yptvuuxm.ga/
200 OK 9.6 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6441), with CRLF line terminators
Hash 99abdaa92359b3fcf73c4084a8621f92
ce552e8db786e04df027f4260dd8a0ca969035d2
b9b2d8ae69a31d59e89f3777057b47c9f3cac8df2c6d76cba43d3f1e50e1598c
GET / HTTP/1.1
Host: yptvuuxm.ga
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Thu, 01 Dec 2022 19:58:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.8
Set-Cookie: ab_referer=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HV24rWBe6C%2Fk9kEJAYpg3Ycevxl7Cob6FPbdcmPK0VM%2FRpcVWqDrLJmdP6y4DP3mDMMA05tYTlmnMDkFZXSVd%2Fp9mRZW7cw89PaqLFzdevZFo5ZjWc9n1wdtwgKPog%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 772e65d4cc82b52d-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6114
Expires: Thu, 01 Dec 2022 21:40:22 GMT
Date: Thu, 01 Dec 2022 19:58:28 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 0c748388899e8a8d3680355da2ea5020
903c620cd137613daafb0da0508c37b2f4a67212
39eab80e022a9a1732872d9926b0ace80f818ec5c535e36a18b539ea63786fb2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3990
Cache-Control: max-age=142754
Content-Type: application/ocsp-response
Date: Thu, 01 Dec 2022 19:58:28 GMT
Etag: "63888270-1d7"
Expires: Sat, 03 Dec 2022 11:37:42 GMT
Last-Modified: Thu, 01 Dec 2022 10:31:12 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12638
Expires: Thu, 01 Dec 2022 23:29:06 GMT
Date: Thu, 01 Dec 2022 19:58:28 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Type, Backoff, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 01 Dec 2022 19:18:09 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2419
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: z9bNKaEZdnO962G3YWBmepAB3j3ICAU++xzpDyLTyUkC37L9K3XzoAi/jbx+D5gUOp2NKCEICyE=
x-amz-request-id: 9N8VZ5FA585D45KP
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 01 Dec 2022 19:46:25 GMT
age: 723
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 19:58:28 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
js.nextpsh.top/ps/ps.js?id=IZHcyCrhjkOKznBjgse6eQ
200 OK 82 B URL HTTP/2 js.nextpsh.top/ps/ps.js?id=IZHcyCrhjkOKznBjgse6eQ
IP
ASN #35277 Llhost Inc. Srl
File type ASCII text, with no line terminators
Hash 26b99d58eb44fb5bf51098b005b728db
dbad6dd9d473fe2836e2abeaa30b5590ce233602
f41597e9109254c277334ce27b4dd5a1b823f2b988b602f3295fc2e8cdfd54a3
Analyzer Verdict Alert quad9 Sinkholed
GET /ps/ps.js?id=IZHcyCrhjkOKznBjgse6eQ HTTP/1.1
Host: js.nextpsh.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript
content-length: 82
set-cookie: __psu=21fb95e9-a484-4f18-9fce-4b726b765b6d; expires=Sun, 01 Dec 2024 19:58:29 GMT; path=/; secure; samesite=none
cache-control: max-age=0, no-cache, no-store, must-revalidate
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 64c3a847b2d3f2b52e55a00976ee9fc6
7aff94d81280d1cc7773d95dda7af31626af7a5b
1fd0c385a4202c4aa8d8e222d9f74ec12b9bb8f1453566182f0cb66cf17dad0b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1FD0C385A4202C4AA8D8E222D9F74EC12B9BB8F1453566182F0CB66CF17DAD0B"
Last-Modified: Thu, 01 Dec 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8701
Expires: Thu, 01 Dec 2022 22:23:30 GMT
Date: Thu, 01 Dec 2022 19:58:29 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 01 Dec 2022 19:08:56 GMT
cache-control: public,max-age=3600
age: 2973
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
136ffb81df.df253f3b96.com/37045ca0347ab2015c7cee6da8efb990/43957?version_name=c
200 OK 1.4 kB URL HTTP/2 136ffb81df.df253f3b96.com/37045ca0347ab2015c7cee6da8efb990/43957?version_name=c
IP
ASN #39572 DataWeb Global Group B.V.
File type JSON data\012- , ASCII text, with very long lines (1426), with no line terminators
Hash ce47aa7bed6e49b8cb7e36305dbf45e7
3a67f166733260329e2179bf3818e01b386df3f9
02ff9b0e3ec6ca6a77680bb4a4dfebfdfd675ab4b364e1f6162f1a1e282e4006
Analyzer Verdict Alert quad9 Sinkholed
GET /37045ca0347ab2015c7cee6da8efb990/43957?version_name=c HTTP/1.1
Host: 136ffb81df.df253f3b96.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://yptvuuxm.ga
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/json
content-length: 1426
server: nginx/1.18.0
cache-control: max-age=300
expires: Thu, 01 Dec 2022 20:03:29 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f4c94bde9a76bc603150ea8268ef5257
a0bcd3dea7384a387d0d984b99cb5b7b60cdaa84
8ce45b3fdf78e48cf77bb7ed8499a37df26b30827aa2919c061561e28209ef4c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8CE45B3FDF78E48CF77BB7ED8499A37DF26B30827AA2919C061561E28209EF4C"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8035
Expires: Thu, 01 Dec 2022 22:12:24 GMT
Date: Thu, 01 Dec 2022 19:58:29 GMT
Connection: keep-alive
js.wpadmngr.com/npc/sdk/wp-banners.js
200 OK 0 B URL HTTP/2 js.wpadmngr.com/npc/sdk/wp-banners.js
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /npc/sdk/wp-banners.js HTTP/1.1
Host: js.wpadmngr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
server: nginx/1.18.0
last-modified: Fri, 20 Aug 2021 15:14:31 GMT
etag: "611fc6d7-0"
expires: Thu, 01 Dec 2022 20:03:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 1f88399f3fdd89dbb9ca1229cb67143a
325c9dbfd932cf9a6fb9fab2dd8e27083f55a9a3
831ecd45dcd2d5ae2ae86cd63ea5e94ecd85281b7e51054af5df9a6386fb8d79
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3982
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 01 Dec 2022 19:58:29 GMT
Last-Modified: Thu, 01 Dec 2022 18:52:07 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
136ffb81df.df253f3b96.com/7e585fc69b6211d91e6b0ff2ed823070.js
200 OK 74 kB URL HTTP/2 136ffb81df.df253f3b96.com/7e585fc69b6211d91e6b0ff2ed823070.js
IP
ASN #39572 DataWeb Global Group B.V.
