2%2Fm7I0DHsR5zwMOY97ayIWYdRLfVR8rmGMshiD6zG43UFhd7CtxrDVI7itBk54cCXBQDSoJUHtCGpKUCuCuiSoB81doV3HNfeEdhULlr6z9GEzMWV%2Fl941ZV%2FmBNSOd4tj8uK8ed6ZtwJsy6OWvxaG8VrCYtllXS5Fr9vlqd8RUbi2FnaDDpxqoNyphdSRmpG3X19BoR6%2FnIPRAzh9AK480OoN0HrS7figW5Oo52OU36ejQmrl2txkEKZBUa6gvOXt6mPy6mKC65vfQfLD83%2BGCwO3DQrb4DP1M0Ff35lcMzXZu2ZqRx5uFqXK1IjOp3u9pKU8%2Fe3H8lZtrFi%2F6MbffMDnwDx8cEO6coPmQuV9R%2B5fUEJIe9lYLslP6%2B6mZFcrt3WhsnlVbFz98PJ6VljpnDL5FHS%2BqU8suJqRF167sdjcMz9uQNkpbNUgqw7J0qDMFLzYgStO%2BDtDYPVJDSs81FUzsR128qjVjFz85wm0PDy%2F%2F%2F7O319OalDWwMn%2FfDyJd90d9K0HWt5GnjUY2AYD3YDqMVx1elIW9vD8b0sCTHsTpq23x7TVXz1rsFNHLRmnfir9jmRpwtIu9UWSRgmjSSC7LKYBSjeT7tKjfwEAAP%2F%2FAQAA%2F%2F9oC83ElQQAAA%3D%3D HTTP/1.1
Host: skiofficerdemote.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=c8904b37-49f4-4bf5-b037-452908cbcbf9:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:12 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d4d1ad129fc1a8c7c8c144eca849910b
Strict-Transport-Security: max-age=0; includeSubdomains
flowhot.cc/wp-content/themes/flowhot/views.php?id=635382
200 OK 9 B URL GET HTTP/3 flowhot.cc/wp-content/themes/flowhot/views.php?id=635382
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with no line terminators
Hash 941b0ab270a8a4dd0ad637f213c6b08c
2cfc8490621868cbbbc1515184f17ad8d5adbce3
3df5355d9f394d373941affb061c8a176caf8a813b4f1a31253ffbbfd8f48c3e
GET /wp-content/themes/flowhot/views.php?id=635382 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:12 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2BupzDKLrJaOtByiYGu4kX2bjz30Hqvb2NGeqTiw6yqx2N6ii6s1jua5KFtvwDgPkYwm1dKx1WLNCeMq5db6uh8kpJBRBqGKMS4vNt3RwZ7K97cqlQ8OY3Kx0Jn%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 83266b908f6256a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/img/close.png
200 OK 6.0 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/img/close.png
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 522 x 391, 8-bit/color RGBA, non-interlaced\012- data
Hash c489ce2c491a22ee37a55e26a92dfd73
2fa588ab09e94dd902e5bd24b48f98ad1949c9d6
1eed147c7d5de6291c25fbc5274830c12d5549262fb144271576d4e15966e5bd
GET /sb/ssp/sweep/social-box/white-small/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: image/png
content-length: 5982
last-modified: Tue, 21 Sep 2021 12:02:03 GMT
etag: "6149c9bb-175e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2200317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2OgWkN330QVMfTDeZk2MEnByuaTlA5T66XVLZ9jgul%2BcCJalm%2FMMKjXITDMwIzaQuPP6Kpq2YPb4O0GDGoa57kiGn5%2BCDCzMuyUuan6dRUj1SYkI0ZB%2FiBsHuExuPM1l5V%2FPBLrQrpPV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b981ddc632b-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
200 OK 1.2 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type gzip compressed data, max compression\012- data
Hash e15ef12c712bd8b9824a5d0d54d46aa6
227042d358fcfb4c268895af6e6a5eadfc4a73e3
93555b394b42931b1cbdab3e022ea62e5bedddeb249ad4ee09d450fcf4fed808
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 08 Dec 2023 16:35:13 GMT
