r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3d0727e32cd103ddd4b73f28c81758aa
197a7bf43d63723fc532c23c6dced68d5cc36652
d3f75d03561d6a47d19370292e821a86e58381466f0c69386a21175de55882ff
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D3F75D03561D6A47D19370292E821A86E58381466F0C69386A21175DE55882FF"
Last-Modified: Fri, 11 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11558
Expires: Sat, 12 Nov 2022 18:23:47 GMT
Date: Sat, 12 Nov 2022 15:11:09 GMT
Connection: keep-alive
agubar.com/
301 Moved Permanently 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: agubar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 12 Nov 2022 15:11:11 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Location: http://www.agubar.com/index.php
ocsp.digicert.com/
200 OK 471 B IP
Hash de470c6bab46e7c4b7cc69f392900fe7
189e4dcc4c2b8bf1f050e06bd68bce8a99618918
86f57134ddebd23a25615dc4d59c4b1ca8919e3e0495e1f006cbe7c0f39aa27e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4033
Cache-Control: max-age=160039
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:09 GMT
Etag: "636f75f3-1d7"
Expires: Mon, 14 Nov 2022 11:38:28 GMT
Last-Modified: Sat, 12 Nov 2022 10:31:15 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5076aaa9f4ccd602540286ce0590cb9a
bbf7936a8413a564478971d9e19beb6338cbc869
00e3b967c579b0ccf709b78d497a43d95646b16eb50925fef1e2694c58f290b2
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "00E3B967C579B0CCF709B78D497A43D95646B16EB50925FEF1E2694C58F290B2"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10064
Expires: Sat, 12 Nov 2022 17:58:53 GMT
Date: Sat, 12 Nov 2022 15:11:09 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Length, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 12 Nov 2022 14:44:13 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1616
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: JYIKswVXVyBx81/kXpfxTNZeJVHdAlNoCG5eFHqOW8k/OsoiSaMclvDIKlGMDSpslNOCIqY1IFs=
x-amz-request-id: YGV4GCZD1ZQRQS53
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 12 Nov 2022 14:13:01 GMT
age: 3488
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 15:11:09 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Cache-Control, Pragma, Last-Modified, ETag, Alert, Backoff, Content-Type, Retry-After, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 12 Nov 2022 14:44:48 GMT
cache-control: public,max-age=3600
age: 1581
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash ae51f1958554de4457c22a7d5a9ba8b6
173e90a8c6ee36b7ec569dbea47436a90d7e7c76
dc43a04e1e26243f63a8e628f2ebcb23a9527fd4bc40dc6d1d61879b0f95bb21
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4653
Cache-Control: max-age=155596
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:09 GMT
Etag: "636f622c-1d7"
Expires: Mon, 14 Nov 2022 10:24:25 GMT
Last-Modified: Sat, 12 Nov 2022 09:06:52 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: pPbLQEn0K7GhZWXMoXpO8A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: p6qXToNlOPCuk56S7dhncnxPOhc=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11634
Expires: Sat, 12 Nov 2022 18:25:05 GMT
Date: Sat, 12 Nov 2022 15:11:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11634
Expires: Sat, 12 Nov 2022 18:25:05 GMT
Date: Sat, 12 Nov 2022 15:11:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11634
Expires: Sat, 12 Nov 2022 18:25:05 GMT
Date: Sat, 12 Nov 2022 15:11:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11634
Expires: Sat, 12 Nov 2022 18:25:05 GMT
Date: Sat, 12 Nov 2022 15:11:11 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d4e929-d0bb-41b7-bdcd-0e67258b428a.webp
200 OK 9.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d4e929-d0bb-41b7-bdcd-0e67258b428a.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 516f1bfefb1c1a737ea2441f85343b32
0cc22d7bf9092fb30f31e2ca8f242c197b891669
733824d4f6f7c5b54ce4e02ecaf152cfc1e10f3f6a801d7e2c55a02460e40087
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d4e929-d0bb-41b7-bdcd-0e67258b428a.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9012
x-amzn-requestid: 83eac9e7-5387-4e11-9769-182fa3f7fffb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdNC6FxzoAMF80w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec212-5ca277b90a5a9a4c437edc1e;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:43:46 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: PrJoEROPymrtc0egNlWRoOMjohiCo3zReD01qAHwByaSiXarfRS0XQ==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:00:43 GMT
age: 61828
etag: "0cc22d7bf9092fb30f31e2ca8f242c197b891669"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash faa8e3cf2ab3c1d53a1735def5bb7476
ccc1ec5ebb5090c6255dcb1e8899e95cdd91e12f
e81a8fa312ec478871427f1d04ba7fe563573c683809153f75dec8df979d6efe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6577
x-amzn-requestid: b4587cfb-6041-453c-9e74-fa35ecd31448
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMjIGHRoAMF26g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec147-29e7ec741b0e6f6f674aef75;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: hsMmHIBEt_4cL455goPqDKQVQA75u4oGFbSxsGP_e_0uG7SZmSLBhQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 b8c4a4ca04bb1976e020396d211bc8dc.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:00:57 GMT
age: 61814
etag: "ccc1ec5ebb5090c6255dcb1e8899e95cdd91e12f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9f88d70-47ed-4a86-9b90-ea63f189df00.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9f88d70-47ed-4a86-9b90-ea63f189df00.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 94a390953f36bf9902cb9f04007c36c1
13535f16f207d4c19c1b6019757f6739a4531eeb
37d73300955a979e5b9d3dabc6e924c4e9734c6c63d92c42c709f8cb0d5aeabb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9f88d70-47ed-4a86-9b90-ea63f189df00.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5902
x-amzn-requestid: 9c8be25c-9c96-4861-89c8-8b7bf06ffc16
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdNBrH2DoAMFqbg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec20a-6c770a86581d1f7f4599684f;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:43:38 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ncUYc6gH2CYjxAwoVCC4MEj8Va5GGn1ZAg-gBmFtm5gzYIe898Ittg==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:45:12 GMT
age: 62759
etag: "13535f16f207d4c19c1b6019757f6739a4531eeb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg
200 OK 8.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 084ca839d34b15916cd2f5034440a1ef
7764777ce9a862c1590712ef33032df72edefffd
b8893d7f327f88316cb909ded7fd8f4e1809190a7da807677785bf953f6e33fb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8482
x-amzn-requestid: 79e5e211-afc8-4531-b361-6f6f3386f16e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhUGJsIAMF7Mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-5a0ba4a93eba91c81ba3a9bc;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: CxrOwBRw0YlwOnKPJZI7h7YEwOAYS3ZtFa8q2o5rDvQct6pehCAFAg==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:51:43 GMT
age: 62368
etag: "7764777ce9a862c1590712ef33032df72edefffd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facfcee70-832e-4f2d-8fc7-55d2bfff651e.jpeg
200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facfcee70-832e-4f2d-8fc7-55d2bfff651e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash eac2ed4bece6282c8273a58a88371e2e
2d90ff66079e8ffbaaa367a6bfc08927e7cc424d