Hash 35e75ceae4abac1d54ad2c31af6ad18f
30af285ba70e83a6c22ff06806860983170ce212
8529c4c5bebef54eb1f22b355d896839aa57bd2d17413a1589212c4cdf8df6fa
Analyzer Verdict Alert quad9 Sinkholed
GET /7e585fc69b6211d91e6b0ff2ed823070.js HTTP/1.1
Host: 136ffb81df.df253f3b96.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Tue, 22 Nov 2022 16:27:58 GMT
etag: W/"637cf88e-48777"
content-encoding: gzip
expires: Thu, 01 Dec 2022 20:03:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
js.wpshsdk.com/npc/sdk/push.m.js?v=1
200 OK 26 kB URL HTTP/2 js.wpshsdk.com/npc/sdk/push.m.js?v=1
IP
ASN #39572 DataWeb Global Group B.V.
Hash 634bd03dac0eafa0af9aa844d1944f30
88192d8a40b2c8e915743a11606912e03598fac4
39cc4bf8980fef71d74019de750e8bbe7f2da1159e3cd4f050ace2853ad93f33
GET /npc/sdk/push.m.js?v=1 HTTP/1.1
Host: js.wpshsdk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Fri, 25 Nov 2022 14:22:37 GMT
etag: W/"6380cfad-f33b"
content-encoding: gzip
expires: Thu, 01 Dec 2022 20:03:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
js.wpshsdk.com/npc/sdk/wp-banners.js
200 OK 0 B URL HTTP/2 js.wpshsdk.com/npc/sdk/wp-banners.js
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /npc/sdk/wp-banners.js HTTP/1.1
Host: js.wpshsdk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
server: nginx/1.18.0
last-modified: Fri, 20 Aug 2021 15:14:31 GMT
etag: "611fc6d7-0"
expires: Thu, 01 Dec 2022 20:03:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
82f7858b81.bac23cfb5b.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxMDcyNzg3NDYxNzc0NzM2NDAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIzLjE3LjMiLCJ0YWdfaWQiOjQzOTU3LCJzY3JlZW5fcmVzb2x1dGlvbiI6IjEyODB4MTAyNCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiVVRDIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjAuMjcsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IkxvYWRpbmcuLi4lMjAifQ==
200 OK 0 B URL HTTP/2 82f7858b81.bac23cfb5b.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxMDcyNzg3NDYxNzc0NzM2NDAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIzLjE3LjMiLCJ0YWdfaWQiOjQzOTU3LCJzY3JlZW5fcmVzb2x1dGlvbiI6IjEyODB4MTAyNCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiVVRDIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjAuMjcsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IkxvYWRpbmcuLi4lMjAifQ==
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxMDcyNzg3NDYxNzc0NzM2NDAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIzLjE3LjMiLCJ0YWdfaWQiOjQzOTU3LCJzY3JlZW5fcmVzb2x1dGlvbiI6IjEyODB4MTAyNCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiVVRDIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjAuMjcsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IkxvYWRpbmcuLi4lMjAifQ== HTTP/1.1
Host: 82f7858b81.bac23cfb5b.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://yptvuuxm.ga
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-length: 0
server: nginx/1.18.0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b65f5b76302d9f5707810bd6dd27ebf3
370c7bc18d4f7cb6a635c7165a6c0c4ed0ad88e1
317b6753a9c731cdf4dbf82283c3292567332be88e52429ca754001d2745d49f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "317B6753A9C731CDF4DBF82283C3292567332BE88E52429CA754001D2745D49F"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5996
Expires: Thu, 01 Dec 2022 21:38:25 GMT
Date: Thu, 01 Dec 2022 19:58:29 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Sky72iFuOjgJZqHTCLtJng==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 4twPxmAS0L/1s2SpUHjql+Pjk/o=
fp.metricswpsh.com/fp?tag_id=43957
204 No Content 0 B URL HTTP/1.1 fp.metricswpsh.com/fp?tag_id=43957
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /fp?tag_id=43957 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://yptvuuxm.ga/
Origin: http://yptvuuxm.ga
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Server: nginx/1.20.1
Date: Thu, 01 Dec 2022 19:58:30 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: http://yptvuuxm.ga
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
nereserv.com/in/dip?site=native-push&wl=0&event_id=eeb830e3-90d1-431b-8bf0-e7e671e9813c&subid=416473681&sid=836725167&spot_id=26103&created_at=2022-12-01&timezone=0&ver=8.5.1&is_native=1
200 OK 0 B URL HTTP/2 nereserv.com/in/dip?site=native-push&wl=0&event_id=eeb830e3-90d1-431b-8bf0-e7e671e9813c&subid=416473681&sid=836725167&spot_id=26103&created_at=2022-12-01&timezone=0&ver=8.5.1&is_native=1
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/dip?site=native-push&wl=0&event_id=eeb830e3-90d1-431b-8bf0-e7e671e9813c&subid=416473681&sid=836725167&spot_id=26103&created_at=2022-12-01&timezone=0&ver=8.5.1&is_native=1 HTTP/1.1
Host: nereserv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://yptvuuxm.ga
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 01 Dec 2022 19:58:29 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fbfabc72b2da2c37647a66daed740bb0
a8f4424d2d746e7fde143a264a7dafa86ae24a88
2c3dd235a890aa5d7ecf5d1f2f4fc1d2f3d3c004d53806bbbd19cc1d1cd2b75f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2C3DD235A890AA5D7ECF5D1F2F4FC1D2F3D3C004D53806BBBD19CC1D1CD2B75F"
Last-Modified: Thu, 01 Dec 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16166
Expires: Fri, 02 Dec 2022 00:27:56 GMT
Date: Thu, 01 Dec 2022 19:58:30 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fbfabc72b2da2c37647a66daed740bb0
a8f4424d2d746e7fde143a264a7dafa86ae24a88
2c3dd235a890aa5d7ecf5d1f2f4fc1d2f3d3c004d53806bbbd19cc1d1cd2b75f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2C3DD235A890AA5D7ECF5D1F2F4FC1D2F3D3C004D53806BBBD19CC1D1CD2B75F"
Last-Modified: Thu, 01 Dec 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16166
Expires: Fri, 02 Dec 2022 00:27:56 GMT
Date: Thu, 01 Dec 2022 19:58:30 GMT
Connection: keep-alive
136ffb81df.df253f3b96.com/fcd57d307ea6fbb23204b1c51f4041fc.js
200 OK 27 kB URL HTTP/2 136ffb81df.df253f3b96.com/fcd57d307ea6fbb23204b1c51f4041fc.js
IP
ASN #39572 DataWeb Global Group B.V.