date: Fri, 08 Dec 2023 16:35:13 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/ff/44/ed/ff44ed1dd0386a555362c65cd289d432/1701649966.png
200 OK 14 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/ff/44/ed/ff44ed1dd0386a555362c65cd289d432/1701649966.png
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash b39effc8e82a1a83041a3282200f2d32
4dd606913c72d9728485151e85d6f4a431f6215b
e5375e1f3bac974f8fed58b80f75290dd66b7d71873f9c489aefab684f725fdf
GET /si/ff/44/ed/ff44ed1dd0386a555362c65cd289d432/1701649966.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: image/png
content-length: 13731
server: nginx/1.21.6
last-modified: Mon, 04 Dec 2023 00:32:55 GMT
etag: "656d1e37-35a3"
expires: Sun, 10 Dec 2023 16:35:13 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 04:57:34 GMT
expires: Fri, 06 Dec 2024 04:57:34 GMT
cache-control: public, max-age=31536000
age: 128260
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
skiofficerdemote.com/pixel/sbs?c=1
200 OK 0 B URL GET HTTP/1.1 skiofficerdemote.com/pixel/sbs?c=1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectskiofficerdemote.com
FingerprintB4:6F:3A:BD:FF:FE:15:51:53:8C:D2:EB:9B:13:BE:14:D1:BC:BD:EE
ValidityTue, 28 Nov 2023 11:02:22 GMT - Mon, 26 Feb 2024 11:02:21 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: skiofficerdemote.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=c8904b37-49f4-4bf5-b037-452908cbcbf9:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:14 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/js/jquery.min.js
200 OK 46 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/js/jquery.min.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (32025)
Hash 4a356126b9573eb7bd1e9a7494737410
8258d046f17dd3c15a5d3984e1868b7b5d1db329
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
GET /sb/ssp/sweep/social-box/white-small/js/jquery.min.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: application/javascript
last-modified: Tue, 21 Sep 2021 12:02:04 GMT
etag: W/"6149c9bc-1499c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2531686
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hmCytjdrMM0H4O7L29vcTL3FBwOMz0mC1%2F6Nmst6U4S%2B65bO%2BXr1xpo24MFDFp7Q54q738NWf8AuO3ZsG21fkOCU3%2Bu%2FEkZ6KpjPxgehiKWpCz%2F%2B9yDT%2BOlWPyQaqRWo0fOFVhCDuccS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b97aa297192-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
skiofficerdemote.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuTtaTIPjjIirMQTGCme2e7vllDtGYRBbX7JKs7Ll%2B9Wy51V1NVff07JwWA5Kb481j7ze7WTRRzFUQwqwXWRAyHmQP7sX%2FIEJA8CAzO7D6oOq9V98r%2BL733hd7xSkJUNCT9U%2FMUGlNl5t1v3ZpU6XClK52a6MW%2BHX%2FSm1Tpa3oSm0wu2z%2FvcBv1v13ah9Jvm2WG37g%2B4Ef1G4qK2MzWJ6jUNnDblDv%2BvWoUQ%2BaEQb2%2F7krPDjqQfRPyUtQYvrc1i%2BPoPgEafLDdem2c5O9eyMpNM2NRV8cfppup6ZMkZyHsfUQp4eLahg3JeTrCzDp4UIBTH9%2FpgBMTYn3ewCWHi5ogvUPzpgyDZmCiedR9ieQegJFJ%2BDmLpR4QgAucGsNaXL%2FlrEl3TlD6QydkqVnf0GVU7L0xytIk%2B%2BvaTWo3TG6yJVJHQZxBTWYQPUmyIoj5EMPqjwCzz%2BHEr%2BS5WerSJP9NacNlDh5k3e6fsTC9uWoG0eXIxY3LzN%2FljYbXb%2FDGWdxd94ipSZQ8QRajkCdh2J2lIci9lBkHhJxUqPNbuz77ZjFYdiJOOdhyHmz0xJNEUad2EfBZxpGyLMRuB6B211kdhfbagRbPIbbquCEB5cT9EWFUhKUjqCkBKUiKHOCsl8dCO0arrovtCtYsPCNhQ%2Brscl7e%2FTA5D2ZElA72stOyYuz5nmX3gqwLU9qfisMm60ua8o2a3MpOu02j%2F2GiMJWK2wHDThVQbkLc6lDNSVvv76ETD15OQWjR3D6CFx5oMUboOW43fBBt8ZRx8cwfUCHmdTK1blJIEyFLF9CvuPt6VPy6nyCK2vfQfLjq3%2BGcwO3FTJb4TP1M0FP3xvfNiXZv21KRx6tZblK1JDOpnsnp7m8%2BO3Hcqc0Vqxcd6NvPuAzYBY%2B3JAuX6WpUGnPkQfXlBDS3jSWS%2FLTituUbL1wW9cKmxbZ6vqHN1eSzErnlEknoLNNfWrB1ZS88NrGfHMv%2FbgKZSewRYWkOCYLgzIT8GwXLjvn7wyB1ec1LPNQFtXYNtj5o1ZTcv2fp9Dy%2BOrh%2B7t%2FfzkuQVkFJ%2F%2Fz8Tzec%2FfQsx5ofhdpUqFvK%2FR1BapHcMXFcZ7Z46u%2FLQgw7Y2Ztt4%2B01Z%2FddZgp05qzSCSHdZpcyGY5CJoN8JO6PsNIaJ2VwZd5G4q3Y3H%2FwIAAP%2F%2FAQAA%2F%2F98A0MilQQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 skiofficerdemote.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuTtaTIPjjIirMQTGCme2e7vllDtGYRBbX7JKs7Ll%2B9Wy51V1NVff07JwWA5Kb481j7ze7WTRRzFUQwqwXWRAyHmQP7sX%2FIEJA8CAzO7D6oOq9V98r%2BL733hd7xSkJUNCT9U%2FMUGlNl5t1v3ZpU6XClK52a6MW%2BHX%2FSm1Tpa3oSm0wu2z%2FvcBv1v13ah9Jvm2WG37g%2B4Ef1G4qK2MzWJ6jUNnDblDv%2BvWoUQ%2BaEQb2%2F7krPDjqQfRPyUtQYvrc1i%2BPoPgEafLDdem2c5O9eyMpNM2NRV8cfppup6ZMkZyHsfUQp4eLahg3JeTrCzDp4UIBTH9%2FpgBMTYn3ewCWHi5ogvUPzpgyDZmCiedR9ieQegJFJ%2BDmLpR4QgAucGsNaXL%2FlrEl3TlD6QydkqVnf0GVU7L0xytIk%2B%2BvaTWo3TG6yJVJHQZxBTWYQPUmyIoj5EMPqjwCzz%2BHEr%2BS5WerSJP9NacNlDh5k3e6fsTC9uWoG0eXIxY3LzN%2FljYbXb%2FDGWdxd94ipSZQ8QRajkCdh2J2lIci9lBkHhJxUqPNbuz77ZjFYdiJOOdhyHmz0xJNEUad2EfBZxpGyLMRuB6B211kdhfbagRbPIbbquCEB5cT9EWFUhKUjqCkBKUiKHOCsl8dCO0arrovtCtYsPCNhQ%2Brscl7e%2FTA5D2ZElA72stOyYuz5nmX3gqwLU9qfisMm60ua8o2a3MpOu02j%2F2GiMJWK2wHDThVQbkLc6lDNSVvv76ETD15OQWjR3D6CFx5oMUboOW43fBBt8ZRx8cwfUCHmdTK1blJIEyFLF9CvuPt6VPy6nyCK2vfQfLjq3%2BGcwO3FTJb4TP1M0FP3xvfNiXZv21KRx6tZblK1JDOpnsnp7m8%2BO3Hcqc0Vqxcd6NvPuAzYBY%2B3JAuX6WpUGnPkQfXlBDS3jSWS%2FLTituUbL1wW9cKmxbZ6vqHN1eSzErnlEknoLNNfWrB1ZS88NrGfHMv%2FbgKZSewRYWkOCYLgzIT8GwXLjvn7wyB1ec1LPNQFtXYNtj5o1ZTcv2fp9Dy%2BOrh%2B7t%2FfzkuQVkFJ%2F%2Fz8Tzec%2FfQsx5ofhdpUqFvK%2FR1BapHcMXFcZ7Z46u%2FLQgw7Y2Ztt4%2B01Z%2FddZgp05qzSCSHdZpcyGY5CJoN8JO6PsNIaJ2VwZd5G4q3Y3H%2FwIAAP%2F%2FAQAA%2F%2F98A0MilQQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectskiofficerdemote.com
FingerprintB4:6F:3A:BD:FF:FE:15:51:53:8C:D2:EB:9B:13:BE:14:D1:BC:BD:EE
ValidityTue, 28 Nov 2023 11:02:22 GMT - Mon, 26 Feb 2024 11:02:21 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuTtaTIPjjIirMQTGCme2e7vllDtGYRBbX7JKs7Ll%2B9Wy51V1NVff07JwWA5Kb481j7ze7WTRRzFUQwqwXWRAyHmQP7sX%2FIEJA8CAzO7D6oOq9V98r%2BL733hd7xSkJUNCT9U%2FMUGlNl5t1v3ZpU6XClK52a6MW%2BHX%2FSm1Tpa3oSm0wu2z%2FvcBv1v13ah9Jvm2WG37g%2B4Ef1G4qK2MzWJ6jUNnDblDv%2BvWoUQ%2BaEQb2%2F7krPDjqQfRPyUtQYvrc1i%2BPoPgEafLDdem2c5O9eyMpNM2NRV8cfppup6ZMkZyHsfUQp4eLahg3JeTrCzDp4UIBTH9%2FpgBMTYn3ewCWHi5ogvUPzpgyDZmCiedR9ieQegJFJ%2BDmLpR4QgAucGsNaXL%2FlrEl3TlD6QydkqVnf0GVU7L0xytIk%2B%2BvaTWo3TG6yJVJHQZxBTWYQPUmyIoj5EMPqjwCzz%2BHEr%2BS5WerSJP9NacNlDh5k3e6fsTC9uWoG0eXIxY3LzN%2FljYbXb%2FDGWdxd94ipSZQ8QRajkCdh2J2lIci9lBkHhJxUqPNbuz77ZjFYdiJOOdhyHmz0xJNEUad2EfBZxpGyLMRuB6B211kdhfbagRbPIbbquCEB5cT9EWFUhKUjqCkBKUiKHOCsl8dCO0arrovtCtYsPCNhQ%2Brscl7e%2FTA5D2ZElA