flowhot.cc/wp-content/uploads/2019/11/promo.jpeg
200 OK 161 kB URL GET HTTP/3 flowhot.cc/wp-content/uploads/2019/11/promo.jpeg
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Macintosh), datetime=2019:11:21 20:13:11], progressive, precision 8, 900x250, components 3\012- data
Size 161 kB (160863 bytes)
Hash f66cbb86803abd9d9f37a1588f14d5fd
c38f678cea2edc798d223b0c57f3b6c6b4acb008
ee089d909a7461ab0f483151883331e191c18f0a1db138a4bba12d82330287a1
GET /wp-content/uploads/2019/11/promo.jpeg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: image/jpeg
content-length: 160863
cache-control: public, max-age=31536000
expires: Sat, 30 Dec 2023 05:45:23 GMT
last-modified: Fri, 22 Nov 2019 02:34:58 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 312769
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Q3CJGWbxi%2Bkig%2Fv2N5scaV0QT%2FxfAODFCNJu%2B6DRV3baIYHi40A2iGw%2BULZhRxsP6sFCn9uNmlXQ9gM4YDP6gwHSHdT8W4xUBUSVAVZMXUnNUjE8HRrN%2FtLU12S"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9ca78817b4f7-OSL
alt-svc: h3=":443"; ma=86400
code.jquery.com/jquery-3.4.1.js
200 OK 83 kB URL GET HTTP/2 code.jquery.com/jquery-3.4.1.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
Hash 11c05eb286ed576526bf4543760785b9
7faa15a054093f3b5d674e63b6567c835a6fa217
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
GET /jquery-3.4.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4472c"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sun, 03 Dec 2023 20:38:12 GMT
age: 6833691
x-served-by: cache-lga21923-LGA, cache-bma1682-BMA
x-cache: HIT, HIT
x-cache-hits: 18, 69303
x-timer: S1701635892.429686,VS0,VE0
vary: Accept-Encoding
content-length: 82889
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=UA-922266-5
200 OK 69 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=UA-922266-5
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Hash 928d7a703a7cab0cc2dde2ed0ddb7f49
7db8eb62ad724cbda55913d5fc1c017b6cdd8ee8
761743421b82b0907aa51c8d460123fbd060d5b2688a94bf01342420e23b0bb9
GET /gtag/js?id=UA-922266-5 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 03 Dec 2023 20:38:12 GMT
expires: Sun, 03 Dec 2023 20:38:12 GMT
cache-control: private, max-age=900
last-modified: Sun, 03 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 68945
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
flowhot.cc/wp-content/uploads/2022/08/El%20Yala%20-%202%20Na'%20Ma-300x300.jpg
200 OK 14 kB URL GET HTTP/3 flowhot.cc/wp-content/uploads/2022/08/El%20Yala%20-%202%20Na'%20Ma-300x300.jpg
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 300x300, components 3\012- data
Hash 1778b6e7d19db1114446eeea199e2161
9fecf0c3abf67ab304b434fe54293bf2c15f517c
196831260581b76e441e98fdc089fe67253d14b0dc151a9a7f22ad17806f9380
GET /wp-content/uploads/2022/08/El%20Yala%20-%202%20Na'%20Ma-300x300.jpg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: image/jpeg
content-length: 13923
cache-control: public, max-age=31536000
expires: Tue, 02 Jan 2024 20:38:12 GMT
last-modified: Fri, 19 Aug 2022 01:08:54 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F07GsLuuCs1OfIwRMzXeCig4BWUgPIZfNDEHCkapKi60cbim26%2B5tiDbxdtOEk6muYCTUuIeBEMe6XXD0Vz4HN1xhX%2BHcvxPnFqcvlNO03o1xliuObvEuSD3mKxC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9ca78818b4f7-OSL
alt-svc: h3=":443"; ma=86400
www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c
200 OK 81 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash 4695633e86842a692040c3b371c71930
d72b07147ba2c0348654eec6119af352fbac1eee
cc2cdfd69ceb5b3f849e0e68c831b16459f1b4812eb63e5a057ec3de8ac34d14
GET /gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 03 Dec 2023 20:38:12 GMT
expires: Sun, 03 Dec 2023 20:38:12 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 81205
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js
200 OK 16 kB URL GET HTTP/1.1 finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectfinallytrained.com
Fingerprint8F:A1:2B:2D:3A:32:A7:71:00:73:CC:06:43:01:E1:62:6F:57:F2:4F
ValiditySat, 04 Nov 2023 06:34:02 GMT - Fri, 02 Feb 2024 06:34:01 GMT
File type ASCII text, with very long lines (42931), with no line terminators
Hash 8e6ad4b73d5aff7e1e772f263607e03a
ba78d6570e04d84811104996abd6c72e9e6d4d1f
c2e3fc472f3d987609bc72cf1e696cc322a91789332aa1bbcd6cf319800b52b8
GET /06/33/56/0633569b5e7b7ced877cf02d43663712.js HTTP/1.1
Host: finallytrained.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 20:38:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c94390593fa28a44702c64c4b3ef48ad
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash e5fa60ce3d16785d7c2367fd715e4040
43bbe902c8cf93f54de79c6f45b5946b18e5ec84
f43970d86d4849064fe152fbdad85cd6c2feb8a5447b51fbca0b7fc891b12a21
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://628811.flowhot.cc