File type Unicode text, UTF-8 text, with very long lines (65464)
Hash 3853627db8978712db7773e4aad203c7
ea62fce290963a2f03be07620d741b8f207764db
fafc75ec5eb840dec3c460b8d5c8140f968906ac913e731cd89bf32beb5d443a
Analyzer Verdict Alert quad9 Sinkholed
GET /fcd57d307ea6fbb23204b1c51f4041fc.js HTTP/1.1
Host: 136ffb81df.df253f3b96.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Thu, 13 Oct 2022 09:19:10 GMT
etag: W/"6347d80e-16007"
content-encoding: gzip
expires: Thu, 01 Dec 2022 20:03:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
fp.metricswpsh.com/fp?tag_id=43957
200 OK 28 B URL HTTP/1.1 fp.metricswpsh.com/fp?tag_id=43957
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text
Hash e3af49472d683a217237a6ebaf79bcb7
378db4d7e6171a2676ee15c80b4475d7f5ec9742
7714898d715fb8b1ce7a1de73e0e7c9f6394acc8a08cf1a3b342a7829d4de84a
POST /fp?tag_id=43957 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 22286
Origin: http://yptvuuxm.ga
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Thu, 01 Dec 2022 19:58:30 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 28
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://yptvuuxm.ga
Set-Cookie: id=18200460750163279339; Expires=Fri, 01 Dec 2023 19:58:30 GMT; Secure; SameSite=None
Vary: Origin
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2158
Expires: Thu, 01 Dec 2022 20:34:29 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2158
Expires: Thu, 01 Dec 2022 20:34:29 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2158
Expires: Thu, 01 Dec 2022 20:34:29 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2158
Expires: Thu, 01 Dec 2022 20:34:29 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2158
Expires: Thu, 01 Dec 2022 20:34:29 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F600016d1-5abb-4a6c-996a-933a8d4bc6df.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F600016d1-5abb-4a6c-996a-933a8d4bc6df.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 26d6dffbf400da4803a2e76e2a8ef2f8
2e62f9ed8f5e7b2f888a73320dd98b0cda9303b8
04c6e31623fe48cbe83dc91635bfa47b337590f18919995b08d5bde27e929e03
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F600016d1-5abb-4a6c-996a-933a8d4bc6df.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8740
x-amzn-requestid: 4823cf63-98eb-40d3-bb8b-e09cd2262f36
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cP7SqHjYIAMF8xw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63830c10-316b213c33ce9bc2355c0900;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 07:04:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: tK4wl-g5kcUhVFE3iZGILhZhZSsaMzQD9JTBHj1JXV95yXs_e3gMGw==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 12:31:43 GMT
age: 26808
etag: "2e62f9ed8f5e7b2f888a73320dd98b0cda9303b8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F83cd87b8-4041-419b-ab34-9f8e5a326f4b.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F83cd87b8-4041-419b-ab34-9f8e5a326f4b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 820cf89fcab8380adff42982c9fb11ed
84241ddddbbfd7de30118307fb1a62800d0a4cb3
0d051495f06ac84de934283b40cbfee7a042d32153a73486dd7c017430e882d8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F83cd87b8-4041-419b-ab34-9f8e5a326f4b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12898
x-amzn-requestid: 9b594c3c-6b8c-4589-8fcb-b3d7518b46f6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cQZBNFxToAMF_9A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63833ba1-767f510d72eef86d0cc892df;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 10:27:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: gsn5uUFEzDZDOMPTvW9UQxtccvRfJKUM4eJ8U99jvUGzNIKkF9SzeA==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:49:20 GMT
age: 79751
etag: "84241ddddbbfd7de30118307fb1a62800d0a4cb3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg
200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e1e6b6ba4f82221b41c3d9129008c76d
2f9532d698b4c28df23e18bbb66399ec776d5b9f
218c6f41a16e6087c611d4db5784a7cc1d027084d0bf2bd6dc3843ee5dfd560f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9459
x-amzn-requestid: c08f55b2-7ac6-4dec-b53c-fd3f4533f9c9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cMpBiGoHIAMFR2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381bba3-69c2c2d05e55fd745caf1dce;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 07:09:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: w_Mb-0pBwp-pUyU2bdJ8MhrGHkk6VQgJmcGV9MfHwj_yGUMIYZkyrg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 10:48:24 GMT
age: 33007