aea97fd7d90302edcb3e0c08507d682e02166e8ddd4d082fc4f5435af438594c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facfcee70-832e-4f2d-8fc7-55d2bfff651e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8633
x-amzn-requestid: 8bdfbfbb-5193-4c62-ba1b-c906f7548676
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhSEC1oAMF8tw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-39b4c2954dbc8e4c40a2c9d8;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: lxrfhO5oOGvECIrlZYKsfXOTZZksAIIHAafyRM-FdRXAaBVZs5cEQA==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:45:21 GMT
age: 62750
etag: "2d90ff66079e8ffbaaa367a6bfc08927e7cc424d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7b66f592-618a-4463-834d-ff9bbe8866ae.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7b66f592-618a-4463-834d-ff9bbe8866ae.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 848af62ec10d0c297922f8600b6ad12d
4eadbf5f0dade92dcc6d68c8ebb70898aadb9a7d
a3b4eb6768259876819d7e6c7ac9e21c603d54f60bf70ed077cb820711e2ae74
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7b66f592-618a-4463-834d-ff9bbe8866ae.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11316
x-amzn-requestid: 8456b25a-b87f-490d-86b3-fb217afea082
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bWlniESaIAMF3Qg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636c1c96-30ed3b0972418bae4700edc8;Sampled=0
x-amzn-remapped-date: Wed, 09 Nov 2022 21:33:10 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: mMfP4wVk4SVBFR_ZqBEFuKeOS_NHYS1RuAnRSZajYau-oLVcc4j9BA==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:14:05 GMT
age: 61026
etag: "4eadbf5f0dade92dcc6d68c8ebb70898aadb9a7d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
www.agubar.com/index.php
200 OK 791 B IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ISO-8859 text, with CRLF line terminators
Hash e9f812bad854448113478cc8dc802be7
cb8a617c6351fbe78b999fdd6f2e37a45e9bf008
5471114847dbb5d5ed340a02df4f537ef82cb19f8a61ace1871947bd9404d647
GET /index.php HTTP/1.1
Host: www.agubar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:15 GMT
Content-Type: text/html
Content-Length: 791
Connection: keep-alive
www.agubar.com/common.js
200 OK 1.1 kB IP
File type HTML document, ASCII text, with very long lines (431), with CRLF line terminators
Hash ad617fa64a6829b00e90b25923b84661
a94f0ae43293e8e4519d5abb7c454ec65baa2e2e
7ffedd973683710e5f9dc692b43f48dd69950bedc93f61ea8009f9f5c434752b
GET /common.js HTTP/1.1
Host: www.agubar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.agubar.com/index.php
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:15 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
www.agubar.com/tj.js
200 OK 258 B IP
File type ASCII text, with CRLF line terminators
Hash d7f2a785d7a9d52753e039a3628f16a0
a7b93991ebe60e5099c833ad083df7c9166a7a30
746d88fb033ce356f4cf9b0eaf94341bd618c1b12c51dad6a833f44db1030d3c
GET /tj.js HTTP/1.1
Host: www.agubar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.agubar.com/index.php
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:15 GMT
Content-Type: application/x-javascript
Content-Length: 258
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash db5506dcc3d28e24ddade0854108241b
292a31520e14a8ca5f7b9bb3ac55a7bccca34365
a43f559e41219be55af7083b9edb944c98706600275b20629c08cfa77765a6be
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A43F559E41219BE55AF7083B9EDB944C98706600275B20629C08CFA77765A6BE"
Last-Modified: Fri, 11 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21538
Expires: Sat, 12 Nov 2022 21:10:11 GMT
Date: Sat, 12 Nov 2022 15:11:13 GMT
Connection: keep-alive
www.agubar.com/favicon.ico
200 OK 1.2 kB URL HTTP/1.1 www.agubar.com/favicon.ico
IP
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 7ef1f0a0093460fe46bb691578c07c95
2da3ffbbf4737ce4dae9488359de34034d1ebfbd
4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c
GET /favicon.ico HTTP/1.1
Host: www.agubar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.agubar.com/index.php
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT
Connection: keep-alive
ETag: "4e0d81df-47e"
Expires: Thu, 17 Nov 2022 15:11:16 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes
aseywi-qwuenc-uersn-01.com/
200 OK 6.8 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1254), with CRLF line terminators
Hash ad25432267323072787a5d25094d29d5
b8511cc25eafa9dc0dc94fb547977bb73941d505
922f132dbdd38de5b5f65e25f8e198533001e008349bdf666646655d7d6eb75c
GET / HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.agubar.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx/0.6.39
Set-Cookie: _d_id=933ab1920c70c5547112c059e9369d; Path=/; HttpOnly
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 6847
aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/ate.css
200 OK 4.5 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/ate.css
IP
File type ASCII text, with CRLF line terminators
Hash 1164a38c5186eff1838f351d96dbd192
1f5c06f7969ca9602774591594b1d4170137cdc3
fec2bebf191e9c67f3ce3234909acb71fa272057962f230dce334cdfd514b3e2
GET /template/waydoaxn/css/ate.css HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Sun, 24 Jan 2021 07:28:36 GMT
Accept-Ranges: bytes
ETag: "06ae58622f2d61:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 4498
push.zhanzhang.baidu.com/push.js
200 OK 227 B URL HTTP/1.1 push.zhanzhang.baidu.com/push.js
IP
ASN #9808 China Mobile Communications Group Co., Ltd.
File type ASCII text, with no line terminators
Hash e548b6ce15bb616c2bfba36e9cfbf307
a348285d9928a6548a57569f1fb9d62bdd747f33
7be3e4c53cc47ce5cfa40a5e79b42848a90acee0d7ff71f10ac31a49c81aead5
GET /push.js HTTP/1.1
Host: push.zhanzhang.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.agubar.com/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Encoding: gzip
Content-Length: 227
Content-Type: text/javascript
Date: Sat, 12 Nov 2022 15:11:13 GMT
Etag: "4078521116"
Expires: Sun, 12 Nov 2023 15:11:13 GMT
Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: apache
Set-Cookie: BAIDUID=277E46A304272ECBE170C1490523562A:FG=1; max-age=31536000; expires=Sun, 12-Nov-23 15:11:13 GMT; domain=.baidu.com; path=/; version=1
Vary: Accept-Encoding
api.share.baidu.com/s.gif?l=http://www.agubar.com/index.php
200 OK 0 B URL HTTP/1.1 api.share.baidu.com/s.gif?l=http://www.agubar.com/index.php
IP
ASN #38365 Beijing Baidu Netcom Science and Technology Co., Ltd.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s.gif?l=http://www.agubar.com/index.php HTTP/1.1
Host: api.share.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.agubar.com/
HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Sat, 12 Nov 2022 15:11:13 GMT
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/vtffstvy.js
200 OK 1.3 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/vtffstvy.js
IP
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 3b46ec2a2b9ba28aa4db10381d2b3fc3
1d468cd9888d4d4a71ad48f68c7b2667d526735c
facc779632a607d9161e7bc8e6d8052a4a8e9ee99a1d61c97769035a74dfc570
GET /template/waydoaxn/mmnjuuta/vtffstvy.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 15:25:16 GMT
Accept-Ranges: bytes
ETag: "016cfcce1f5d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 1325
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/ebhhnphx.js
200 OK 860 B URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/ebhhnphx.js
IP
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 4928d81408cacfce374967442d2bbe14
395845ec7ec847383551d89e99eb690282c98c92