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=a24411f8-2200-4811-b4b8-65a258d357d3:1:1; expires=Wed, 30 Nov 2033 20:38:13 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
200 OK 18 kB URL GET HTTP/3 maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type Web Open Font Format (Version 2), TrueType, length 18028, version 1.589\012- data
Hash 448c34a56d699c29117adc64c43affeb
ca35b697d99cae4d1b60f2d60fcd37771987eb07
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
GET /bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: font/woff2
content-length: 18028
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "448c34a56d699c29117adc64c43affeb"
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-cachedat: 09/21/2023 16:48:19
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1053
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 7828b5ffc8d0ece0e4e828ac677c5832
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82fe9cae88bb56c0-OSL
alt-svc: h3=":443"; ma=86400
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
200 OK 77 kB URL GET HTTP/3 maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Hash af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
GET /font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://maxcdn.bootstrapcdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: font/woff2
content-length: 77160
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "af7ae505a9eed503f8b8e6982036873e"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 19:08:24
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 752
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 6f74f614178efbd16f34e9c7bf8d8b36
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82fe9cae587156c0-OSL
alt-svc: h3=":443"; ma=86400
628811.flowhot.cc/dectector.js
404 Not Found 971 B URL GET HTTP/3 628811.flowhot.cc/dectector.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash e00762520e4ab4b33624eaa8ad271f53
7a41deabed370ebe3a80f9bca5f7394693495b8a
c36d24216ab2a409590f390838c3950da222f30e6ce7399f009a66446de4e3f2
GET /dectector.js HTTP/1.1
Host: 628811.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1701635898.1.0.1701635898.0.0.0; _ga=GA1.1.1172294257.1701635898
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hAArdMeyChfKrDA48XQc3b4gXBA6t0IyzmECjC2zugtQA1rLeRKeZBZY7vpx7IzmdW0qqJ856X2hwBH4FiyhTKkSkTMuWehh0h0zfvWJyQivXr6zqA6k6jHw3MD2ULBizLRuxw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cad9fc6b4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
ardentlyexposureflushed.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js
200 OK 23 kB URL GET HTTP/1.1 ardentlyexposureflushed.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectardentlyexposureflushed.com
FingerprintCB:F3:A7:64:D0:55:AE:83:FE:CD:FA:A4:A8:5E:97:D2:27:E6:2D:01
ValidityTue, 28 Nov 2023 10:50:41 GMT - Mon, 26 Feb 2024 10:50:40 GMT
File type ASCII text, with very long lines (59635), with no line terminators
Hash 37f649a8c2f4b34214dbb142e1b6a30b
0fca675abd655ffc239d773ce2f5e2aff2cb53f9
af05f33527bf4fc05bc6058a8d7d3c4bda6d5b4bfd4a87150926ca27f2fe2fdf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js HTTP/1.1
Host: ardentlyexposureflushed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 20:38:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ec3ffee134e6cadbfe8b8442c4f1da84
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
flowhot.cc/wp-content/themes/flowhot/views.php?id=628811
200 OK 4.1 kB URL GET HTTP/3 flowhot.cc/wp-content/themes/flowhot/views.php?id=628811
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with no line terminators
Hash 7a4b4237c9f5731fc8eca3f753feef2a
ddcb91261143b87bd3ec2f4502a4b125eca6f4f7
09b3d8c141694f7ce34b06909afeeac30cd45232450dabb85d1decc7afac0d9b
GET /wp-content/themes/flowhot/views.php?id=628811 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xzjM5aZEbWHCDUAfRMMLyIW%2F8t0bKv4LchI82u0bQn2iempPWS8YeOqPpCxpZiAi8%2F6cuUwGFZLmQfmKmZunov9YxbB3Tuqu3pABOx%2FXe6sQwGpy7rQc2JLmcpdi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82fe9caf19bbb4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
assistantasks.com/pixel/purst?dl=0&th=0&sc=0&rs=2129&rd=2129&fd=614&bv=23.11.v.8&tmpl=136
200 OK 0 B URL GET HTTP/1.1 assistantasks.com/pixel/purst?dl=0&th=0&sc=0&rs=2129&rd=2129&fd=614&bv=23.11.v.8&tmpl=136
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectassistantasks.com
Fingerprint89:09:6E:08:6E:3C:29:55:98:DE:AF:77:15:0F:3E:EF:C7:30:A5:7A
ValidityTue, 28 Nov 2023 08:05:53 GMT - Mon, 26 Feb 2024 08:05:52 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=2129&rd=2129&fd=614&bv=23.11.v.8&tmpl=136 HTTP/1.1
Host: assistantasks.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 20:38:14 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