etag: "2f9532d698b4c28df23e18bbb66399ec776d5b9f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb53953-3f6b-43ee-95d9-fb65d133745f.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb53953-3f6b-43ee-95d9-fb65d133745f.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 328ce221bcf3442f88d09373193ff594
63bfa2ea925aa2c188c664a7bf7af7b0e5417e60
21d5b5ec267430dba91b17f89a557aca5cd2a21535da18eb02ec69ed0e1b7371
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb53953-3f6b-43ee-95d9-fb65d133745f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13411
x-amzn-requestid: 17fcc4e1-76c1-4eca-9235-c1a513bca24a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cbz80FCQoAMFs1A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387cd1e-26da4f265d74215f31425eb9;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:37:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: MttRByNp1C1ZeFFicFVa0w3XRyXJnUycPy2Izk8hzGEgXGdDqD3L3A==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:48:17 GMT
age: 79814
etag: "63bfa2ea925aa2c188c664a7bf7af7b0e5417e60"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0e1339e-3c63-4033-8b5b-e21137509777.jpeg
200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0e1339e-3c63-4033-8b5b-e21137509777.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ffd12f9c423ffc627d9e3b3145944fe4
5cf9a7a784952e1bb0cbe499104f1774b1269d08
a25f1b752d9af599aefd73073c105853130f1759905269de3d582d2eb35fe167
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0e1339e-3c63-4033-8b5b-e21137509777.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 16038
x-amzn-requestid: 9d34c42b-ba0c-498f-8f99-d4ab527ffa89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cbzMdHXNIAMFgaw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387cbe9-376846f31dc9b995797cbd18;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:32:25 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: DngCuOTO9fQAwWe_ip6EtBcgruigZN6Bl1_v5BHM2dsWlhqCXCL3gg==
via: 1.1 efcf7b9d0f917f9ebf314db03e52d9b6.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:45:33 GMT
age: 79978
etag: "5cf9a7a784952e1bb0cbe499104f1774b1269d08"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F051e025a-c892-4a7d-8a1d-95f6d77ebb3c.jpeg
200 OK 4.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F051e025a-c892-4a7d-8a1d-95f6d77ebb3c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d2dd5a4bcfd47db8f38544bf39ce3031
fa2217bae05b7beca2e12597eaad835298276b82
3266004f5e73af5359b71622eea31f1e28abb4bbc443b5f9e481b5a8b2e9249e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F051e025a-c892-4a7d-8a1d-95f6d77ebb3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4762
x-amzn-requestid: b7c0e28a-de0d-443d-8bf4-900a964bf110
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cP7uSFcMoAMF2CQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63830cc1-7abade3a670201cf1906b79f;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 07:07:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: gZSkafSw8cXo9AChLOTVJW7r_hHLW8kaHlA-ED2_zFJwuUk1uS3VRw==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 13:29:36 GMT
age: 23335
etag: "fa2217bae05b7beca2e12597eaad835298276b82"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
02f3427bf4.bac23cfb5b.com/in/multy
200 OK 17 kB URL HTTP/2 02f3427bf4.bac23cfb5b.com/in/multy
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (17392), with no line terminators
Hash 3a384e2872c134c57e7ef31c2c33cda8
0d85e9176b864483fc85db94b6a3a33b022a12e1
7099ef7c9d13bdbfa4fdbf77bc0bdbc0183a86ba55f4f0730453e382371a7be6
POST /in/multy HTTP/1.1
Host: 02f3427bf4.bac23cfb5b.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 697
Origin: http://yptvuuxm.ga
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 01 Dec 2022 19:58:31 GMT
content-type: application/json
content-length: 17395
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
02f3427bf4.bac23cfb5b.com/in/show/?mid=2959830145807337605&pid=0&site=native-push-mainstream&sc=NO&usage_type=DCH&subid=416473681&sid=836725167&cid=12654&price=0.00046899999999999996&is_cpm=0&cpm=0&ecpm=0.0006333320829738549&crid=&crtid=41e2b054b7d7fdd561f6651d06d511e5&tcid=0&out_id=1&ver=8.5.1&ver_c=&refdom=yptvuuxm.ga&hostname=auc-inpage-hz-3-a&site_id=3126103&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=2022-12-01&is_native=2&auction_queue=0&burl=qQ45UL0G__sIoQD1HVPU1-SJanOSbBWIjk4HaGPUr_AjbJQHQf-DLw&pop_winurl=&ip=91.90.42.154&testab=0&px_id=5326103&adblock=0&auction_host=&mm=0&yc=0&render_type=mq&campaign_type=lq-pop&uniq=&exp=&resp_type=&iabcat=IAB24-24&min_cpm=9.675632994485913e-05&placement_type_id=&skin_test=0&verify_hash=c0bbe8669b266d203b9802fe04728d6a&score=57.8479437229132&durl=https%3A%2F%2Fts.cvastico.