51a074cbda741e0fdd07aa36f174aeed110f08c14e56015a5e9a01507e10dfa9
GET /template/waydoaxn/mmnjuuta/ebhhnphx.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Thu, 03 Nov 2022 11:45:47 GMT
Accept-Ranges: bytes
ETag: "38422fd079efd81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 860
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/nyyhulad.js
200 OK 2.2 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/nyyhulad.js
IP
File type HTML document text\012- HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash bf0a61b8bb5d16112902cf4b8fbfc8d6
59f0dfe10ee1038d405605ab9301527b5edb833d
ac3e59ab8cb44a11804552228ce06d01a6e325b7ca9938eb59503f2a054ffc38
GET /template/waydoaxn/mmnjuuta/nyyhulad.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Sat, 12 Nov 2022 08:01:36 GMT
Accept-Ranges: bytes
ETag: "03077fc6cf6d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 2198
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/app.js
200 OK 2.3 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/app.js
IP
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 65dd8367ba3839b1cba734bda4c82c4b
e3ce07a74f88f6bce189e6f97907745fea7e8233
157459f21602040b231d3a33920e256c42bab5cc729b787070cfbd1f67b22a62
GET /template/waydoaxn/mmnjuuta/app.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 14:05:56 GMT
Accept-Ranges: bytes
ETag: "0baa0b7d6f5d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 2252
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/geaueyhh.js
200 OK 1.1 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/geaueyhh.js
IP
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 02722b7e4196cd283642a306c4a61c83
d1435f3e851eabc3f12bde8c43d3db47e4bc40cf
847d50aa7e1f9d3d266c51172b630600c2ef1b7f17ac17952f063b31e593f0f0
GET /template/waydoaxn/mmnjuuta/geaueyhh.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 14:05:35 GMT
Accept-Ranges: bytes
ETag: "80611cabd6f5d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 1067
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/rradauct.js
200 OK 778 B URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/rradauct.js
IP
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 9ff7011b41ba1bfcccc3f8312919e880
7fcdaa99180321296307e6fd1030fd7cc7a13974
ca669ec6f75f77f192f9935bdabc36195dd7a395a8fe282da44e2f62c21beda3
GET /template/waydoaxn/mmnjuuta/rradauct.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Sun, 06 Nov 2022 06:35:29 GMT
Accept-Ranges: bytes
ETag: "b8897bf6a9f1d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 778
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/mqntlfic.js
200 OK 1.8 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/mqntlfic.js
IP
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 8dde0c0a7b77e9f7acc754378a6ec841
7c0fe5397f9d661a2a77767c21763e31bcf1a79c
4db4a00815727513e778d78ff31708b149605339923ba0fe7e439e26d1d27bc3
GET /template/waydoaxn/mmnjuuta/mqntlfic.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Sat, 12 Nov 2022 08:00:46 GMT
Accept-Ranges: bytes
ETag: "0cba9de6cf6d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 1841
ocsp.globalsign.com/gsrsaovsslca2018
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP
Hash 1fa35ed128e32dafc3ce880f556f900a
09bf66917290081defce73e87095e0c0b25279f1
2121a19c7ea8bd3ff8fd8ed191a4ecf4cc184557dd5723a90cad3b05ac9111e7
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:14 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Wed, 16 Nov 2022 13:02:50 GMT
ETag: "09bf66917290081defce73e87095e0c0b25279f1"
Last-Modified: Sat, 12 Nov 2022 13:02:51 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1161
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 769032f1cb75b4f4-OSL
aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/zui.css
200 OK 15 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/zui.css
IP
File type assembler source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 48c376278eb9da985b90bb1612dbeee1
4d755742285a8bc38f9c73b3a5976c6b381e3c32
af7cb37270a26d66dd3bb89f42d9c122bb2a1bfe9f6fe076138d9864c7193bee
GET /template/waydoaxn/css/zui.css HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Wed, 27 Jan 2021 05:34:18 GMT
Accept-Ranges: bytes
ETag: "0e972e6ef4d61:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 15351
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/ficsblek.js
200 OK 886 B URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/ficsblek.js
IP
File type HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash bf8f2bbc84c3165f1ce81244d63c625f
11722537ad1a60ea7a411098709027442e41ff19
74344961b9cadc92932eabbf2d74ee45aed7d7ed9f07132d0009d2346c0f1301
GET /template/waydoaxn/mmnjuuta/ficsblek.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 13:50:27 GMT
Accept-Ranges: bytes
ETag: "9410738ed4f5d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 886
aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/kcpmvycl.js
200 OK 212 B URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/mmnjuuta/kcpmvycl.js
IP
File type HTML document, ASCII text, with CRLF line terminators
Hash 6d23b1e6dc71e3ef03252b13f7a1454f
2696a8fedeb76ed53e14542eb8ff95c6d2da91ca
2366bd84896434e3d5976e5818a34c1f46ca2ea7d2b7dca1445f83ab39d08bd9
GET /template/waydoaxn/mmnjuuta/kcpmvycl.js HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 30 Sep 2022 06:16:09 GMT
Accept-Ranges: bytes
ETag: "2cc4e72194d4d81:0"
Vary: Accept-Encoding
Server: nginx/0.6.39
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 212
aseywi-qwuenc-uersn-01.com/template/waydoaxn/images/1.gif
200 OK 254 B URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/images/1.gif
IP
File type GIF image data, version 89a, 16 x 17\012- data
Hash b013f8fa3ec997fe20dc80b82af0ad0a
e02ce6c30d5c0abfaa3e008d1a3ce7d11f299ed9
119bff063d1d402fdf6e48bc7e681d48aabfb9bc65378dfcf64a8845ec3fceef
GET /template/waydoaxn/images/1.gif HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Fri, 11 Jun 2021 00:37:23 GMT
Accept-Ranges: bytes
ETag: "28ba8f2595ed71:0"
Server: nginx/0.6.39
Set-Cookie: _d_id=939aac14cf6c8cf80e3a687f13909d; Path=/; HttpOnly
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 254
aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/loogo8.png
200 OK 23 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/loogo8.png
IP
File type PNG image data, 210 x 100, 8-bit/color RGBA, non-interlaced\012- data
Hash e935e114b9be588eff66c31554c3245c
064ce51b6947d6f6c2f2531c9a0f0fc1517b799c
470ab5686a7241d007c207559926b84b05bc413db92b979ac7fca91c1cf6e105
GET /template/waydoaxn/css/loogo8.png HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Wed, 20 Oct 2021 10:22:05 GMT
Accept-Ranges: bytes
ETag: "40525b549cc5d71:0"
Server: nginx/0.6.39
Set-Cookie: _d_id=938db0aababc251fd0c5cca7638d9d; Path=/; HttpOnly
Date: Sat, 12 Nov 2022 15:11:08 GMT
Content-Length: 22644
hm.baidu.com/hm.js?1a85169089bc020cf82521c1e705809e
200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?1a85169089bc020cf82521c1e705809e
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (616)
Hash 24979316cbf9430a7a7bbfefb91fd276
db16462efe34157cc898d46ff76dd7217700d4d9
15212fe1704263fed090f0982b60927eb16509e0c8cb7275a4eba22f3f280c40
GET /hm.js?1a85169089bc020cf82521c1e705809e HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.agubar.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11329
Content-Type: application/javascript
Date: Sat, 12 Nov 2022 15:11:14 GMT
Etag: 50630aa2a14c390cf411fa42f1fa746d