72stOyYuz5nmX3gqwLU9qfisMm60ua8o2a3MpOu02j%2F2GiMJWK2wHDThVQbkLc6lDNSVvv76ETD15OQWjR3D6CFx5oMUboOW43fBBt8ZRx8cwfUCHmdTK1blJIEyFLF9CvuPt6VPy6nyCK2vfQfLjq3%2BGcwO3FTJb4TP1M0FP3xvfNiXZv21KRx6tZblK1JDOpnsnp7m8%2BO3Hcqc0Vqxcd6NvPuAzYBY%2B3JAuX6WpUGnPkQfXlBDS3jSWS%2FLTituUbL1wW9cKmxbZ6vqHN1eSzErnlEknoLNNfWrB1ZS88NrGfHMv%2FbgKZSewRYWkOCYLgzIT8GwXLjvn7wyB1ec1LPNQFtXYNtj5o1ZTcv2fp9Dy%2BOrh%2B7t%2FfzkuQVkFJ%2F%2Fz8Tzec%2FfQsx5ofhdpUqFvK%2FR1BapHcMXFcZ7Z46u%2FLQgw7Y2Ztt4%2B01Z%2FddZgp05qzSCSHdZpcyGY5CJoN8JO6PsNIaJ2VwZd5G4q3Y3H%2FwIAAP%2F%2FAQAA%2F%2F98A0MilQQAAA%3D%3D HTTP/1.1
Host: skiofficerdemote.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=c8904b37-49f4-4bf5-b037-452908cbcbf9:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:14 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 90f597f8d980558c86997c74995bd30b
Strict-Transport-Security: max-age=0; includeSubdomains
cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/css/animate.css
200 OK 4.8 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/css/animate.css
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
Hash e1d8acd5ee9d1a90ea09313cbd8f2b02
8a8327b115d1356715e63270d1ce6d46124c7b1a
3028c87fc798ac3741f02079034e6c23462afc0c5e6c8d321188ce3716c8472a
GET /sb/ssp/sweep/social-box/white-small/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: text/css
last-modified: Tue, 21 Sep 2021 12:02:02 GMT
etag: W/"6149c9ba-13591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fslou1xyLTDJw4MDQOi0HzsaF1ksykwlOD%2BB23W3EipHuGcuD6Y%2BOJ8eZZQhzzKpVFSwtvrSdFesakKtNIHtRb27UdqJvDZe00PAKNJEKuDBM3%2FZ%2FOAxk%2B3N886I%2BNFdEZEUxubzAQUS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b97aa227192-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
unseenreport.com/pxf.gif?uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=16
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=16
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=16 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:14 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c1436b538e1cbda47c9c970d99d6813f
Strict-Transport-Security: max-age=0; includeSubdomains
friendshipmale.com/sfp.js
200 OK 86 kB URL GET HTTP/3 friendshipmale.com/sfp.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:12 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: b9bbf36a8edde38cb27e7afced29381a
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Fri, 08 Dec 2023 16:35:12 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eve%2FN3Aj3ATxKSNX6KS7zQK6yyDMTHvxvQXnUmKLixgaW8h%2FlABH0PqCFt2DV8VeMbG9l4XNQXixzSJeNUf8HAFZI5bOMw8J76PWaGlvR%2BWkDS31BLPUkH0rtNy5QK0NBrqHghs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b941be97691-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
635382.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js
200 OK 6.4 kB URL GET HTTP/3 635382.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with very long lines (6543), with no line terminators
Hash e3adfa7305baa9b772b751a386ab07cb
dd4ca881327917117a02882f9cb9bd10d3afb859