ardentlyexposureflushed.com/ren.gif?sid=H4sIAAAAAAAC%2F1RST4gcxReuTvZ3%2BuFBzUVQmINiBHe2%2F84fcwjGmBiMyZI%2F7MFTVVf1bLnVXU1V9%2FTseFkMSI4jePDY%2B81uFk0IxqMgyKwXWRAyHmQPLogHb7kIOcvMDow%2BqHrve18d3ve9%2Bny3PCEeSnq8%2FpEeSqXoWtR0G%2Bc3ZMZ1ZRs37jQ8t%2BleaGzIrBVeaAxml%2Bm%2F47lR032rcVXEW3rNdz3X9VyvcUUakejB2pyFzB91vWbXbYZ%2B04tCDMx%2FsS0dWOqA90%2FIS5B8%2Br%2FNn59AxhNk6beXhd0qdP72%2B2mpaKEN%2BvzgbraV6SpDuiwT4yDJDhavoe2UkK%2FOQGcHCwXQ%2Fb2ZAjA5Jc5vHlh2sBgTrL9%2FOilTEBkY%2Fz%2Bq%2FgRCTSDpBLG%2BB8mfEiDmuHETWfrghjYV3T5l6YydkpXnf0NWU7Ly%2Bzlk6eNLSg4at7UqC6kzi0FSQw4mkL0J8vIQxdCBrA4RF59B8l%2FI2vPryNK9m1ZpSH78OvXD0POSzqrvu%2B5q2PG8VRayzmoron7U4UHU5sHcIiknkMkESoxArYNydqSDMnFQ5g5SftygUTdx3XbCkiDohHEcB0EcR50Wj3gQdhIXZTzTMEKRjxCrEWKzg9zsYEuOYMofYTdrWO7AFgR9XqMSBJUlqChBJQmqgqDq1%2FtcWd%2FWD7iyJfMW2V%2FkoB7rordL93XRExkBNaPd%2FIS8ODPPOf%2BGhy1x3HBbQRC1uiwSbdaOBe%2B023Hi%2BjwMWq2g7fmwsoa0Z%2BZSh3JK3nx1Bbl8%2BnIGRg9h1SFi6YCWr4FW47bvgm6Ow46LYfaQDnOhpG3GOgXXNfJiBcW2s6tOyCvzDX7w%2FccQ8dHFL4d%2FXH187lPEpkZuanwifyLoqfvjW7oie7d0ZcmTm3khUzmks%2B3eLmghzn7zodiutOHXLtvR1%2B%2FGM2JWProjbHGdZlxmPUseXpKcC3NFm1iQH67ZDcHWS7t5qTRZmV9ff%2B%2FKtTQ3wlqpswmonBLy7DvEckpeeGbnP%2Ff83T8hzQSmrJGWR2QRkPoQcb4Dmy97VhMYtcQsd1CV9dj4bNlUkkCJJaashv0XZst6195HzzigxT1kaY2%2BqdFXNagawZZnx0Vuji7%2BGswDTDljpoyzx5RRX5yaa%2BVxQ0SJmwjXFyzpsqRNXd5Nwi6jXU%2B0WUQ9FHYq1F%2BtfwAAAP%2F%2FAQAA%2F%2F8kSskykQQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 ardentlyexposureflushed.com/ren.gif?sid=H4sIAAAAAAAC%2F1RST4gcxReuTvZ3%2BuFBzUVQmINiBHe2%2F84fcwjGmBiMyZI%2F7MFTVVf1bLnVXU1V9%2FTseFkMSI4jePDY%2B81uFk0IxqMgyKwXWRAyHmQPLogHb7kIOcvMDow%2BqHrve18d3ve9%2Bny3PCEeSnq8%2FpEeSqXoWtR0G%2Bc3ZMZ1ZRs37jQ8t%2BleaGzIrBVeaAxml%2Bm%2F47lR032rcVXEW3rNdz3X9VyvcUUakejB2pyFzB91vWbXbYZ%2B04tCDMx%2FsS0dWOqA90%2FIS5B8%2Br%2FNn59AxhNk6beXhd0qdP72%2B2mpaKEN%2BvzgbraV6SpDuiwT4yDJDhavoe2UkK%2FOQGcHCwXQ%2Fb2ZAjA5Jc5vHlh2sBgTrL9%2FOilTEBkY%2Fz%2Bq%2FgRCTSDpBLG%2BB8mfEiDmuHETWfrghjYV3T5l6YydkpXnf0NWU7Ly%2Bzlk6eNLSg4at7UqC6kzi0FSQw4mkL0J8vIQxdCBrA4RF59B8l%2FI2vPryNK9m1ZpSH78OvXD0POSzqrvu%2B5q2PG8VRayzmoron7U4UHU5sHcIiknkMkESoxArYNydqSDMnFQ5g5SftygUTdx3XbCkiDohHEcB0EcR50Wj3gQdhIXZTzTMEKRjxCrEWKzg9zsYEuOYMofYTdrWO7AFgR9XqMSBJUlqChBJQmqgqDq1%2FtcWd%2FWD7iyJfMW2V%2FkoB7rordL93XRExkBNaPd%2FIS8ODPPOf%2BGhy1x3HBbQRC1uiwSbdaOBe%2B023Hi%2BjwMWq2g7fmwsoa0Z%2BZSh3JK3nx1Bbl8%2BnIGRg9h1SFi6YCWr4FW47bvgm6Ow46LYfaQDnOhpG3GOgXXNfJiBcW2s6tOyCvzDX7w%2FccQ8dHFL4d%2FXH187lPEpkZuanwifyLoqfvjW7oie7d0ZcmTm3khUzmks%2B3eLmghzn7zodiutOHXLtvR1%2B%2FGM2JWProjbHGdZlxmPUseXpKcC3NFm1iQH67ZDcHWS7t5qTRZmV9ff%2B%2FKtTQ3wlqpswmonBLy7DvEckpeeGbnP%2Ff83T8hzQSmrJGWR2QRkPoQcb4Dmy97VhMYtcQsd1CV9dj4bNlUkkCJJaashv0XZst6195HzzigxT1kaY2%2BqdFXNagawZZnx0Vuji7%2BGswDTDljpoyzx5RRX5yaa%2BVxQ0SJmwjXFyzpsqRNXd5Nwi6jXU%2B0WUQ9FHYq1F%2BtfwAAAP%2F%2FAQAA%2F%2F8kSskykQQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectardentlyexposureflushed.com
FingerprintCB:F3:A7:64:D0:55:AE:83:FE:CD:FA:A4:A8:5E:97:D2:27:E6:2D:01
ValidityTue, 28 Nov 2023 10:50:41 GMT - Mon, 26 Feb 2024 10:50:40 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RST4gcxReuTvZ3%2BuFBzUVQmINiBHe2%2F84fcwjGmBiMyZI%2F7MFTVVf1bLnVXU1V9%2FTseFkMSI4jePDY%2B81uFk0IxqMgyKwXWRAyHmQPLogHb7kIOcvMDow%2BqHrve18d3ve9%2Bny3PCEeSnq8%2FpEeSqXoWtR0G%2Bc3ZMZ1ZRs37jQ8t%2BleaGzIrBVeaAxml%2Bm%2F47lR032rcVXEW3rNdz3X9VyvcUUakejB2pyFzB91vWbXbYZ%2B04tCDMx%2FsS0dWOqA90%2FIS5B8%2Br%2FNn59AxhNk6beXhd0qdP72%2B2mpaKEN%2BvzgbraV6SpDuiwT4yDJDhavoe2UkK%2FOQGcHCwXQ%2Fb2ZAjA5Jc5vHlh2sBgTrL9%2FOilTEBkY%2Fz%2Bq%2FgRCTSDpBLG%2BB8mfEiDmuHETWfrghjYV3T5l6YydkpXnf0NWU7Ly%2Bzlk6eNLSg4at7UqC6kzi0FSQw4mkL0J8vIQxdCBrA4RF59B8l%2FI2vPryNK9m1ZpSH78OvXD0POSzqrvu%2B5q2PG8VRayzmoron7U4UHU5sHcIiknkMkESoxArYNydqSDMnFQ5g5SftygUTdx3XbCkiDohHEcB0EcR50Wj3gQdhIXZTzTMEKRjxCrEWKzg9zsYEuOYMofYTdrWO7AFgR9XqMSBJUlqChBJQmqgqDq1%2FtcWd%2FWD7iyJfMW2V%2FkoB7rordL93XRExkBNaPd%2FIS8ODPPOf%2BGhy1x3HBbQRC1uiwSbdaOBe%2B023Hi%2BjwMWq2g7fmwsoa0Z%2BZSh3JK3nx1Bbl8%2BnIGRg9h1SFi6YCWr4FW47bvgm6Ow46LYfaQDnOhpG3GOgXXNfJiBcW2s6tOyCvzDX7w%2FccQ8dHFL4d%2FXH187lPEpkZuanwifyLoqfvjW7oie7d0ZcmTm3khUzmks%2B3eLmghzn7zodiutOHXLtvR1%2B%2FGM2JWProjbHGdZlxmPUseXpKcC3NFm1iQH67ZDcHWS7t5qTRZmV9ff%2B%2FKtTQ3wlqpswmonBLy7DvEckpeeGbnP%2Ff83T8hzQSmrJGWR2QRkPoQcb4Dmy97VhMYtcQsd1CV9dj4bNlUkkCJJaashv0XZst6195HzzigxT1kaY2%2BqdFXNagawZZnx0Vuji7%2BGswDTDljpoyzx5RRX5yaa%2BVxQ0SJmwjXFyzpsqRNXd5Nwi6jXU%2B0WUQ9FHYq1F%2BtfwAAAP%2F%2FAQAA%2F%2F8kSskykQQAAA%3D%3D HTTP/1.1
Host: ardentlyexposureflushed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=a24411f8-2200-4811-b4b8-65a258d357d3:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 20:38:14 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0c428336245d36182800da199469fb8c
Strict-Transport-Security: max-age=0; includeSubdomains
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/img/close.png
200 OK 591 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/img/close.png
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced\012- data
Hash 9fd5bcb6103d86e317bd1eb019bcbe71
6b5a52ea669dcb74946f2bed4bdd7ec985026113