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttp%253A%252F%252Fyptvuuxm.ga%252F%26idzone%3D0%26sid%3D1885&ml=&tag_ab=c&original_bid=0.00046899999999999996&user_fp=0&v2_track=0&url=g-DGZAevBAUVsZWlP3p27gFCLSIvjAmKWW8J58EjYyCd4hFVX6XyEju4X2XBksYHgoWjkD05h25Lh9VWGN3-GVxythQyfZw5ki7gVoB06VDwbJgOapYr0fnfDP64UdofI_XpZembiDUnW9VemmAFPjqkFP69o9APKbQXuPttxOdUOH_I2A&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FIN%2FIN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp&skin_id=2&vertical_id=0&real_bid=0.00046899999999999996&pr=&user_keywords=&auc_type=1&aid=471&ext_cid=0&device_theme=light&keywords=&label_ids=83,89,0&mlc=1&format=default-slide-b_r-body&mlf=1&cpa=3becbd32-f354-49d4-9624-a669f98fe387
302 Found 0 B URL HTTP/2 02f3427bf4.bac23cfb5b.com/in/show/?mid=2959830145807337605&pid=0&site=native-push-mainstream&sc=NO&usage_type=DCH&subid=416473681&sid=836725167&cid=12654&price=0.00046899999999999996&is_cpm=0&cpm=0&ecpm=0.0006333320829738549&crid=&crtid=41e2b054b7d7fdd561f6651d06d511e5&tcid=0&out_id=1&ver=8.5.1&ver_c=&refdom=yptvuuxm.ga&hostname=auc-inpage-hz-3-a&site_id=3126103&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=2022-12-01&is_native=2&auction_queue=0&burl=qQ45UL0G__sIoQD1HVPU1-SJanOSbBWIjk4HaGPUr_AjbJQHQf-DLw&pop_winurl=&ip=91.90.42.154&testab=0&px_id=5326103&adblock=0&auction_host=&mm=0&yc=0&render_type=mq&campaign_type=lq-pop&uniq=&exp=&resp_type=&iabcat=IAB24-24&min_cpm=9.675632994485913e-05&placement_type_id=&skin_test=0&verify_hash=c0bbe8669b266d203b9802fe04728d6a&score=57.8479437229132&durl=https%3A%2F%2Fts.cvastico.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttp%253A%252F%252Fyptvuuxm.ga%252F%26idzone%3D0%26sid%3D1885&ml=&tag_ab=c&original_bid=0.00046899999999999996&user_fp=0&v2_track=0&url=g-DGZAevBAUVsZWlP3p27gFCLSIvjAmKWW8J58EjYyCd4hFVX6XyEju4X2XBksYHgoWjkD05h25Lh9VWGN3-GVxythQyfZw5ki7gVoB06VDwbJgOapYr0fnfDP64UdofI_XpZembiDUnW9VemmAFPjqkFP69o9APKbQXuPttxOdUOH_I2A&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FIN%2FIN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp&skin_id=2&vertical_id=0&real_bid=0.00046899999999999996&pr=&user_keywords=&auc_type=1&aid=471&ext_cid=0&device_theme=light&keywords=&label_ids=83,89,0&mlc=1&format=default-slide-b_r-body&mlf=1&cpa=3becbd32-f354-49d4-9624-a669f98fe387
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/show/?mid=2959830145807337605&pid=0&site=native-push-mainstream&sc=NO&usage_type=DCH&subid=416473681&sid=836725167&cid=12654&price=0.00046899999999999996&is_cpm=0&cpm=0&ecpm=0.0006333320829738549&crid=&crtid=41e2b054b7d7fdd561f6651d06d511e5&tcid=0&out_id=1&ver=8.5.1&ver_c=&refdom=yptvuuxm.ga&hostname=auc-inpage-hz-3-a&site_id=3126103&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=2022-12-01&is_native=2&auction_queue=0&burl=qQ45UL0G__sIoQD1HVPU1-SJanOSbBWIjk4HaGPUr_AjbJQHQf-DLw&pop_winurl=&ip=91.90.42.154&testab=0&px_id=5326103&adblock=0&auction_host=&mm=0&yc=0&render_type=mq&campaign_type=lq-pop&uniq=&exp=&resp_type=&iabcat=IAB24-24&min_cpm=9.675632994485913e-05&placement_type_id=&skin_test=0&verify_hash=c0bbe8669b266d203b9802fe04728d6a&score=57.8479437229132&durl=https%3A%2F%2Fts.cvastico.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttp%253A%252F%252Fyptvuuxm.ga%252F%26idzone%3D0%26sid%3D1885&ml=&tag_ab=c&original_bid=0.00046899999999999996&user_fp=0&v2_track=0&url=g-DGZAevBAUVsZWlP3p27gFCLSIvjAmKWW8J58EjYyCd4hFVX6XyEju4X2XBksYHgoWjkD05h25Lh9VWGN3-GVxythQyfZw5ki7gVoB06VDwbJgOapYr0fnfDP64UdofI_XpZembiDUnW9VemmAFPjqkFP69o9APKbQXuPttxOdUOH_I2A&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FIN%2FIN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp&skin_id=2&vertical_id=0&real_bid=0.00046899999999999996&pr=&user_keywords=&auc_type=1&aid=471&ext_cid=0&device_theme=light&keywords=&label_ids=83,89,0&mlc=1&format=default-slide-b_r-body&mlf=1&cpa=3becbd32-f354-49d4-9624-a669f98fe387 HTTP/1.1
Host: 02f3427bf4.bac23cfb5b.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
server: nginx/1.20.1
date: Thu, 01 Dec 2022 19:58:31 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
location: https://static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
X-Firefox-Spdy: h2