3840f06ccbae438e3bff75651db3d99affb440fb3932e69036da9290317815ef
GET /cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js HTTP/1.1
Host: 635382.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: application/javascript; charset=utf-8
x-amz-id-2: MqFnBtkavS/UZ7/6MR8MA0PAH87yit+hEvaFxFpTLbrtDNhbtcYFOO97vrH9E3krcux3Mgt+TXQ=
x-amz-request-id: KG3DAFNGVJ42SKD2
cache-control: public, max-age=31536000
last-modified: Wed, 11 Dec 2019 13:31:58 GMT
x-amz-version-id: ESUrlvQQwNmPgiI2n2eMDNt6te85sX_N
etag: W/"ceb291a94a4e29bc8fe20512e46d29e3"
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mdy26LK%2FmN%2FVkEC7G4lDT%2FacAnG%2Fx5Nhh5YtSf6Zr9en30aZlNjDaUFsx1p8XrOByOwx7ML7AIPTStMtu7WlfxqA1DNjkIkh2wh7zTRpt4DWzr6fW0ahDdwaKDIrGoPFzqggsg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b875d4a56a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
friendshipmale.com/sfp.js
200 OK 86 kB URL GET HTTP/2 friendshipmale.com/sfp.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 42260e865f38a22ef14b027023ebd691
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Fri, 08 Dec 2023 16:35:11 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2B6eyCL6YW5pLCkclEZ5SN14QmnLN3G5XZRkwY3CKFCM%2BAVwHs8V5gwuhkvRPBIlDg%2FkA4zrpwf2%2FTyDLJkBm77%2FWETCdL0isViHlRTQKEKjPocg9Dh3Q5lg6w%2Bvg9cnw3y%2BVU8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b8f0b1206c1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.0
200 OK 318 B URL GET HTTP/2 notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.0
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectnotix.io
Fingerprint68:78:0C:AA:A6:75:6F:E2:65:2D:3B:7E:5B:8A:2B:6B:F6:1A:BF:1D
ValidityFri, 15 Sep 2023 11:38:16 GMT - Thu, 14 Dec 2023 11:38:15 GMT
File type troff or preprocessor input, ASCII text, with very long lines (358), with no line terminators
Hash e4eca3944e50640b652edd2758160079
d5f785a8effb3fb04a6af6c42365da013afe6cef
6298b3913a578c409d9d2b5e256d762cf77761aa4703b1c8b32e0f5b99a1baa0
GET /settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.0 HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://635382.flowhot.cc/
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 08 Dec 2023 16:35:12 GMT
content-type: application/json; charset=utf-8
content-length: 318
access-control-allow-origin: https://635382.flowhot.cc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
200 OK 31 kB URL GET HTTP/2 maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type ASCII text, with very long lines (30837)
Hash 269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 18:48:06
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 9e61a4e37a75208649ae6b63a0cb4f72
cdn-cache: HIT
cf-cache-status: HIT
age: 993580
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 83266b87fbf2b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.barscreative1.com/sb/au/29/a4/96/29a4965e1015f036b834d9da1d4a5e6c/1632399618.html
200 OK 1.4 kB URL GET HTTP/2 cdn.barscreative1.com/sb/au/29/a4/96/29a4965e1015f036b834d9da1d4a5e6c/1632399618.html
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