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=A80930E20B8C264A; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f6d3e1565b970f60a12fc682b062de25
2312789f34c3ee514ca9d7bd93c656bea50eddc1
0ba0d99c731d85942812e2de890d89bf3ac18cf9d171ceb4064a144992aae2bd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0BA0D99C731D85942812E2DE890D89BF3AC18CF9D171CEB4064A144992AAE2BD"
Last-Modified: Thu, 10 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17372
Expires: Sat, 12 Nov 2022 20:00:47 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 409feecd26acd36ce961502eecdeee6b
efc4db7ed667abaa527a2bc41c37d5d0cc01ec4b
0a8bb9c9615528f012c50d4fc7da2a8ac5d9799c4a820d9206a06d895edeb5db
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0A8BB9C9615528F012C50D4FC7DA2A8AC5D9799C4A820D9206A06D895EDEB5DB"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11052
Expires: Sat, 12 Nov 2022 18:15:27 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fd1269100148684cf3e00a00dda2ae02
1770d71d183fa522432a1c9c7e450a3466e39ea3
b4583d6bef53e6d8c34fcf19072ccf3dc6787d079eefb6309f34f8d138c67317
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B4583D6BEF53E6D8C34FCF19072CCF3DC6787D079EEFB6309F34F8D138C67317"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3094
Expires: Sat, 12 Nov 2022 16:02:49 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fecc6d06809e9847d79cd10a6b2bba01
39885694a80ff977f0985fcb1f8afd69f1453861
1471c67fe7283d75c7e9628a7797fd0d2691c67f2896ec081d9e8eaca7547b8c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1471C67FE7283D75C7E9628A7797FD0D2691C67F2896EC081D9E8EACA7547B8C"
Last-Modified: Fri, 11 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7772
Expires: Sat, 12 Nov 2022 17:20:47 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 787b5b36cc392ea91fb573aeb6d74512
d4db9f4b7ec717270721d2c7c440ceef74188fd6
24fd353e90a4eff40298c31c39ffb7ca4c05b2d2ca0c1682d9b410323eb71a17
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "24FD353E90A4EFF40298C31C39FFB7CA4C05B2D2CA0C1682D9B410323EB71A17"
Last-Modified: Sat, 12 Nov 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=266
Expires: Sat, 12 Nov 2022 15:15:41 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f8458c0517b83fe525d944d5eec431f1
3f2f8eb6a3534b1348d3f7a870b9711d706d7472
f2b56725917015a07a1667675c47c098d9be9b51d08de05206575c48fcd7551c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F2B56725917015A07A1667675C47C098D9BE9B51D08DE05206575C48FCD7551C"
Last-Modified: Thu, 10 Nov 2022 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16264
Expires: Sat, 12 Nov 2022 19:42:19 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f5cd6524aba7e79a6ee6c857d7e7ea29
81693c03baec533d6cba9a2196a93a31703b8e00
41524802a038c37d95f36d1d2841dc9327b2606a76d917e5e00e39523de9b30c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "41524802A038C37D95F36D1D2841DC9327B2606A76D917E5E00E39523DE9B30C"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8617
Expires: Sat, 12 Nov 2022 17:34:52 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f5cd6524aba7e79a6ee6c857d7e7ea29
81693c03baec533d6cba9a2196a93a31703b8e00
41524802a038c37d95f36d1d2841dc9327b2606a76d917e5e00e39523de9b30c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "41524802A038C37D95F36D1D2841DC9327B2606A76D917E5E00E39523DE9B30C"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8617
Expires: Sat, 12 Nov 2022 17:34:52 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
aseywi-qwuenc-uersn-01.com/template/waydoaxn/images/video-mask.png
200 OK 107 B URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/images/video-mask.png
IP
File type PNG image data, 1 x 46, 8-bit gray+alpha, non-interlaced\012- data
Hash 6a5ee87ff75437cb480df839f36004fd
eac66370f99601cb7febef320c9540d4593cd856
c9b6925bdd64dab63151c3106347fefb8c500d87ac3d87d9a82e9a1c561233aa
GET /template/waydoaxn/images/video-mask.png HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/zui.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sun, 24 Jan 2021 07:28:42 GMT
Accept-Ranges: bytes
ETag: "b0b58b8a22f2d61:0"
Server: nginx/0.6.39
Set-Cookie: _d_id=93c2ac6320bad7d249c55b6989b79d; Path=/; HttpOnly
Date: Sat, 12 Nov 2022 15:11:09 GMT
Content-Length: 107
dimg04.c-ctrip.com/images/01062120009juijo220FF.gif?proc=autoorient
200 OK 459 kB URL HTTP/2 dimg04.c-ctrip.com/images/01062120009juijo220FF.gif?proc=autoorient
IP
File type GIF image data, version 89a, 240 x 240\012- data
Size 459 kB (459178 bytes)
Hash b94c433c7ff120830548e8235064c166
495aab71076393eb97ab0f4e00f361d2a5dbcef2
260ae0971036dd2ff09076337b2e81ead9ce9c7afd576a12e45676a4b76abea2
GET /images/01062120009juijo220FF.gif?proc=autoorient HTTP/1.1
Host: dimg04.c-ctrip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 459178
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=3410300
expires: Thu, 22 Dec 2022 02:29:35 GMT
date: Sat, 12 Nov 2022 15:11:15 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
dimg04.c-ctrip.com/images/0396s12000a0xzzws247D.gif
200 OK 1.4 MB URL HTTP/2 dimg04.c-ctrip.com/images/0396s12000a0xzzws247D.gif
IP
File type GIF image data, version 89a, 960 x 240\012- data
Size 1.4 MB (1367629 bytes)
Hash a82047b0c42a3d4707d251820bc2ea04
a215eb250a869a723bd87cc76830f193aea5fafc
feef5a64e954e16467f743c50f02ee1d8dc09fb3666ca4cc24ff74ed09b1360d
GET /images/0396s12000a0xzzws247D.gif HTTP/1.1
Host: dimg04.c-ctrip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 1367629
access-control-allow-origin: *
last-modified: Tue, 12 May 2015 01:00:00 GMT
cache-control: max-age=11829726
expires: Wed, 29 Mar 2023 13:13:21 GMT
date: Sat, 12 Nov 2022 15:11:15 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
kvezz.com/95ca29ec3907b3bf2d8a24b35e3eda22.gif
301 Moved Permanently 162 B URL HTTP/2 kvezz.com/95ca29ec3907b3bf2d8a24b35e3eda22.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /95ca29ec3907b3bf2d8a24b35e3eda22.gif HTTP/1.1
Host: kvezz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvkggg.top/95ca29ec3907b3bf2d8a24b35e3eda22.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kzeaa.com/92f0c144d76dd785f7c04f84ae149b33.gif
301 Moved Permanently 162 B URL HTTP/2 kzeaa.com/92f0c144d76dd785f7c04f84ae149b33.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /92f0c144d76dd785f7c04f84ae149b33.gif HTTP/1.1
Host: kzeaa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvheee.top/92f0c144d76dd785f7c04f84ae149b33.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvevv.com/47fc3dfa6dab926d04bc8c0e76b89995.gif
301 Moved Permanently 162 B URL HTTP/2 kvevv.com/47fc3dfa6dab926d04bc8c0e76b89995.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /47fc3dfa6dab926d04bc8c0e76b89995.gif HTTP/1.1
Host: kvevv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvhyyy.top/47fc3dfa6dab926d04bc8c0e76b89995.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvevv.com/62c32c04c4566524981b72086b0c545b.gif
301 Moved Permanently 162 B URL HTTP/2 kvevv.com/62c32c04c4566524981b72086b0c545b.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /62c32c04c4566524981b72086b0c545b.gif HTTP/1.1
Host: kvevv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvhyyy.top/62c32c04c4566524981b72086b0c545b.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 4b9da3614e5ea3d18812d30c591c4ff8
f3ea36793becec8ee1ace6019fb5ce6ec7b9176b
069b99cdc9d54922976be03cda459c305b54e8d8b91393f6744bf7798bc99d8d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "069B99CDC9D54922976BE03CDA459C305B54E8D8B91393F6744BF7798BC99D8D"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=226