02f3427bf4.bac23cfb5b.com/in/show/?mid=2959830145807337605&pid=0&site=native-push-mainstream&sc=NO&usage_type=DCH&subid=416473681&sid=836725167&cid=13061&price=0.01675000024959445&is_cpm=0&cpm=0&ecpm=0.007004310449199944&crid=5713643&crtid=1c81c2cc33a9d6c8cd6172aeefa0077e&tcid=0&out_id=0&ver=8.5.1&ver_c=&refdom=yptvuuxm.ga&hostname=auc-inpage-hz-3-a&site_id=3126103&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=1670011110&created_at=2022-12-01&is_native=1&auction_queue=0&burl=OO-u-5Y7fWRk_NYcw-QGgQBocmUkWZG1wZWLlMieud6Vj-EjGfRqOw&pop_winurl=&ip=91.90.42.154&testab=0&px_id=3126103&adblock=0&auction_host=&mm=0&yc=0&render_type=mq&campaign_type=mq&uniq=&exp=&resp_type=&iabcat=IAB24-24&min_cpm=3.841286562875279e-05&placement_type_id=&skin_test=0&verify_hash=ece9056c7694eb5c076adfceb540482f&score=57.8479437229132&durl=https%3A%2F%2Fts.cvastico.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttp%253A%252F%252Fyptvuuxm.ga%252F%26idzone%3D0%26sid%3D1885&ml=&tag_ab=c&original_bid=0.01675000024959445&user_fp=0&v2_track=0&url=U9flbNW1-mUKmGiMFnyfTIa2hn5VqyNwu1wJS69mclYN5vxUykXy_5DYFM5CutaVZQZ2EzrndwHVi5EeuRv1EwGgm0yYUb7zWbhdOr7SLStBZ7ZWiJDmLqfDV9OgFTNzU9hUdd7j4TQIEt6cNpGDyXtv1dMdJA0uSYqjdD985mHusv9f3BnUMuwKQDJOjXw_7v3eBJamibVW1-X2Gv3oIlvSlbZ2Js-qRnSX7FI5EvN8avIJzFeLb9L0StngirUaaKJ_3cHz9ien5z05spHTr7UTn0loO4TdYumJ_ztkW4p1kLqib0FcxlqNDtLWNodKLvjEoFpx9dcfnjhHVrKEGFPMk_-glXwmmxxHuU00Zt1c7cKjHjjXO5moc3ogNDeMianBJCj1Nu99H5ctK-hwSgiO5Bf9CRstufHs9fINmMkcRAd4dQDYR0mh9FWiwcOdUJfIfNJSkauOCmH1nE0u1fYxOYO7pZFJajjXXXP3GCyfiDLNiU3GQJ5_I2TxiHQ1qdFj96wuXblxNWNRdNwJtd7ZzJE1xiSNISWnIuAS-PIpd3v7mZQ_e8ZH6KjlMdLz0CnmfEnAT-NH4iE8VEOycmZ5tUuFYlRPSnotnaR4qX9sD5FWYnXdRw-8sM3aZeL_bKlMV9RMeXFMM6U8d3i1wF8YLLKtrApOgKF5p20k0lMQ_J9RszJqwFyciffAtnEgzQ0pU1ABMvUJ4M8lYSryMNgA4ye4Iesk9B7Y7LG0zlh2nO7V0g4-pkLe4MUHx4_IxNhupzzSvEdFjjn54LYP4w97oMl25afvJ1eyEq_QaleBFpPsr7C-ff4I9V0GCwKwFponmws5g381EnnUiN2MjnFM5jlogY9e5hODY9bPt6yK-oySqibxirJXJVSGzt0r2mrifflSZb3GsLR8wO1d12AgfOQEhhxBpzlSyEe6_eI4vRNnObRgYzotYh374dI4mSr7521W2kX5Za1NDl5ilxhOYm6smOkJmzB4je7cqVMkXTgrsG7gnYZGr1xMZA0zxT-jJCqx2SIbdwDVGUBJMO9nySmk113sDzFJpyBvWQ4TaDjoH6eldCDvYBY2RSaqalHfUUtksqZJbPMmi6zHCQ&image_url=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F492x328%2Fq85%2Fimage%2Fvk%2F3643%2F643%2Frect_626aadf074621t1651158512r522.png.webp&skin_id=2&vertical_id=0&real_bid=0.013065000194683672&pr=&user_keywords=&auc_type=1&aid=412&ext_cid=0&device_theme=light&keywords=&label_ids=83,96,101,106,0&format=default-slide-b_r-body&cpa=098b4249-5dce-4e58-b293-39831d7fa24e
302 Found 0 B URL HTTP/2 02f3427bf4.bac23cfb5b.com/in/show/?mid=2959830145807337605&pid=0&site=native-push-mainstream&sc=NO&usage_type=DCH&subid=416473681&sid=836725167&cid=13061&price=0.01675000024959445&is_cpm=0&cpm=0&ecpm=0.007004310449199944&crid=5713643&crtid=1c81c2cc33a9d6c8cd6172aeefa0077e&tcid=0&out_id=0&ver=8.5.1&ver_c=&refdom=yptvuuxm.ga&hostname=auc-inpage-hz-3-a&site_id=3126103&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=1670011110&created_at=2022-12-01&is_native=1&auction_queue=0&burl=OO-u-5Y7fWRk_NYcw-QGgQBocmUkWZG1wZWLlMieud6Vj-EjGfRqOw&pop_winurl=&ip=91.90.42.154&testab=0&px_id=3126103&adblock=0&auction_host=&mm=0&yc=0&render_type=mq&campaign_type=mq&uniq=&exp=&resp_type=&iabcat=IAB24-24&min_cpm=3.841286562875279e-05&placement_type_id=&skin_test=0&verify_hash=ece9056c7694eb5c076adfceb540482f&score=57.8479437229132&durl=https%3A%2F%2Fts.cvastico.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttp%253A%252F%252Fyptvuuxm.ga%252F%26idzone%3D0%26sid%3D1885&ml=&tag_ab=c&original_bid=0.01675000024959445&user_fp=0&v2_track=0&url=U9flbNW1-mUKmGiMFnyfTIa2hn5VqyNwu1wJS69mclYN5vxUykXy_5DYFM5CutaVZQZ2EzrndwHVi5EeuRv1EwGgm0yYUb7zWbhdOr7SLStBZ7ZWiJDmLqfDV9OgFTNzU9hUdd7j4TQIEt6cNpGDyXtv1dMdJA0uSYqjdD985mHusv9f3BnUMuwKQDJOjXw_7v3eBJamibVW1-X2Gv3oIlvSlbZ2Js-qRnSX7FI5EvN8avIJzFeLb9L0StngirUaaKJ_3cHz9ien5z05spHTr7UTn0loO4TdYumJ_ztkW4p1kLqib0FcxlqNDtLWNodKLvjEoFpx9dcfnjhHVrKEGFPMk_-glXwmmxxHuU00Zt1c7cKjHjjXO5moc3ogNDeMianBJCj1Nu99H5ctK-hwSgiO5Bf9CRstufHs9fINmMkcRAd4dQDYR0mh9FWiwcOdUJfIfNJSkauOCmH1nE0u1fYxOYO7pZFJajjXXXP3GCyfiDLNiU3GQJ5_I2TxiHQ1qdFj96wuXblxNWNRdNwJtd7ZzJE1xiSNISWnIuAS-PIpd3v7mZQ_e8ZH6KjlMdLz0CnmfEnAT-NH4iE8VEOycmZ5tUuFYlRPSnotnaR4qX9sD5FWYnXdRw-8sM3aZeL_bKlMV9RMeXFMM6U8d3i1wF8YLLKtrApOgKF5p20k0lMQ_J9RszJqwFyciffAtnEgzQ0pU1ABMvUJ4M8lYSryMNgA4ye4Iesk9B7Y7LG0zlh2nO7V0g4-pkLe4MUHx4_IxNhupzzSvEdFjjn54LYP4w97oMl25afvJ1eyEq_QaleBFpPsr7C-ff4I9V0GCwKwFponmws5g381EnnUiN2MjnFM5jlogY9e5hODY9bPt6yK-oySqibxirJXJVSGzt0r2mrifflSZb3GsLR8wO1d12AgfOQEhhxBpzlSyEe6_eI4vRNnObRgYzotYh374dI4mSr7521W2kX5Za1NDl5ilxhOYm6smOkJmzB4je7cqVMkXTgrsG7gnYZGr1xMZA0zxT-jJCqx2SIbdwDVGUBJMO9nySmk113sDzFJpyBvWQ4TaDjoH6eldCDvYBY2RSaqalHfUUtksqZJbPMmi6zHCQ&image_url=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F492x328%2Fq85%2Fimage%2Fvk%2F3643%2F643%2Frect_626aadf074621t1651158512r522.png.webp&skin_id=2&vertical_id=0&real_bid=0.013065000194683672&pr=&user_keywords=&auc_type=1&aid=412&ext_cid=0&device_theme=light&keywords=&label_ids=83,96,101,106,0&format=default-slide-b_r-body&cpa=098b4249-5dce-4e58-b293-39831d7fa24e