0ddd3be104ac7945fb062096df62034a6a24ecc76ba92493c35c62c3c25982ae
GET /sb/ssp/vpn/classic-push/big1/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: image/png
content-length: 591
last-modified: Mon, 21 Feb 2022 10:06:44 GMT
etag: "62136434-24f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 303828
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uTdRb2iR3uQphXfqbWKE5uOkUHYMWQDGK3oYZKEAr1HsOYo7Hqz7dG1Tq08NiY5TLRJuRO7%2BzCXaYL8XxCGdj4i1DEVWA%2B%2BcgLwbXSdpZHgK9AdDd1aIOi%2BVLMVkyG3Wd1H403wBEnSw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb499f523ae-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/98/58/2f/98582fa31e3a411721a1f890fd22419a/1700491903.png
200 OK 9.0 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/98/58/2f/98582fa31e3a411721a1f890fd22419a/1700491903.png
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash a56f06ca83ee06488a213b352e00bd90
aec437b74eb6f1143683872fb2d664286da4a664
7144c526762a9d91bdde1939194c2835f2cb1afe0ebac298bbdf1e9239b539ec
GET /si/98/58/2f/98582fa31e3a411721a1f890fd22419a/1700491903.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: image/png
content-length: 9016
server: nginx/1.21.6
last-modified: Mon, 20 Nov 2023 14:51:52 GMT
etag: "655b7288-2338"
expires: Tue, 05 Dec 2023 20:38:14 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/3c/d5/62/3cd562dd264800ee586ac2da770e9a65/1700491951.png
200 OK 20 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/3c/d5/62/3cd562dd264800ee586ac2da770e9a65/1700491951.png
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 320 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash ea31001ce8fa95eb2ac1617515105332
d505ca04808c25cfa33a555c96886f421ddbbde7
0267f5cd21fe5609405724c20d6f021b8932a696ada766b8e86e42c670000ab3
GET /si/3c/d5/62/3cd562dd264800ee586ac2da770e9a65/1700491951.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: image/png
content-length: 20001
server: nginx/1.21.6
last-modified: Mon, 20 Nov 2023 14:52:40 GMT
etag: "655b72b8-4e21"
expires: Tue, 05 Dec 2023 20:38:14 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
unseenreport.com/pxf.gif?uuid=a24411f8-2200-4811-b4b8-65a258d357d3&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=a24411f8-2200-4811-b4b8-65a258d357d3&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=a24411f8-2200-4811-b4b8-65a258d357d3&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 20:38:15 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 89d160046c6241de46bab7390d0ad976
Strict-Transport-Security: max-age=0; includeSubdomains
unseenreport.com/pxf.gif?uuid=a24411f8-2200-4811-b4b8-65a258d357d3&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=a24411f8-2200-4811-b4b8-65a258d357d3&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=a24411f8-2200-4811-b4b8-65a258d357d3&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 20:38:15 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: eeb7877dce970567d28abca4fa858c09
Strict-Transport-Security: max-age=0; includeSubdomains
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 21:13:56 GMT
expires: Thu, 28 Nov 2024 21:13:56 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 343459
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:57:34 GMT
expires: Fri, 29 Nov 2024 04:57:34 GMT
cache-control: public, max-age=31536000
age: 315641
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/js/jquery.min.js
200 OK 31 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/js/jquery.min.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (32025)
Hash 4a356126b9573eb7bd1e9a7494737410
8258d046f17dd3c15a5d3984e1868b7b5d1db329
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
GET /sb/ssp/vpn/classic-push/big1/js/jquery.min.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: application/javascript
last-modified: Mon, 21 Feb 2022 10:06:46 GMT
etag: W/"62136436-1499c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2132655
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ikys2uoXizN40boOHrsxWP62vTN2dZpJzakqNUsVymbYDHHU%2B4fia4J88HPelAL8Hkk%2FMmNz01vAhGx6flST1Xyhd6XO7G%2BZLao0nAFcjpnQw8VasQZt2IBW%2FN8lZXikVuHvAlR3lxvW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb4ba1523ae-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ardentlyexposureflushed.com/impr.gif?sid=H4sIAAAAAAAC%2F1RST4gcxReuTvZ3%2BuFBzUVQmINiBHe2%2F870mEMwxsRgTEL%2BkIOn6qrq2XKru5qq7unJeAkGJMcRPHjs%2FWY3iyYE41EQZNaLLAgZD7IHF8SDt1yEnGVmB0YfVL33va8O7%2Ftefb5dHREPFT289pEeSaXoRtR2W6dvy5zr2rau3Gx5bts907ot8054pjWcX2bwjudGbfet1kXBtvSG73qu67le64I0ItXDjQULWTzqee2e2w79theFGJr%2FYls5sNQBHxyRlyD57H%2BbPz%2BBZFPk2bfnhd0qdfH2%2B1mlaKkNBnzvVr6V6zpHtipT4yDN95avoe2MkK9OQOd7SwXQg525AiRyRpzfPCT53nJMJIPd40kTBZEj4f9HPZhCqCkknYLpe5D8KQEYx5WryLMHV7Sp6Z1jls7ZGVl7%2FjdkPSNrv59Cnj0%2Bp%2BSwdUOrqpQ6tximDeRwCtmfoqj2UY4cyHofrPwMkv9CNp5fRp7tXLVKQ%2FLD16kfhp6Xxuu%2B77rrYex560mYxOudiPpRzIOoy4OFRVJOIdMplBiDWgfV%2FEgHVeqgKhxk%2FLBFo17qut00SYMgDhljQcBYFHd4xIMwTl1UbK5hjLIYg6kxmLmLwtzFlhzDVD%2FCbjaw3IEtCQa8QS0IaktQU4JaEtQlQT1odrmyvm0ecGWrxFtmf5mDZqLL%2Fjbd1WVf5ATUjLeLI%2FLi3Dzn9BsetsRhy%2B0EQdTpJZHoJl0meNztstT1eRh0OkHX82FlA2lPLKSO5Iy8%2BeoaCvn05RwJ3YdV%2B2DSAa1eA60nXd8F3ZyEsYtR%2FpCOCqGkbTOdgesGRbmG8o6zrY7IK4sNfvD9xxDs4OyXoz8uPj71KZhpUJgGn8ifCPrq%2FuS6rsnOdV1b8uRqUcpMjuh8uzdKWoqT33wo7tTa8Evn7fjrd9mcmJePbgpbXqY5l3nfkofnJOfCXNCGCfLDJXtbJNcqu3muMnlVXL723oVLWWGEtVLnU1A5I%2BTZd2ByRl54Zhc%2F9%2FStPyHNFKZqkFUHZBmQeh%2BsuAtbrHpWExi1wknhoK6aifGTVVNJAiVWmCYN7L9wsqq37X30jQNa3kOeNRiYBgPVgKoxbHVyUhbm4OyvwSKQKGeSKOPsJMqoL47NtfKwFXmhiJO4yzhPBONe1w%2FiwHV9zsNuT3g9lHYm1F%2BdfwAAAP%2F%2FAQAA%2F%2F8wQkfUkQQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 