Expires: Sat, 12 Nov 2022 15:15:01 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
aseywi-qwuenc-uersn-01.com/template/waydoaxn/images/video-play.png
200 OK 1.6 kB URL HTTP/1.1 aseywi-qwuenc-uersn-01.com/template/waydoaxn/images/video-play.png
IP
File type PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced\012- data
Hash be7ca0a4a7c0317398a11162b1e09b75
5dbe6a02524cfbf5f5111478a71f91a9259056b5
cbad06b58f97516faa5f745d4e09716b5db3f134d5b4644b159681aa24909dd4
GET /template/waydoaxn/images/video-play.png HTTP/1.1
Host: aseywi-qwuenc-uersn-01.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/template/waydoaxn/css/zui.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sun, 24 Jan 2021 07:28:46 GMT
Accept-Ranges: bytes
ETag: "4081698d22f2d61:0"
Server: nginx/0.6.39
Set-Cookie: _d_id=93c0ac6320bad79a6bc55b6989b79d; Path=/; HttpOnly
Date: Sat, 12 Nov 2022 15:11:09 GMT
Content-Length: 1567
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6ad0161e8367dde2c36f1cfb4865f7b2
3d5e87d559d0578dcb90fe64cbd158fef81e14e5
5560ec898e8393f0c4111419fe342ac8094af0fb374843075f27854a465fbd67
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5560EC898E8393F0C4111419FE342AC8094AF0FB374843075F27854A465FBD67"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2798
Expires: Sat, 12 Nov 2022 15:57:53 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e6cc526ab7701c88aba67fd7b5ca186b
f360b0c5544f901cc5947c4981fc1f0f0a1ce7c5
e1c80a4cea7961efa5cf2f29fd0fc47d66456d33675542650884a3876f3897db
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E1C80A4CEA7961EFA5CF2F29FD0FC47D66456D33675542650884A3876F3897DB"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3457
Expires: Sat, 12 Nov 2022 16:08:52 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
kvexx.com/0385a02384cf8bb1f4b429d18548cbd7.gif
301 Moved Permanently 162 B URL HTTP/2 kvexx.com/0385a02384cf8bb1f4b429d18548cbd7.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /0385a02384cf8bb1f4b429d18548cbd7.gif HTTP/1.1
Host: kvexx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvhuuu.top/0385a02384cf8bb1f4b429d18548cbd7.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kzeii.com/8d62ac139591ff0c5f17d4c5f1ff3cf6.gif
301 Moved Permanently 162 B URL HTTP/2 kzeii.com/8d62ac139591ff0c5f17d4c5f1ff3cf6.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /8d62ac139591ff0c5f17d4c5f1ff3cf6.gif HTTP/1.1
Host: kzeii.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvhfff.top/8d62ac139591ff0c5f17d4c5f1ff3cf6.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kzerr.com/6fb5deabda1e984b6bd49b2baa8dfa10.gif
301 Moved Permanently 162 B URL HTTP/2 kzerr.com/6fb5deabda1e984b6bd49b2baa8dfa10.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /6fb5deabda1e984b6bd49b2baa8dfa10.gif HTTP/1.1
Host: kzerr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvkccc.top/6fb5deabda1e984b6bd49b2baa8dfa10.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvemm.com/c70f7dd4a4c94432f7e7dfd8886c435b.gif
301 Moved Permanently 162 B URL HTTP/2 kvemm.com/c70f7dd4a4c94432f7e7dfd8886c435b.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /c70f7dd4a4c94432f7e7dfd8886c435b.gif HTTP/1.1
Host: kvemm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvknnn.top/c70f7dd4a4c94432f7e7dfd8886c435b.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kveff.com/5acaa66e30e443214f59a6b31654a54e.gif
301 Moved Permanently 162 B URL HTTP/2 kveff.com/5acaa66e30e443214f59a6b31654a54e.gif
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /5acaa66e30e443214f59a6b31654a54e.gif HTTP/1.1
Host: kveff.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvteee.top/5acaa66e30e443214f59a6b31654a54e.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e6cc526ab7701c88aba67fd7b5ca186b
f360b0c5544f901cc5947c4981fc1f0f0a1ce7c5
e1c80a4cea7961efa5cf2f29fd0fc47d66456d33675542650884a3876f3897db
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E1C80A4CEA7961EFA5CF2F29FD0FC47D66456D33675542650884A3876F3897DB"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3413
Expires: Sat, 12 Nov 2022 16:08:08 GMT
Date: Sat, 12 Nov 2022 15:11:15 GMT
Connection: keep-alive
kzeaa.com/57d302c9956928857573010dc47c3edf.gif
301 Moved Permanently 162 B URL HTTP/2 kzeaa.com/57d302c9956928857573010dc47c3edf.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /57d302c9956928857573010dc47c3edf.gif HTTP/1.1
Host: kzeaa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvheee.top/57d302c9956928857573010dc47c3edf.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kveff.com/68a7807de3933bf7079116fa9df99e6f.gif
301 Moved Permanently 162 B URL HTTP/2 kveff.com/68a7807de3933bf7079116fa9df99e6f.gif
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /68a7807de3933bf7079116fa9df99e6f.gif HTTP/1.1
Host: kveff.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvteee.top/68a7807de3933bf7079116fa9df99e6f.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvemm.com/ec9fcd758df74f805f29f72e8545d13b.gif
301 Moved Permanently 162 B URL HTTP/2 kvemm.com/ec9fcd758df74f805f29f72e8545d13b.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /ec9fcd758df74f805f29f72e8545d13b.gif HTTP/1.1
Host: kvemm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvknnn.top/ec9fcd758df74f805f29f72e8545d13b.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kzerr.com/088dd32a701a1e73cabc4ae46ece3879.gif
301 Moved Permanently 162 B URL HTTP/2 kzerr.com/088dd32a701a1e73cabc4ae46ece3879.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /088dd32a701a1e73cabc4ae46ece3879.gif HTTP/1.1
Host: kzerr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvkccc.top/088dd32a701a1e73cabc4ae46ece3879.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kveww.com/99462c01e85acc1311bebac224df6cce.gif
301 Moved Permanently 162 B URL HTTP/2 kveww.com/99462c01e85acc1311bebac224df6cce.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /99462c01e85acc1311bebac224df6cce.gif HTTP/1.1
Host: kveww.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvhzzz.top/99462c01e85acc1311bebac224df6cce.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kzecc.com/2dafd276863e05cd86626a2b7b394960.gif
301 Moved Permanently 162 B URL HTTP/2 kzecc.com/2dafd276863e05cd86626a2b7b394960.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /2dafd276863e05cd86626a2b7b394960.gif HTTP/1.1
Host: kzecc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvkooo.top/2dafd276863e05cd86626a2b7b394960.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kzecc.com/8fdce7479dd03f1ee73805e8d2e9bab8.gif
301 Moved Permanently 162 B URL HTTP/2 kzecc.com/8fdce7479dd03f1ee73805e8d2e9bab8.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /8fdce7479dd03f1ee73805e8d2e9bab8.gif HTTP/1.1
Host: kzecc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvkooo.top/8fdce7479dd03f1ee73805e8d2e9bab8.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=984956817&si=1a85169089bc020cf82521c1e705809e&v=1.2.97&lv=1&sn=6914&r=0&ww=1280&ct=!!&u=http%3A%2F%2Fwww.agubar.com%2Findex.php&tt=%E9%BB%84%E5%B1%B1%E5%88%A8%E8%B0%82%E8%A3%85%E9%A5%B0%E8%AE%BE%E8%AE%A1%E5%B7%A5%E7%A8%8B%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=984956817&si=1a85169089bc020cf82521c1e705809e&v=1.2.97&lv=1&sn=6914&r=0&ww=1280&ct=!!&u=http%3A%2F%2Fwww.agubar.com%2Findex.php&tt=%E9%BB%84%E5%B1%B1%E5%88%A8%E8%B0%82%E8%A3%85%E9%A5%B0%E8%AE%BE%E8%AE%A1%E5%B7%A5%E7%A8%8B%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=984956817&si=1a85169089bc020cf82521c1e705809e&v=1.2.97&lv=1&sn=6914&r=0&ww=1280&ct=!!&u=http%3A%2F%2Fwww.agubar.com%2Findex.php&tt=%E9%BB%84%E5%B1%B1%E5%88%A8%E8%B0%82%E8%A3%85%E9%A5%B0%E8%AE%BE%E8%AE%A1%E5%B7%A5%E7%A8%8B%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.agubar.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Sat, 12 Nov 2022 15:11:15 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=99E443A224307782; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