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/show/?mid=2959830145807337605&pid=0&site=native-push-mainstream&sc=NO&usage_type=DCH&subid=416473681&sid=836725167&cid=13061&price=0.01675000024959445&is_cpm=0&cpm=0&ecpm=0.007004310449199944&crid=5713643&crtid=1c81c2cc33a9d6c8cd6172aeefa0077e&tcid=0&out_id=0&ver=8.5.1&ver_c=&refdom=yptvuuxm.ga&hostname=auc-inpage-hz-3-a&site_id=3126103&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=1670011110&created_at=2022-12-01&is_native=1&auction_queue=0&burl=OO-u-5Y7fWRk_NYcw-QGgQBocmUkWZG1wZWLlMieud6Vj-EjGfRqOw&pop_winurl=&ip=91.90.42.154&testab=0&px_id=3126103&adblock=0&auction_host=&mm=0&yc=0&render_type=mq&campaign_type=mq&uniq=&exp=&resp_type=&iabcat=IAB24-24&min_cpm=3.841286562875279e-05&placement_type_id=&skin_test=0&verify_hash=ece9056c7694eb5c076adfceb540482f&score=57.8479437229132&durl=https%3A%2F%2Fts.cvastico.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttp%253A%252F%252Fyptvuuxm.ga%252F%26idzone%3D0%26sid%3D1885&ml=&tag_ab=c&original_bid=0.01675000024959445&user_fp=0&v2_track=0&url=U9flbNW1-mUKmGiMFnyfTIa2hn5VqyNwu1wJS69mclYN5vxUykXy_5DYFM5CutaVZQZ2EzrndwHVi5EeuRv1EwGgm0yYUb7zWbhdOr7SLStBZ7ZWiJDmLqfDV9OgFTNzU9hUdd7j4TQIEt6cNpGDyXtv1dMdJA0uSYqjdD985mHusv9f3BnUMuwKQDJOjXw_7v3eBJamibVW1-X2Gv3oIlvSlbZ2Js-qRnSX7FI5EvN8avIJzFeLb9L0StngirUaaKJ_3cHz9ien5z05spHTr7UTn0loO4TdYumJ_ztkW4p1kLqib0FcxlqNDtLWNodKLvjEoFpx9dcfnjhHVrKEGFPMk_-glXwmmxxHuU00Zt1c7cKjHjjXO5moc3ogNDeMianBJCj1Nu99H5ctK-hwSgiO5Bf9CRstufHs9fINmMkcRAd4dQDYR0mh9FWiwcOdUJfIfNJSkauOCmH1nE0u1fYxOYO7pZFJajjXXXP3GCyfiDLNiU3GQJ5_I2TxiHQ1qdFj96wuXblxNWNRdNwJtd7ZzJE1xiSNISWnIuAS-PIpd3v7mZQ_e8ZH6KjlMdLz0CnmfEnAT-NH4iE8VEOycmZ5tUuFYlRPSnotnaR4qX9sD5FWYnXdRw-8sM3aZeL_bKlMV9RMeXFMM6U8d3i1wF8YLLKtrApOgKF5p20k0lMQ_J9RszJqwFyciffAtnEgzQ0pU1ABMvUJ4M8lYSryMNgA4ye4Iesk9B7Y7LG0zlh2nO7V0g4-pkLe4MUHx4_IxNhupzzSvEdFjjn54LYP4w97oMl25afvJ1eyEq_QaleBFpPsr7C-ff4I9V0GCwKwFponmws5g381EnnUiN2MjnFM5jlogY9e5hODY9bPt6yK-oySqibxirJXJVSGzt0r2mrifflSZb3GsLR8wO1d12AgfOQEhhxBpzlSyEe6_eI4vRNnObRgYzotYh374dI4mSr7521W2kX5Za1NDl5ilxhOYm6smOkJmzB4je7cqVMkXTgrsG7gnYZGr1xMZA0zxT-jJCqx2SIbdwDVGUBJMO9nySmk113sDzFJpyBvWQ4TaDjoH6eldCDvYBY2RSaqalHfUUtksqZJbPMmi6zHCQ&image_url=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F492x328%2Fq85%2Fimage%2Fvk%2F3643%2F643%2Frect_626aadf074621t1651158512r522.png.webp&skin_id=2&vertical_id=0&real_bid=0.013065000194683672&pr=&user_keywords=&auc_type=1&aid=412&ext_cid=0&device_theme=light&keywords=&label_ids=83,96,101,106,0&format=default-slide-b_r-body&cpa=098b4249-5dce-4e58-b293-39831d7fa24e HTTP/1.1
Host: 02f3427bf4.bac23cfb5b.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
server: nginx/1.20.1
date: Thu, 01 Dec 2022 19:58:31 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
location: https://s.viichxt.com/n/1154/oziesyteafyfwbtbpz5vizkjmjsqw724azqh46cu2l2ostzsifnfgmd3f5jdmt2gkugx4wabmb5xq6nxsbdxfhvmqdyfo72plfacrvs3maqqt7gvvd4z7p4q5cldsimpxtzngtir2cwlzcb5gel3qvy7iofi3jcwjithq2jsk3x5f6gji4ocyqkjnezfmt2lsfx7qvktwbeghisxz3ygtydzvhibz4li5roy6sukrwsfnhzzl3pog3u2jjvyow3pw44yjjp6nktuu75npfb6l2lryezwt72kmluhspmchfb3cm7eslq4su4ykxqoly6bgg7e4sutkf5qcal4ybvug22fttbcbhllyi5erqzqkunbqjpapk2jfrglshg2tmfumcjhu7c3hbewtewp23jf4qjk5rgelicpunux6x2ziq4qn2rggsabjr3qdjqva6cuki4lsvx2kqszsy2qublfbwcl5w4zttsmsfjh3xsrgb4q6ubto56ao2pik5izqsqxtjku563cldafphwu6zupevmfu7pfdccxr63o5tzq2rfuuygapt4fbicnncjffkofyxgh57cwhh4w3fftu2ezbxgfk3vdzknjz3klpne6v6dvlcb4ibiqcydypfkgcttd6i6uq===?f=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F3643%2F643%2F626aadf074621t1651158512r522.png.webp
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7961d390357066ed3882c969bc7e20af
fa35dc49986c657ce4f47a1428b32e744bbab738
8e76c50c9eb02e53cd86651f80ea9178bc884ca025c825085c2f6b58b270ff5e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8E76C50C9EB02E53CD86651F80EA9178BC884CA025C825085C2F6B58B270FF5E"
Last-Modified: Thu, 01 Dec 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5154
Expires: Thu, 01 Dec 2022 21:24:25 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
i.cdnkimg.com/auto/492x328/q85/image/vk/3643/643/rect_626aadf074621t1651158512r522.png.webp
200 OK 10 kB URL HTTP/2 i.cdnkimg.com/auto/492x328/q85/image/vk/3643/643/rect_626aadf074621t1651158512r522.png.webp
IP
ASN #39572 DataWeb Global Group B.V.