Fingerprint55:06:B7:F1:EF:E9:55:FB:7C:8C:4F:5D:DB:05:C9:15:19:90:9B:2F
ValiditySat, 11 Nov 2023 03:00:51 GMT - Fri, 09 Feb 2024 03:00:50 GMT
File type HTML document text\012- HTML document, ASCII text, with very long lines (1461), with no line terminators
Hash 044d881c6720506cc85acab4df4c5560
4026b431d6a7888854135ddf63597b51aef6e498
84082caf159dc1a63f01c3482f9765da16d0384be3f4cb21a055599d0272deac
GET /sb/au/29/a4/96/29a4965e1015f036b834d9da1d4a5e6c/1632399618.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Thu, 23 Sep 2021 12:20:22 GMT
etag: W/"614c7106-563"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Fri, 08 Dec 2023 17:35:13 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
notix.io/ent/current/enot.min.js
200 OK 145 kB URL GET HTTP/2 notix.io/ent/current/enot.min.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectnotix.io
Fingerprint68:78:0C:AA:A6:75:6F:E2:65:2D:3B:7E:5B:8A:2B:6B:F6:1A:BF:1D
ValidityFri, 15 Sep 2023 11:38:16 GMT - Thu, 14 Dec 2023 11:38:15 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 145 kB (145050 bytes)
Hash 92b38f6d9fc417ca26ce303b35c4a8a7
ac43be3c7b02b0ea8e9234290c88d617ae99b889
932b6fbd6e590cb895e40347965b2d02412c54e0198d07ffc2226661b28c62dd
Analyzer Verdict Alert Public Nextron YARA rules malware Unique code from Jetriz, Swid & Jeniva of the Tetris framework
GET /ent/current/enot.min.js HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: application/javascript
last-modified: Fri, 08 Dec 2023 09:06:51 GMT
etag: W/"6572dcab-2369a"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/css/style.css
200 OK 4.7 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/css/style.css
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (4946), with no line terminators
Hash 0c9820574b198ca562dabca383187b6a
8751a9ab8a4c172a325096fd01d0e995e3bbc5d9
00bad6e2c7ac63a0b72b4ac1352711a51752a3e7c31a5596391f55b39beeb80f
GET /sb/ssp/sweep/social-box/white-small/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: text/css
last-modified: Mon, 24 Jan 2022 10:39:40 GMT
etag: W/"61ee81ec-123b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HPQLqXoKBuHcl%2FqsxdsQLbWyS8QUF8%2BayGcrG4ZG485a%2F8Sfbr5ujYqB7s%2BmKYjs0fg12RluZrbKGLYPNHDJlMc1QLg0Gt5ZcE5c7Q59126knqNycOQafRQQglCLIGLkRDtIfAc4SXp3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b9769dc7192-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
635382.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
200 OK 1.2 kB URL GET HTTP/3 635382.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document, ASCII text, with very long lines (1271), with no line terminators
Hash 40d981045a7516cdadd00e8dccc9c58d
8b8d9a48c6b9d2fba596034ef5db3dd0f2f781c3
71c7d5fc630ff38080f71945be1e8b0c43140d8c25338056b752495e18739c0c
GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: 635382.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: application/javascript
last-modified: Fri, 01 Dec 2023 15:04:24 GMT