kveww.com/2d9e99d0532fbc12eded53b70c20d64d.gif
301 Moved Permanently 162 B URL HTTP/2 kveww.com/2d9e99d0532fbc12eded53b70c20d64d.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /2d9e99d0532fbc12eded53b70c20d64d.gif HTTP/1.1
Host: kveww.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvhzzz.top/2d9e99d0532fbc12eded53b70c20d64d.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvemm.com/b1dec1c6aa5f13c7681a48b3a87fa578.gif
301 Moved Permanently 162 B URL HTTP/2 kvemm.com/b1dec1c6aa5f13c7681a48b3a87fa578.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /b1dec1c6aa5f13c7681a48b3a87fa578.gif HTTP/1.1
Host: kvemm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvknnn.top/b1dec1c6aa5f13c7681a48b3a87fa578.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvemm.com/9b68c13628d3eda27f139dbcab11f1e5.gif
301 Moved Permanently 162 B URL HTTP/2 kvemm.com/9b68c13628d3eda27f139dbcab11f1e5.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /9b68c13628d3eda27f139dbcab11f1e5.gif HTTP/1.1
Host: kvemm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvknnn.top/9b68c13628d3eda27f139dbcab11f1e5.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
kvezz.com/d8766c5ff8e42ad5dafb8044a9ffd1e1.gif
301 Moved Permanently 162 B URL HTTP/2 kvezz.com/d8766c5ff8e42ad5dafb8044a9ffd1e1.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /d8766c5ff8e42ad5dafb8044a9ffd1e1.gif HTTP/1.1
Host: kvezz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:15 GMT
content-type: text/html
content-length: 162
location: https://kvkggg.top/d8766c5ff8e42ad5dafb8044a9ffd1e1.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
zerossl.ocsp.sectigo.com/
200 OK 728 B URL HTTP/1.1 zerossl.ocsp.sectigo.com/
IP
Hash 8cbbea900144c3afa5e649ec318911ca
b2c8527bbc812e2582330968468ac3d7f92ca332
6afd3c45ff5a74e98f14457210f24b6daaf8eebbcc2a5fe62b11ffe36ac4b211
POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 728
Connection: keep-alive
Last-Modified: Fri, 11 Nov 2022 11:09:42 GMT
Expires: Fri, 18 Nov 2022 11:09:41 GMT
Etag: "b2c8527bbc812e2582330968468ac3d7f92ca332"
Cache-Control: max-age=503304,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769032ffef90b517-OSL
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash 99ce787c80b6750351aff98acd34b9af
527a137f800bd3a0ac2e9db26838eb3dbc72d833
4ab94ab117f4a4cafe073cf6622c4507ae175c03fbd461246fe3f90178892c46
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Wed, 16 Nov 2022 13:46:47 GMT
ETag: "527a137f800bd3a0ac2e9db26838eb3dbc72d833"
Last-Modified: Sat, 12 Nov 2022 13:46:48 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 769032ff4d92b51d-OSL
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash 99ce787c80b6750351aff98acd34b9af
527a137f800bd3a0ac2e9db26838eb3dbc72d833
4ab94ab117f4a4cafe073cf6622c4507ae175c03fbd461246fe3f90178892c46
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Wed, 16 Nov 2022 13:46:47 GMT
ETag: "527a137f800bd3a0ac2e9db26838eb3dbc72d833"
Last-Modified: Sat, 12 Nov 2022 13:46:48 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 769032ff4da70b59-OSL
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 84fd9679523653df6660d37f00b1b68f
61b0327dd765acc8617c4c6655786bef75326a91
1d600144f759877e4aa585bdf204b40536b4911b94af8ed0725b5d302e9d7def
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Fri, 11 Nov 2022 19:09:50 GMT
Expires: Sat, 12 Nov 2022 19:09:50 GMT
ETag: "61b0327dd765acc8617c4c6655786bef75326a91"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 84fd9679523653df6660d37f00b1b68f
61b0327dd765acc8617c4c6655786bef75326a91
1d600144f759877e4aa585bdf204b40536b4911b94af8ed0725b5d302e9d7def
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Fri, 11 Nov 2022 19:09:50 GMT
Expires: Sat, 12 Nov 2022 19:09:50 GMT
ETag: "61b0327dd765acc8617c4c6655786bef75326a91"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 84fd9679523653df6660d37f00b1b68f
61b0327dd765acc8617c4c6655786bef75326a91
1d600144f759877e4aa585bdf204b40536b4911b94af8ed0725b5d302e9d7def
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Fri, 11 Nov 2022 19:09:50 GMT
Expires: Sat, 12 Nov 2022 19:09:50 GMT
ETag: "61b0327dd765acc8617c4c6655786bef75326a91"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.sectigo.com/
200 OK 472 B IP
Hash 195d3a9db207274f9b46639e59697080
80cf4a147bd070468bacda737c35af39b9371cb8
92f83a10bc601bc2837d41c960595e32465bfd9d66c9a4b4e4bff50fd94eef89
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 12 Nov 2022 03:24:53 GMT
Expires: Sat, 19 Nov 2022 03:24:52 GMT
Etag: "80cf4a147bd070468bacda737c35af39b9371cb8"
Cache-Control: max-age=561815,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76903301f856b527-OSL
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash a8f270f7d7b5cd12ed48a114d39879e9
f389f5d589960a6c8a1fd13249f6670d4e74d1db
e729ea58994f7e6da0ccd690183315bb22eb24c510ef8491a26705be3ca20b35
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "E729EA58994F7E6DA0CCD690183315BB22EB24C510EF8491A26705BE3CA20B35"
Last-Modified: Fri, 11 Nov 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21556
Expires: Sat, 12 Nov 2022 21:10:32 GMT
Date: Sat, 12 Nov 2022 15:11:16 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 7fcd7ac46ab92f90339f620feb34a629
d8839d496f75aaecff8e30cc25b335cd535ec1e2
1f54e2d58fe8e4d7e543ad9d18038f427b47bab82a9ab9a06ce1d0f0b2c6125a
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "1F54E2D58FE8E4D7E543AD9D18038F427B47BAB82A9AB9A06CE1D0F0B2C6125A"
Last-Modified: Thu, 10 Nov 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15652
Expires: Sat, 12 Nov 2022 19:32:08 GMT
Date: Sat, 12 Nov 2022 15:11:16 GMT
Connection: keep-alive
666999123.com/tu/66x66.gif
200 OK 37 kB URL HTTP/2 666999123.com/tu/66x66.gif
IP
File type GIF image data, version 89a, 66 x 66\012- data
Hash 361de468c9f830884954f7cad315550d
54dd6c8caa63b563f1d977d448ef0d7e9836c2aa
f326ade0a98b296dd1d37d23d24be718a268421cec81e220b7c361074a9f88cd
GET /tu/66x66.gif HTTP/1.1
Host: 666999123.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:16 GMT
content-type: image/gif
content-length: 37400
last-modified: Thu, 25 Aug 2022 14:56:23 GMT
etag: "63078d97-9218"
expires: Tue, 29 Nov 2022 20:26:01 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1104482
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DRedPZqBcuL9uNtL8gYjSzTqVji0ebLeTK%2BXH%2FIA3eVhh9BZtQslNigzAs3HSs6LJC%2FeHah1dQin4ojRBM1ej06Dsoj33%2FMeucf%2BT5MMZCC3Q%2F95Yw1cLNcrcI4Oq2WB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033028991b4f7-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
666999123.com/tu/960x80.gif
200 OK 66 kB URL HTTP/2 666999123.com/tu/960x80.gif
IP
File type GIF image data, version 89a, 960 x 80\012- data
Hash 533088f482b5d674e3c5fc25279e0037
29b6daf86814e89dfc9b93cc97ff61c06d190fac
61dfa09f1abc9d378aaf0f9c2dc2b5a9f6b3de5bdfb63fe42887d1c5a6d8f3ca
GET /tu/960x80.gif HTTP/1.1