ardentlyexposureflushed.com/impr.gif?sid=H4sIAAAAAAAC%2F1RST4gcxReuTvZ3%2BuFBzUVQmINiBHe2%2F870mEMwxsRgTEL%2BkIOn6qrq2XKru5qq7unJeAkGJMcRPHjs%2FWY3iyYE41EQZNaLLAgZD7IHF8SDt1yEnGVmB0YfVL33va8O7%2Ftefb5dHREPFT289pEeSaXoRtR2W6dvy5zr2rau3Gx5bts907ot8054pjWcX2bwjudGbfet1kXBtvSG73qu67le64I0ItXDjQULWTzqee2e2w79theFGJr%2FYls5sNQBHxyRlyD57H%2BbPz%2BBZFPk2bfnhd0qdfH2%2B1mlaKkNBnzvVr6V6zpHtipT4yDN95avoe2MkK9OQOd7SwXQg525AiRyRpzfPCT53nJMJIPd40kTBZEj4f9HPZhCqCkknYLpe5D8KQEYx5WryLMHV7Sp6Z1jls7ZGVl7%2FjdkPSNrv59Cnj0%2Bp%2BSwdUOrqpQ6tximDeRwCtmfoqj2UY4cyHofrPwMkv9CNp5fRp7tXLVKQ%2FLD16kfhp6Xxuu%2B77rrYex560mYxOudiPpRzIOoy4OFRVJOIdMplBiDWgfV%2FEgHVeqgKhxk%2FLBFo17qut00SYMgDhljQcBYFHd4xIMwTl1UbK5hjLIYg6kxmLmLwtzFlhzDVD%2FCbjaw3IEtCQa8QS0IaktQU4JaEtQlQT1odrmyvm0ecGWrxFtmf5mDZqLL%2Fjbd1WVf5ATUjLeLI%2FLi3Dzn9BsetsRhy%2B0EQdTpJZHoJl0meNztstT1eRh0OkHX82FlA2lPLKSO5Iy8%2BeoaCvn05RwJ3YdV%2B2DSAa1eA60nXd8F3ZyEsYtR%2FpCOCqGkbTOdgesGRbmG8o6zrY7IK4sNfvD9xxDs4OyXoz8uPj71KZhpUJgGn8ifCPrq%2FuS6rsnOdV1b8uRqUcpMjuh8uzdKWoqT33wo7tTa8Evn7fjrd9mcmJePbgpbXqY5l3nfkofnJOfCXNCGCfLDJXtbJNcqu3muMnlVXL723oVLWWGEtVLnU1A5I%2BTZd2ByRl54Zhc%2F9%2FStPyHNFKZqkFUHZBmQeh%2BsuAtbrHpWExi1wknhoK6aifGTVVNJAiVWmCYN7L9wsqq37X30jQNa3kOeNRiYBgPVgKoxbHVyUhbm4OyvwSKQKGeSKOPsJMqoL47NtfKwFXmhiJO4yzhPBONe1w%2FiwHV9zsNuT3g9lHYm1F%2BdfwAAAP%2F%2FAQAA%2F%2F8wQkfUkQQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectardentlyexposureflushed.com
FingerprintCB:F3:A7:64:D0:55:AE:83:FE:CD:FA:A4:A8:5E:97:D2:27:E6:2D:01
ValidityTue, 28 Nov 2023 10:50:41 GMT - Mon, 26 Feb 2024 10:50:40 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RST4gcxReuTvZ3%2BuFBzUVQmINiBHe2%2F870mEMwxsRgTEL%2BkIOn6qrq2XKru5qq7unJeAkGJMcRPHjs%2FWY3iyYE41EQZNaLLAgZD7IHF8SDt1yEnGVmB0YfVL33va8O7%2Ftefb5dHREPFT289pEeSaXoRtR2W6dvy5zr2rau3Gx5bts907ot8054pjWcX2bwjudGbfet1kXBtvSG73qu67le64I0ItXDjQULWTzqee2e2w79theFGJr%2FYls5sNQBHxyRlyD57H%2BbPz%2BBZFPk2bfnhd0qdfH2%2B1mlaKkNBnzvVr6V6zpHtipT4yDN95avoe2MkK9OQOd7SwXQg525AiRyRpzfPCT53nJMJIPd40kTBZEj4f9HPZhCqCkknYLpe5D8KQEYx5WryLMHV7Sp6Z1jls7ZGVl7%2FjdkPSNrv59Cnj0%2Bp%2BSwdUOrqpQ6tximDeRwCtmfoqj2UY4cyHofrPwMkv9CNp5fRp7tXLVKQ%2FLD16kfhp6Xxuu%2B77rrYex560mYxOudiPpRzIOoy4OFRVJOIdMplBiDWgfV%2FEgHVeqgKhxk%2FLBFo17qut00SYMgDhljQcBYFHd4xIMwTl1UbK5hjLIYg6kxmLmLwtzFlhzDVD%2FCbjaw3IEtCQa8QS0IaktQU4JaEtQlQT1odrmyvm0ecGWrxFtmf5mDZqLL%2Fjbd1WVf5ATUjLeLI%2FLi3Dzn9BsetsRhy%2B0EQdTpJZHoJl0meNztstT1eRh0OkHX82FlA2lPLKSO5Iy8%2BeoaCvn05RwJ3YdV%2B2DSAa1eA60nXd8F3ZyEsYtR%2FpCOCqGkbTOdgesGRbmG8o6zrY7IK4sNfvD9xxDs4OyXoz8uPj71KZhpUJgGn8ifCPrq%2FuS6rsnOdV1b8uRqUcpMjuh8uzdKWoqT33wo7tTa8Evn7fjrd9mcmJePbgpbXqY5l3nfkofnJOfCXNCGCfLDJXtbJNcqu3muMnlVXL723oVLWWGEtVLnU1A5I%2BTZd2ByRl54Zhc%2F9%2FStPyHNFKZqkFUHZBmQeh%2BsuAtbrHpWExi1wknhoK6aifGTVVNJAiVWmCYN7L9wsqq37X30jQNa3kOeNRiYBgPVgKoxbHVyUhbm4OyvwSKQKGeSKOPsJMqoL47NtfKwFXmhiJO4yzhPBONe1w%2FiwHV9zsNuT3g9lHYm1F%2BdfwAAAP%2F%2FAQAA%2F%2F8wQkfUkQQAAA%3D%3D HTTP/1.1
Host: ardentlyexposureflushed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=a24411f8-2200-4811-b4b8-65a258d357d3:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 20:38:15 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a5cbb40d1a716a64cedc5a7570b84a07
Strict-Transport-Security: max-age=0; includeSubdomains
flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.4.1
200 OK 110 kB URL GET HTTP/3 flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.4.1
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
Size 110 kB (110035 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /wp-includes/css/dist/block-library/style.min.css?ver=6.4.1 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Sat, 30 Dec 2023 05:45:23 GMT
last-modified: Wed, 08 Nov 2023 14:55:17 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 312769
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LsMQVV79qBW0SUaKtY1U10PexlEqfatVouvehq3si2jNZo3qALPSy%2B0cFaUvUk368WDN2ZELTBdMuzkfDx3izRZ7Q%2BxfeQ%2BmwRx7yK1AJf4JWe9YccKnBkvXInSJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82fe9ca78815b4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/css/style.css
200 OK 4.2 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/css/style.css