etag: W/"6569f5f8-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hm%2BkhfB%2Bb44O80A9COTup3kLJ2NHpTuAVQC%2BzPRa%2FCq%2B59w%2F9qdE3ZrUrf3lWIBeztJUrU9ZDPFoDxZZTeAUo1P14XP2o3ZOeclwcjqA91DopBmHgGfxdm%2FS%2BTb%2FaEE4O1FTZA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b876d6656a9-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Sun, 10 Dec 2023 16:35:10 GMT
cache-control: max-age=172800, public
content-encoding: gzip
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
200 OK 18 kB URL GET HTTP/3 maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type Web Open Font Format (Version 2), TrueType, length 18028, version 1.589\012- data
Hash 448c34a56d699c29117adc64c43affeb
ca35b697d99cae4d1b60f2d60fcd37771987eb07
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
GET /bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:11 GMT
content-type: font/woff2
content-length: 18028
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "448c34a56d699c29117adc64c43affeb"
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-cachedat: 09/21/2023 16:48:19
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1053
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: a501f8d72ee5fc641df4903aff67e86d
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 83266b8f9ad5712e-OSL
alt-svc: h3=":443"; ma=86400
200 OK 533 kB URL User Request GET HTTP/2 IP
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
Size 533 kB (532753 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: 635382.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-litespeed-cache: hit
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K1QAiC9c3FMSQgfHT6F0%2Be8KET0kedCzHgNlBRYrppTc0Ax%2B%2BAlqzVmjfFr7uKq8MJHmtTFNxMnw7kOIIZhCKLuEZfsWbyRqS140Eba%2BnDUUJajlEegxooygUEsEruvbRDOV8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 83266b846f81b4f4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
200 OK 110 kB URL GET HTTP/3 flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
Size 110 kB (110035 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /wp-includes/css/dist/block-library/style.min.css?ver=6.4.2 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 16:35:10 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 00:13:36 GMT
last-modified: Wed, 08 Nov 2023 14:55:17 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 145294
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7yhZdlA9uXo6s4z4dAbSo4fZEVAvFnB6LTQX1ntQeFr3DnjN%2F8TIi8smouXN1lZrTpFKjMJIjUlO58ob55UYTI4gYT7arOovj1Hx64eg7XJB8Ds9DBAsMHG3WpmW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 83266b879da156a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
635382.flowhot.cc/favicon.ico
404 Not Found 1.3 kB URL GET HTTP/3 635382.flowhot.cc/favicon.ico
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1336), with no line terminators
Hash f524e65bd054ef4645f2613feecd62ba
8f40c58021af38e48ca8cf873f8fc33016b8191f
519829523d799cdcf97fc3e589c7b8c0d21316df097951cf4108b95ff0a037cc
GET /favicon.ico HTTP/1.1