Host: 666999123.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:16 GMT
content-type: image/gif
content-length: 65451
last-modified: Thu, 25 Aug 2022 14:15:02 GMT
etag: "630783e6-ffab"
expires: Thu, 08 Dec 2022 04:35:42 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 383914
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gUr6PSznHtJFIbsvA4tpAXUP%2Fou3SenW9M71dpG0W2teZWEES2RIm127FU0mbig6U3lR9vjHaHh5rB7AQDMtLaZqnmWBkPo%2FXWFgcGTVImeugSndVew5UD%2BeaH41iLmG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903302c9eeb4f7-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash efb7be1d83ef8de280de7214acd6aefd
6730d0b912303101c295b1e357edcbc1428b34b0
ac9b1bf4f195da2065a940424096e9d8e24f7f3fc40f050b4cd717561322377f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 03:31:15 GMT
Expires: Thu, 17 Nov 2022 03:31:14 GMT
Etag: "6730d0b912303101c295b1e357edcbc1428b34b0"
Cache-Control: max-age=389397,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7690330298feb527-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash 51080e19405b04e6fc7c8a41be02d787
82c5bc57519f3ef753e6a7ab7adf34558b8c04e8
b1581b526c34b2b8f83c48470e88d709aed353980a19730ae540aaf1cc7bb384
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 11 Nov 2022 20:52:31 GMT
Expires: Fri, 18 Nov 2022 20:52:30 GMT
Etag: "82c5bc57519f3ef753e6a7ab7adf34558b8c04e8"
Cache-Control: max-age=538273,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76903302d80bb4eb-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash a1f23c21b61efd571d95e441bb5e59ad
a78598d5e0f0a423578a238ae1b9239bcec3b8be
ad999c2474cf698868b35266da31bd244c1b154163f0ed96f48ace0103570852
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 16:52:22 GMT
Expires: Thu, 17 Nov 2022 16:52:21 GMT
Etag: "a78598d5e0f0a423578a238ae1b9239bcec3b8be"
Cache-Control: max-age=437464,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76903301fca6b4f9-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash 8b4dfcd4cad745f4aa3d239bf919874d
28d5314a34d1a8b256b73c0308fc13ed70190272
a8f4d5ff779c22b3dc5763e6d082ad603d7e0bdca66ec26e4baa767a8c3dbc31
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 11 Nov 2022 06:26:17 GMT
Expires: Fri, 18 Nov 2022 06:26:16 GMT
Etag: "28d5314a34d1a8b256b73c0308fc13ed70190272"
Cache-Control: max-age=486298,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769033033a4eb527-OSL
ocsp.digicert.com/
200 OK 279 B IP
Hash f3653fc4145a530506fbd9b7b7146ea8
132f2ee953057b9fe3a13d007ce7e0a721e5601f
428e765efe938e92a3e4da0abc75c3c274075b8374f72ad877f3b9724a0eda5a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=163548
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:16 GMT
Etag: "636f9370-117"
Expires: Mon, 14 Nov 2022 12:37:04 GMT
Last-Modified: Sat, 12 Nov 2022 12:37:04 GMT
Server: nginx
Content-Length: 279
8357.app/images/111.gif
200 OK 235 kB IP
File type GIF image data, version 89a, 950 x 60\012- data
Size 235 kB (235089 bytes)
Hash ce54fdef11a4b49711f4972717259e2c
d23e1ffcde7629b62300529d9193f53a6602dd0a
630298b0df9948f0cf5647484627e4f7276315cc13328271714f2d033cdb4d46
GET /images/111.gif HTTP/1.1
Host: 8357.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Thu, 10 Nov 2022 08:54:22 GMT
Accept-Ranges: bytes
ETag: "b0a9f76e2f4d81:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 12 Nov 2022 15:10:56 GMT
Content-Length: 235089
aooacctp.com/logotp/xfb63.gif
200 OK 801 kB URL HTTP/2 aooacctp.com/logotp/xfb63.gif
IP
File type GIF image data, version 89a, 200 x 200\012- data
Size 801 kB (800906 bytes)
Hash b67d8e3b2e6a17ef65cca5924479bcaf
170f0e54f86d9fe303bca99f7524cee878289a3f
2b6a9b53114e36c800d36b460001279b5b27d86ad0b0f79d71bd5157d7d2ba8c
GET /logotp/xfb63.gif HTTP/1.1
Host: aooacctp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:16 GMT
content-type: image/gif
content-length: 800906
last-modified: Sun, 14 Aug 2022 07:55:32 GMT
etag: "62f8aa74-c388a"
expires: Sat, 10 Dec 2022 11:03:51 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 147266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tP1vGJkh%2BtcPyV7vfRJQ6IWOOsYIm7QM1bqDxzSmdaHfTveBHDt03Vqe8msKDnaC3nsT6VPfP1cct%2BblVZrZS1uTDowPTiHsxBjhpA%2B1DS6n8VxDulongHe6CD6TBCg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903302bb8972ba-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash d043d697a65f9ac19797783ab7f221a0
8c2a6b54d4167b8fdb5bf21c2d1c70bdcf24ec63
39f0e028e14c9f6b5c03e4af36a91fafe2c59e89ee4eae8ce5c4c7538b37ad6a
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 09 Nov 2022 17:12:54 GMT
Expires: Wed, 16 Nov 2022 17:12:53 GMT
Etag: "8c2a6b54d4167b8fdb5bf21c2d1c70bdcf24ec63"
Cache-Control: max-age=352295,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769033039accb527-OSL
ocsp.sectigo.com/
200 OK 472 B IP
Hash 4ba14371e1cf4d95db3762d3ba2d2f47
a5bb868fffa6e5b46d4f15a131640beb3433acc8
a6f62ea742ecfd7f8ec474b16e641b5deb8686ad71c76c37f226c4f4e7a8e84c
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 12 Nov 2022 02:24:37 GMT
Expires: Sat, 19 Nov 2022 02:24:36 GMT
Etag: "a5bb868fffa6e5b46d4f15a131640beb3433acc8"
Cache-Control: max-age=558198,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76903302cfffb4eb-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash 850005765db8ccf0b1b9703166825f26
c50762ed7ad9fd2e42f9543e3b4fed04bb86d23d
615214573d14fb155d9fe9c56944f494c6c160b3f6cd96541a113065cc317f5d
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 23:03:10 GMT
Expires: Thu, 17 Nov 2022 23:03:09 GMT
Etag: "c50762ed7ad9fd2e42f9543e3b4fed04bb86d23d"
Cache-Control: max-age=459711,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76903303aebbb4f9-OSL
ocsp.pki.goog/s/gts1p5/t1eJGFHGm7w
200 OK 471 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/t1eJGFHGm7w
IP
Hash 183d58ed5186cc91a86aa56ec4159de2
0c5374b8345ec403f31fa34f5fa57c2852691712
45433b6de39ae016469ee8323ec67f042eff4c7855fa2aa3463f55018cb6d9cc
POST /s/gts1p5/t1eJGFHGm7w HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/yJiqwzofsT4
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/yJiqwzofsT4
IP
Hash 0631c4d225074b6cef432f63257d7e52
7b388c56e7d805d755c4e9bb11013d78ebbfc683
9f39603a5e664dd6902192a96c24277cd30d72016844b95bf8c37a7e01b0f8f5
POST /s/gts1p5/yJiqwzofsT4 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.tukudhgg.vip/lm/klm01.gif
200 OK 78 kB URL HTTP/2 www.tukudhgg.vip/lm/klm01.gif
IP
File type GIF image data, version 89a, 320 x 190\012- data
Hash f12d32b75b26394038be19df19aea586
286e3cee23dee594ce497c1f2020ccb842e0ae69
06a090053e07f41505d1949525aa511001d14069cb8560f933d60740f9e3eba9
GET /lm/klm01.gif HTTP/1.1
Host: www.tukudhgg.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 78524
last-modified: Wed, 24 Aug 2022 10:34:37 GMT
etag: "6305febd-132bc"
expires: Sun, 04 Dec 2022 02:26:51 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 696704
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DRGIwYmw2qy4eA3fpAtyX38dr7FKlMI1r4hzJrLOX9U9ixdgQbE%2B7YaANK4uR16bl87yxmQ707302a01CTzuCdoY6ftS8SLUN3n7W7VRLrhEA%2FRzzDNPNbKeIPcPuoOHZ6It"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033047f68fac0-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvkggg.top/95ca29ec3907b3bf2d8a24b35e3eda22.gif
200 OK 400 kB URL HTTP/2 kvkggg.top/95ca29ec3907b3bf2d8a24b35e3eda22.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 400 kB (400264 bytes)
Hash b722c3905b96f11823e04826aafdd50e
68b63b572a042d40ab210aa313b7ebbc372be5a1
630c6a955789d5bb6311db75ce52e57ff4c12074ef5a5a080cf5459f907e9dc1