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (4404), with no line terminators
Hash 68b1992666e9738c9fe476446c9554c6
7ed918e75115fd3be8bd1df1f6106d3f53129c78
c3ca1c3bc15dfab20c6c3733049214afc18b2deaba8d9685c57cc3f238b687d8
GET /sb/ssp/vpn/classic-push/big1/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: text/css
last-modified: Mon, 21 Feb 2022 10:59:09 GMT
etag: W/"6213707d-1048"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s4JY%2BgZAj826ePEEopJvWU8WykajPdBHZ5EGOb%2BHpUeibNQQ%2F1H93fbqlp%2BP0001dzki4MWvYyBr1SVi0dF09Ii9N1bEAvXtTdmTCnaJKz%2B8wux8uq3ZdIT1tkITgKJNuIT2qt5kJpWG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb4697223ae-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/js/script.js
200 OK 958 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/js/script.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (1009), with no line terminators
Hash 04835fd7dd7f8cfbad901bee8cff2170
38e9ed1e93f8f0beba9447a99afe3995e63b6f3e
be63bbd38c66ca9a9ee1c8abfed042fd5fc090c40b91ad561e922744ece47c41
GET /sb/ssp/vpn/classic-push/big1/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: application/javascript
last-modified: Mon, 21 Feb 2022 10:06:46 GMT
etag: W/"62136436-3be"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a1Yp4WKg%2Bt%2Fo163RnCpkIU0s9qKHyjOGa7SHRhZ4C%2FwlpvCWIixWGGpHrW0niOgOgEYle%2BMLWYS5Vbv%2BaOPYz9KNON2FPwMlQDWCLTuPOzFOsLHnUReTnnzKePArMd7bGjIP0ci8odsY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb60c1023ae-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ardentlyexposureflushed.com/pixel/sbs?c=1
200 OK 0 B URL GET HTTP/1.1 ardentlyexposureflushed.com/pixel/sbs?c=1
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectardentlyexposureflushed.com
FingerprintCB:F3:A7:64:D0:55:AE:83:FE:CD:FA:A4:A8:5E:97:D2:27:E6:2D:01
ValidityTue, 28 Nov 2023 10:50:41 GMT - Mon, 26 Feb 2024 10:50:40 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: ardentlyexposureflushed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=a24411f8-2200-4811-b4b8-65a258d357d3:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 03 Dec 2023 20:38:15 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
friendshipmale.com/sfp.js
200 OK 86 kB URL GET HTTP/2 friendshipmale.com/sfp.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 5f975910735a981ae82e283b2fd7e124
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sun, 03 Dec 2023 20:38:13 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ZpCdpqGHCBxlw9wQHlPTw7u9xKrPEsD2kMna78WVPrOBztY9wqliOWTMLoRUoXqo75lc7Iv6EDo%2FRITpA32HUKQmGKZVO5KwOhVdSJkneP6u6hswkSdbfM7T566EPhDXL6%2BYM4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cad38afb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.15.19
200 OK 318 B URL GET HTTP/2 notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.15.19
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectnotix.io
Fingerprint68:78:0C:AA:A6:75:6F:E2:65:2D:3B:7E:5B:8A:2B:6B:F6:1A:BF:1D
ValidityFri, 15 Sep 2023 11:38:16 GMT - Thu, 14 Dec 2023 11:38:15 GMT
File type troff or preprocessor input, ASCII text, with very long lines (358), with no line terminators
Hash e4eca3944e50640b652edd2758160079
d5f785a8effb3fb04a6af6c42365da013afe6cef
6298b3913a578c409d9d2b5e256d762cf77761aa4703b1c8b32e0f5b99a1baa0
GET /settings?appId=1004ce02062614f98c25893fe046136&ver=0.15.19 HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://628811.flowhot.cc/
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: application/json; charset=utf-8
content-length: 318
access-control-allow-origin: https://628811.flowhot.cc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
628811.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
200 OK 1.2 kB URL GET HTTP/3 628811.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document, ASCII text, with very long lines (1271), with no line terminators
Hash 40d981045a7516cdadd00e8dccc9c58d
8b8d9a48c6b9d2fba596034ef5db3dd0f2f781c3
71c7d5fc630ff38080f71945be1e8b0c43140d8c25338056b752495e18739c0c
GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: 628811.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: application/javascript
last-modified: Tue, 28 Nov 2023 16:06:21 GMT
etag: W/"65660ffd-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yEa%2FnW2NuSWAnX0gz6C%2FpMtTqWgHc5ydfNFqTsHTteSuKRTCawe0h5zufhoPq8miGeyV83edIJ3G9%2BjZBKy%2F6gLhyd0QQvDZWRN198NDAqOez0NwI3f26uuSpv%2FO6dJUq%2BxIIA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9ca76fedb4f7-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Tue, 05 Dec 2023 20:38:12 GMT
cache-control: max-age=172800, public
content-encoding: gzip
628811.flowhot.cc/favicon.ico
404 Not Found 1.3 kB URL GET HTTP/3 628811.flowhot.cc/favicon.ico
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1336), with no line terminators
Hash f524e65bd054ef4645f2613feecd62ba
8f40c58021af38e48ca8cf873f8fc33016b8191f