Host: 635382.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1702053318.1.0.1702053318.0.0.0; _ga=GA1.1.1797832012.1702053318; dom3ic8zudi28v8lr6fgphwffqoz0j6c=c8904b37-49f4-4bf5-b037-452908cbcbf9%3A1%3A1; sb_main_0633569b5e7b7ced877cf02d43663712=1; sb_count_0633569b5e7b7ced877cf02d43663712=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 08 Dec 2023 16:35:12 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lNq0%2BpbTGvy88isVoDCm8u7VcA8CRKb0EX9bualIHTDDx4Ph7X%2BcCu0fiTGOZr1Ga48JA%2BENxu8Zabj1rI6or8%2BIIDmaXudoCKWdXBRbjh0%2BVZEnV2uWlw40w%2BW5YZMRLBt4fg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b934a5256a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
vexationworship.com/pixel/purst?dl=0&th=0&sc=0&rs=2572&rd=2572&fd=918&bv=23.12.v.2&tmpl=136
200 OK 0 B URL GET HTTP/1.1 vexationworship.com/pixel/purst?dl=0&th=0&sc=0&rs=2572&rd=2572&fd=918&bv=23.12.v.2&tmpl=136
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectvexationworship.com
FingerprintAB:75:EA:1F:F2:23:27:A4:01:23:97:24:D6:1E:24:CE:9F:65:F4:9C
ValidityTue, 28 Nov 2023 08:18:54 GMT - Mon, 26 Feb 2024 08:18:53 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=2572&rd=2572&fd=918&bv=23.12.v.2&tmpl=136 HTTP/1.1
Host: vexationworship.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:13 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
unseenreport.com/pxf.gif?uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=16
200 OK 0 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=16
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://635382.flowhot.cc/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=c8904b37-49f4-4bf5-b037-452908cbcbf9&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=16 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 16:35:14 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 72945041826d268fd0f954495e62100d
Strict-Transport-Security: max-age=0; includeSubdomains
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 15:46:25 GMT
expires: Fri, 06 Dec 2024 15:46:25 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 89329
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/js/script.js
200 OK 774 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/sweep/social-box/white-small/js/script.js
IP
Requested by https://635382.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (812), with no line terminators
Hash 4ec80506223ecab10ca4aa3f0a23505c
1eee12c2972e49bfc91ca6368890e2d4da8c885f
a32bf5464b886bf5ed62307dc6aa6d5ea573e61534983e6ff081d1336d12837a
GET /sb/ssp/sweep/social-box/white-small/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635382.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635382.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 16:35:13 GMT
content-type: application/javascript
last-modified: Tue, 21 Sep 2021 12:02:04 GMT
etag: W/"6149c9bc-306"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDsyjKA%2FA1sYcfkKFDvAwAf67IdH4JGH9N%2B%2FvaCxFhWXuzQtwy2LGXDH3%2FvmFXO3szz8HC8vfEet5746j6%2B0qvjkybB922%2BKErxKPAutkm0vzR%2FQ1pTVJmnOtnTew8%2FtmiF%2FEBXUGwup"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83266b98fb8b7192-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
188.114.97.1
104.18.10.207
45.133.44.10
139.45.240.92
18.184.210.76
0.0.0.0