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 360x240, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 68329d624a42af6145117bed5c9a2f03
4439b8d8b7e2dc706b5e9a417852bf16e6eb17dd
ede7a9f931abc7e53d07dbf4a82e992cfc38ebb280158f7fa4d12d00cab03bc6
GET /auto/492x328/q85/image/vk/3643/643/rect_626aadf074621t1651158512r522.png.webp HTTP/1.1
Host: i.cdnkimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:31 GMT
content-type: image/webp
content-length: 10348
server: nginx/1.19.0
cache-control: max-age=1209600
x-cache-status: MISS
expires: Thu, 15 Dec 2022 19:58:31 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3eb95bae164584821cd239f4f7de9532
19133652cd7a52015089eb941710dcd4d43d9dc7
f4ec51323002838d08d197a04232ac1bb46627ea8d0481c533410ebd1940a29f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F4EC51323002838D08D197A04232AC1BB46627EA8D0481C533410EBD1940A29F"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6388
Expires: Thu, 01 Dec 2022 21:44:59 GMT
Date: Thu, 01 Dec 2022 19:58:31 GMT
Connection: keep-alive
s.viichxt.com/n/1154/oziesyteafyfwbtbpz5vizkjmjsqw724azqh46cu2l2ostzsifnfgmd3f5jdmt2gkugx4wabmb5xq6nxsbdxfhvmqdyfo72plfacrvs3maqqt7gvvd4z7p4q5cldsimpxtzngtir2cwlzcb5gel3qvy7iofi3jcwjithq2jsk3x5f6gji4ocyqkjnezfmt2lsfx7qvktwbeghisxz3ygtydzvhibz4li5roy6sukrwsfnhzzl3pog3u2jjvyow3pw44yjjp6nktuu75npfb6l2lryezwt72kmluhspmchfb3cm7eslq4su4ykxqoly6bgg7e4sutkf5qcal4ybvug22fttbcbhllyi5erqzqkunbqjpapk2jfrglshg2tmfumcjhu7c3hbewtewp23jf4qjk5rgelicpunux6x2ziq4qn2rggsabjr3qdjqva6cuki4lsvx2kqszsy2qublfbwcl5w4zttsmsfjh3xsrgb4q6ubto56ao2pik5izqsqxtjku563cldafphwu6zupevmfu7pfdccxr63o5tzq2rfuuygapt4fbicnncjffkofyxgh57cwhh4w3fftu2ezbxgfk3vdzknjz3klpne6v6dvlcb4ibiqcydypfkgcttd6i6uq===?f=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F3643%2F643%2F626aadf074621t1651158512r522.png.webp
302 Found 0 B URL HTTP/2 s.viichxt.com/n/1154/oziesyteafyfwbtbpz5vizkjmjsqw724azqh46cu2l2ostzsifnfgmd3f5jdmt2gkugx4wabmb5xq6nxsbdxfhvmqdyfo72plfacrvs3maqqt7gvvd4z7p4q5cldsimpxtzngtir2cwlzcb5gel3qvy7iofi3jcwjithq2jsk3x5f6gji4ocyqkjnezfmt2lsfx7qvktwbeghisxz3ygtydzvhibz4li5roy6sukrwsfnhzzl3pog3u2jjvyow3pw44yjjp6nktuu75npfb6l2lryezwt72kmluhspmchfb3cm7eslq4su4ykxqoly6bgg7e4sutkf5qcal4ybvug22fttbcbhllyi5erqzqkunbqjpapk2jfrglshg2tmfumcjhu7c3hbewtewp23jf4qjk5rgelicpunux6x2ziq4qn2rggsabjr3qdjqva6cuki4lsvx2kqszsy2qublfbwcl5w4zttsmsfjh3xsrgb4q6ubto56ao2pik5izqsqxtjku563cldafphwu6zupevmfu7pfdccxr63o5tzq2rfuuygapt4fbicnncjffkofyxgh57cwhh4w3fftu2ezbxgfk3vdzknjz3klpne6v6dvlcb4ibiqcydypfkgcttd6i6uq===?f=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F3643%2F643%2F626aadf074621t1651158512r522.png.webp
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /n/1154/oziesyteafyfwbtbpz5vizkjmjsqw724azqh46cu2l2ostzsifnfgmd3f5jdmt2gkugx4wabmb5xq6nxsbdxfhvmqdyfo72plfacrvs3maqqt7gvvd4z7p4q5cldsimpxtzngtir2cwlzcb5gel3qvy7iofi3jcwjithq2jsk3x5f6gji4ocyqkjnezfmt2lsfx7qvktwbeghisxz3ygtydzvhibz4li5roy6sukrwsfnhzzl3pog3u2jjvyow3pw44yjjp6nktuu75npfb6l2lryezwt72kmluhspmchfb3cm7eslq4su4ykxqoly6bgg7e4sutkf5qcal4ybvug22fttbcbhllyi5erqzqkunbqjpapk2jfrglshg2tmfumcjhu7c3hbewtewp23jf4qjk5rgelicpunux6x2ziq4qn2rggsabjr3qdjqva6cuki4lsvx2kqszsy2qublfbwcl5w4zttsmsfjh3xsrgb4q6ubto56ao2pik5izqsqxtjku563cldafphwu6zupevmfu7pfdccxr63o5tzq2rfuuygapt4fbicnncjffkofyxgh57cwhh4w3fftu2ezbxgfk3vdzknjz3klpne6v6dvlcb4ibiqcydypfkgcttd6i6uq===?f=https%3A%2F%2Fi.cdnkimg.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F3643%2F643%2F626aadf074621t1651158512r522.png.webp HTTP/1.1
Host: s.viichxt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx/1.19.0
date: Thu, 01 Dec 2022 19:58:31 GMT
content-length: 0
location: https://i.cdnkimg.com/auto/192/q85/image/vk/3643/643/626aadf074621t1651158512r522.png.webp
X-Firefox-Spdy: h2
static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
200 OK 790 B URL HTTP/2 static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
IP
ASN #24940 Hetzner Online GmbH
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 65156a660e465299370ebd90d84aa461
12ff60b17f579a77e42a8be7b6b1892fc71be33d
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18
GET /creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp HTTP/1.1
Host: static.bookmsg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Thu, 01 Dec 2022 19:58:31 GMT
content-type: image/webp
content-length: 790
last-modified: Tue, 24 Nov 2020 14:20:43 GMT
etag: "5fbd16bb-316"
cache-control: public, max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
i.cdnkimg.com/auto/192/q85/image/vk/3643/643/626aadf074621t1651158512r522.png.webp
200 OK 7.7 kB URL HTTP/2 i.cdnkimg.com/auto/192/q85/image/vk/3643/643/626aadf074621t1651158512r522.png.webp
IP
ASN #39572 DataWeb Global Group B.V.
File type RIFF (little-endian) data, Web/P image\012- data
Hash 311dea4d14f115d233335c6e836384b4
8b92a31d5f07440ea67469f1b2827fe1bde271e4
8136f9d883af8abb2895a1c5946063fc41ed4b3a7f7226ffe2f49e49a3d0c961
GET /auto/192/q85/image/vk/3643/643/626aadf074621t1651158512r522.png.webp HTTP/1.1
Host: i.cdnkimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:31 GMT
content-type: image/webp
content-length: 7712
server: nginx/1.19.0
cache-control: max-age=1209600
x-cache-status: MISS
expires: Thu, 15 Dec 2022 19:58:31 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
136ffb81df.df253f3b96.com/6344fbdb6edcc7d50564efa2798e8bc6.js
200 OK 0 B URL HTTP/2 136ffb81df.df253f3b96.com/6344fbdb6edcc7d50564efa2798e8bc6.js
IP
ASN #39572 DataWeb Global Group B.V.
Analyzer Verdict Alert quad9 Sinkholed
GET /6344fbdb6edcc7d50564efa2798e8bc6.js HTTP/1.1
Host: 136ffb81df.df253f3b96.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://yptvuuxm.ga
Connection: keep-alive
Referer: http://yptvuuxm.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 01 Dec 2022 19:58:29 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Wed, 30 Nov 2022 13:10:49 GMT
etag: W/"63875659-17718"
content-encoding: gzip
expires: Thu, 01 Dec 2022 20:03:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
188.114.97.1
45.133.44.24
157.90.84.246
31.220.27.135
23.36.76.226
93.184.220.29