519829523d799cdcf97fc3e589c7b8c0d21316df097951cf4108b95ff0a037cc
GET /favicon.ico HTTP/1.1
Host: 628811.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1701635898.1.0.1701635898.0.0.0; _ga=GA1.1.1172294257.1701635898; dom3ic8zudi28v8lr6fgphwffqoz0j6c=a24411f8-2200-4811-b4b8-65a258d357d3%3A1%3A1; sb_main_0633569b5e7b7ced877cf02d43663712=1; sb_count_0633569b5e7b7ced877cf02d43663712=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=ardentlyexposureflushed.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tefzEqG00E8aAuQoAYnurH%2BEgFjnUuwezBU%2FyvjyV8KLsunM%2FqyvV6SZi9lw9GVGNINl%2B9CrKFzCcmJMHcPNMbh0PPvBiw3tw9mcoFi1kqqAjaqcZD2rI66eLLvIHZKy2n7%2Bwg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb3b958b4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
200 OK 31 kB URL GET HTTP/2 maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type ASCII text, with very long lines (30837)
Hash 269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 18:48:06
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 9e61a4e37a75208649ae6b63a0cb4f72
cdn-cache: HIT
cf-cache-status: HIT
age: 576162
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82fe9ca7db2956c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/css/animate.css
200 OK 79 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/css/animate.css
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
Hash e1d8acd5ee9d1a90ea09313cbd8f2b02
8a8327b115d1356715e63270d1ce6d46124c7b1a
3028c87fc798ac3741f02079034e6c23462afc0c5e6c8d321188ce3716c8472a
GET /sb/ssp/vpn/classic-push/big1/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: text/css
last-modified: Mon, 21 Feb 2022 10:06:42 GMT
etag: W/"62136432-13591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vvKaTf%2FW0zpEeawiGIvJEuxd%2Fj8Fmw1%2BvVIQ7SNrbSEexznR7ac4ZJAGIoekFohqwyLT2J3zN47eYwXIIw%2BHncYG%2BSEk6N8SCgMrA%2FLrSWSB%2FbV7bdXJZgSiwp0IFDS82jiS%2FXbvdVkJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb4697423ae-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
flowhot.cc/wp-content/themes/flowhot/style.css?ver=1701635539
200 OK 20 kB URL GET HTTP/3 flowhot.cc/wp-content/themes/flowhot/style.css?ver=1701635539
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with very long lines (4468)
Hash 4c1717ce0a000bdbf8af2b620be2b465
9398d9ac4a1f37374cc187f5a1e3d6dc69f2a208
25f469c98011ebbf04fe876c4a5732b88c74bf48dfc6b03f8fa7d68b34657404
GET /wp-content/themes/flowhot/style.css?ver=1701635539 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Tue, 02 Jan 2024 20:38:12 GMT
last-modified: Fri, 19 Jun 2020 18:37:30 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rs%2FbXKmoMF8mb6O7PRQgj0Hc7RcKtJnGMhoe9Y7roMYCVyf%2Bo7iZhGzW63fFZJBhS%2BjYQyA%2Ba8kecSQTLTKKiLB8vOoToOka2Tr0aWJffELBoH56cF4pE12K4YNC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82fe9ca78811b4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
friendshipmale.com/sfp.js
200 OK 86 kB URL GET HTTP/3 friendshipmale.com/sfp.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: a97da82ea59eb9f3cfbcc118d16c40cc
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sun, 03 Dec 2023 20:38:13 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3tcExduovlVCgXpzsEkfz1wEaIzmhVPkIh7XsB3so%2BeHRbXnRZqJcQqWL9bdZVrxmNIHYAUp6bAhcXBxGhe5xZHrwa6kYpfQMKkx%2B8r95eXQ7PLAZz6q82uRQ00DNbUWzX0U%2FAg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9cb0fb24568b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
628811.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js
200 OK 6.4 kB URL GET HTTP/3 628811.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with very long lines (6543), with no line terminators
Hash e3adfa7305baa9b772b751a386ab07cb
dd4ca881327917117a02882f9cb9bd10d3afb859
3840f06ccbae438e3bff75651db3d99affb440fb3932e69036da9290317815ef
GET /cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js HTTP/1.1
Host: 628811.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 03 Dec 2023 20:38:12 GMT
content-type: application/javascript; charset=utf-8
x-amz-id-2: i6VbcpnnVqbgWl/HvRWsTJJBSkFMKPke1txDzZMqUPhXfuGbO2mFjtX0wl5n15Cw1bO74NZ7I7Q=
x-amz-request-id: 8TXCHC158DJSVBGC
cache-control: public, max-age=31536000
last-modified: Wed, 11 Dec 2019 13:31:58 GMT
x-amz-version-id: ESUrlvQQwNmPgiI2n2eMDNt6te85sX_N
etag: W/"ceb291a94a4e29bc8fe20512e46d29e3"
cf-cache-status: HIT
age: 661903
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=toWgT78aUUPtI7FoenwDZMJ4tvoQiJJDextxZ0OkIPwfq52jfyNy%2FfXt2n1Hzj6nNc1%2FRgqau5gLzdHZZBdeLYwBO%2BTCNf7LO%2BYadbL%2BrKnO6yW1nLqVzySz%2F%2BV0OSuUCRNa8A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82fe9ca74fbdb4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
200 OK 6.8 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (7013), with no line terminators
Hash 49475c425d6c00477bb339179326c49b
bd97deeb753f44f43a21feafa92d98239fa511bd
598841a98ad357d2896d2f093ea3e4e1d44e24b3351268ffd45e61ff8c1d0e09
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 03 Dec 2023 20:38:14 GMT
date: Sun, 03 Dec 2023 20:38:14 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
200 OK 532 kB URL User Request GET HTTP/2 IP
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
Size 532 kB (531922 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: 628811.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:11 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-litespeed-cache: hit
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2B4Xxm8uCNKdcpLMxoDPIrvnfUlnakQxkF7PBNS7hoE2005CRilXs7LzwzlRXk5HZVPoVmmw3UiuQZfJw0fH2jiAmv0bS%2F%2FX1MFdtjcEUwL9ACE9cphtRpWCYdebtvxEvZ4QtQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82fe9ca3ea20b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
notix.io/ent/current/enot.min.js
200 OK 145 kB URL GET HTTP/2 notix.io/ent/current/enot.min.js
IP
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectnotix.io
Fingerprint68:78:0C:AA:A6:75:6F:E2:65:2D:3B:7E:5B:8A:2B:6B:F6:1A:BF:1D
ValidityFri, 15 Sep 2023 11:38:16 GMT - Thu, 14 Dec 2023 11:38:15 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 145 kB (144887 bytes)
Hash 5ec57c87dbac3f07e59e5d74ae3421e4
70121f1541a1961d7b87544001d612f18ad04243
e1d529afcbb911c99bb039ba39c7fb6716275b97650ae816a90fc03f256542bb
Analyzer Verdict Alert Public Nextron YARA rules malware Unique code from Jetriz, Swid & Jeniva of the Tetris framework
GET /ent/current/enot.min.js HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 03 Dec 2023 20:38:13 GMT
content-type: application/javascript
last-modified: Thu, 30 Nov 2023 09:39:49 GMT
etag: W/"65685865-235f7"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
ardentlyexposureflushed.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=a24411f8-2200-4811-b4b8-65a258d357d3%3A1%3A1
200 OK 6.0 kB URL GET HTTP/1.1 ardentlyexposureflushed.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=a24411f8-2200-4811-b4b8-65a258d357d3%3A1%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectardentlyexposureflushed.com
FingerprintCB:F3:A7:64:D0:55:AE:83:FE:CD:FA:A4:A8:5E:97:D2:27:E6:2D:01
ValidityTue, 28 Nov 2023 10:50:41 GMT - Mon, 26 Feb 2024 10:50:40 GMT
File type ASCII text, with very long lines (6100), with no line terminators
Hash 9aaf433a157d1a54b8538baa2cd876e9
77b5e667e3e25cfffaa203b59e9b45246e586ff1
a8f1dac8bd032dd5b1c77e13c91b01827e899459ca3b3d7b32355e25faaa8e07
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=a24411f8-2200-4811-b4b8-65a258d357d3%3A1%3A1 HTTP/1.1
Host: ardentlyexposureflushed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 03 Dec 2023 20:38:14 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://628811.flowhot.cc
Access-Control-Allow-Origin: https://628811.flowhot.cc
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=19408177; expires=Mon, 04 Dec 2023 20:38:13 GMT; secure; SameSite=None
uid_id2=a24411f8-2200-4811-b4b8-65a258d357d3:1:1; expires=Sun, 10 Dec 2023 20:38:13 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 04 Dec 2023 20:38:14 GMT; secure; SameSite=None
uncs=1; expires=Mon, 04 Dec 2023 20:38:14 GMT; secure; SameSite=None
pdhtkv29=true; expires=Mon, 04 Dec 2023 20:38:14 GMT; secure; SameSite=None
uncs29=1; expires=Mon, 04 Dec 2023 20:38:14 GMT; secure; SameSite=None
slec0633569b5e7b7ced877cf02d43663712=[4766299]; expires=Sun, 03 Dec 2023 20:38:19 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b84017f87ce05d51e389e0b917a378ec
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
cdn.barscreative1.com/sb/au/48/48/eb/4848ebd6f7295875a5d388ec2488aba3/1648542421.html
200 OK 1.5 kB URL GET HTTP/2 cdn.barscreative1.com/sb/au/48/48/eb/4848ebd6f7295875a5d388ec2488aba3/1648542421.html
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://628811.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
Fingerprint55:06:B7:F1:EF:E9:55:FB:7C:8C:4F:5D:DB:05:C9:15:19:90:9B:2F
ValiditySat, 11 Nov 2023 03:00:51 GMT - Fri, 09 Feb 2024 03:00:50 GMT
File type HTML document text\012- HTML document, ASCII text, with very long lines (1639), with no line terminators
Hash 97b357c624104a8e915d01424dfe16ce
6bd7fcedfb7986b149601b1bc840f525b67a8f06
8d010e7163298acf3671bb429a2e0b1d69033a5adc314fa4bddebf74b9775e6e
GET /sb/au/48/48/eb/4848ebd6f7295875a5d388ec2488aba3/1648542421.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://628811.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://628811.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 20:38:14 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Tue, 29 Mar 2022 08:27:10 GMT
etag: W/"6242c2de-602"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Sun, 03 Dec 2023 21:38:14 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
188.114.96.1
142.250.74.168
18.184.210.76
104.18.10.207
139.45.240.92
0.0.0.0