GET /95ca29ec3907b3bf2d8a24b35e3eda22.gif HTTP/1.1
Host: kvkggg.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 400264
last-modified: Mon, 02 May 2022 19:22:39 GMT
etag: "62702f7f-61b88"
expires: Sat, 10 Dec 2022 11:40:47 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 185430
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p3IP81bNFTcu4ittdKhLlS07svXsZe73raA%2FVsEQ47r1yQ3lu9lXC2fShSDiBRtiwfyMZ1MMMXVGRJOnH%2FZluqbTfsRKTqEl6j1rb57Nn76wFpgyrVgeSFrSVWzo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7690330488c71c0a-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash 28705666c96b81c641f97c79c2d19c3b
f6e6571a65801d75642fd2b9226438e41970a13b
116f8694f933519f9cce7bf98c0f76533fb1452ff7425dab574d160ffd346e75
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 09 Nov 2022 08:49:47 GMT
Expires: Wed, 16 Nov 2022 08:49:46 GMT
Etag: "f6e6571a65801d75642fd2b9226438e41970a13b"
Cache-Control: max-age=322108,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7690330348a7b4eb-OSL
ocsp.pki.goog/s/gts1p5/yJiqwzofsT4
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/yJiqwzofsT4
IP
Hash 0631c4d225074b6cef432f63257d7e52
7b388c56e7d805d755c4e9bb11013d78ebbfc683
9f39603a5e664dd6902192a96c24277cd30d72016844b95bf8c37a7e01b0f8f5
POST /s/gts1p5/yJiqwzofsT4 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
i.niupic.com/images/2022/10/05/a685.jpg
206 Partial Content 22 kB URL HTTP/2 i.niupic.com/images/2022/10/05/a685.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 240x240, components 3\012- data
Hash c544a3f1e21f24d74be86c4dd02b2230
50bc460a4384daec38ef96175d1ba12673e42548
a912dc483c157f5d78fde58e096b1fdf00ef1a8f81a2b0a1f407c4d53fa97add
GET /images/2022/10/05/a685.jpg HTTP/1.1
Host: i.niupic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 206 Partial Content
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/jpeg
content-length: 21540
content-range: bytes 0-21539/21540
last-modified: Tue, 04 Oct 2022 18:36:15 GMT
x-rgw-object-type: Normal
etag: "c544a3f1e21f24d74be86c4dd02b2230"
x-amz-request-id: tx00000000000001b333441-00633c7d3f-39cb2b34-default
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
x-cache-status: HIT
x-client-cc: JP
x-client-ip: 162.158.118.61
x-edge-name: jphnd2
x-edge-ip: 172.104.82.88
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SuFd3LLiScBOuuLlPkhUXptyKySyiwNLxj3lsqCmWSNNN4umxplpO4wFX%2FA3CQRBAEbHdu9qjkuUV7TWl3sEW%2B1HlpKh4SRnnn1r2eOttyjjERDZBkoLf18gJfZKN9M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903302d8837777-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvkggg.top/d8766c5ff8e42ad5dafb8044a9ffd1e1.gif
200 OK 38 kB URL HTTP/2 kvkggg.top/d8766c5ff8e42ad5dafb8044a9ffd1e1.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash 84051de17ff2fbe6c2af3e15319f4de8
a8013e3dbbd4bbe5bb25e2ee1da2e34f2c5b8a47
62801552ce63b30c91b5e476981f7d85e808025c2e15d82bcb103b3884f64ad8
GET /d8766c5ff8e42ad5dafb8044a9ffd1e1.gif HTTP/1.1
Host: kvkggg.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 37847
last-modified: Mon, 02 May 2022 19:12:15 GMT
etag: "62702d0f-93d7"
expires: Sat, 10 Dec 2022 13:33:14 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 178683
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8T%2FtwxXRHVIr16qJ%2Flr9xEBzgAg6F9Wo2521u%2Fn4cYehvqPeB2mmg4uAuu%2BYBywFrT4LBkey%2B9aSUC8vmhrw6Cv2gQeWyjRYcfiUPSVq3mcNncgXMQ7lWbpSyIBW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903304d8fc1c0a-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b0039b4efa155ff6a2f38950e4a0ba3
667ac4efbc770095097558e8444f53c747bbd448
bdaf9e874f20ba01a2618c2650647095ec8d988f64a0ae656ea282833b5d9647
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDAF9E874F20BA01A2618C2650647095EC8D988F64A0AE656EA282833B5D9647"
Last-Modified: Fri, 11 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3303
Expires: Sat, 12 Nov 2022 16:06:20 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
8499483.com/8499/960x60.gif
200 OK 331 kB URL HTTP/2 8499483.com/8499/960x60.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 331 kB (331043 bytes)
Hash 09f29e56330449942571a66f47f82fb5
30fc3421671176f6f724f32ee910470f03661ddc
b1a0f29b0a924b51c844351bddb87fddf9fa4ef5909f69f818e968f18413a725
GET /8499/960x60.gif HTTP/1.1
Host: 8499483.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:16 GMT
content-type: image/gif
content-length: 331043
last-modified: Wed, 09 Nov 2022 06:22:39 GMT
etag: "50d23-5ed03aef4304d"
server: qq.com
x-cache-status: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash d0cc945eb786a72db60816daecf76e3c
90dcaa6f255207406e188382439d32f73b40a9a5
9040cb9377ca22502ec558578cbe58637610a1b5eca32219f67ecebe8b34a0c0
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "9040CB9377CA22502EC558578CBE58637610A1B5ECA32219F67ECEBE8B34A0C0"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16678
Expires: Sat, 12 Nov 2022 19:49:15 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
ocsp.sectigo.com/
200 OK 472 B IP
Hash 28705666c96b81c641f97c79c2d19c3b
f6e6571a65801d75642fd2b9226438e41970a13b
116f8694f933519f9cce7bf98c0f76533fb1452ff7425dab574d160ffd346e75
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 09 Nov 2022 08:49:47 GMT
Expires: Wed, 16 Nov 2022 08:49:46 GMT
Etag: "f6e6571a65801d75642fd2b9226438e41970a13b"
Cache-Control: max-age=322108,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769033043bb9b527-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 41d96586e8b86955f267954a18f4bc41
3805c31998c35827e30029ef9b5d0f3adc90bb63
4338123d26fe8046dcfd84cd650de961a800e62b0c67cbe6f06a483f57654066
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4338123D26FE8046DCFD84CD650DE961A800E62B0C67CBE6F06A483F57654066"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16799
Expires: Sat, 12 Nov 2022 19:51:16 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
8357.app/images/222.gif
200 OK 532 kB IP
File type GIF image data, version 89a, 960 x 120\012- data
Size 532 kB (531920 bytes)
Hash e74d49a1c2617c360791835f66cfcdfa
c6df43d2eb3d74a1d9786d8a79a379eff3ad1461
7ba844b237d93bbc66b51a5dcd87f459a40d4a07a0fdbb9518c9ebe97979c519
GET /images/222.gif HTTP/1.1
Host: 8357.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Fri, 11 Nov 2022 14:56:31 GMT
Accept-Ranges: bytes
ETag: "c080e3c8ddf5d81:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 12 Nov 2022 15:10:56 GMT
Content-Length: 531920
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash d0cc945eb786a72db60816daecf76e3c
90dcaa6f255207406e188382439d32f73b40a9a5
9040cb9377ca22502ec558578cbe58637610a1b5eca32219f67ecebe8b34a0c0
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "9040CB9377CA22502EC558578CBE58637610A1B5ECA32219F67ECEBE8B34A0C0"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Sat, 12 Nov 2022 21:11:17 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 278 B IP
Hash 9dc14eed39594774b2274801dedb801f
40428ecd18e0acbde9d8736a6a97fbb3c4945fd0
5faa00e1d668277941b46c464c2bfa1847cdbf672535ea772fb0a445d47c1c4a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=97680
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Etag: "636e9225-116"
Expires: Sun, 13 Nov 2022 18:19:17 GMT
Last-Modified: Fri, 11 Nov 2022 18:19:17 GMT
Server: nginx
Content-Length: 278
kvhfff.top/8d62ac139591ff0c5f17d4c5f1ff3cf6.gif
200 OK 566 kB URL HTTP/2 kvhfff.top/8d62ac139591ff0c5f17d4c5f1ff3cf6.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 566 kB (565615 bytes)
Hash 6a2c609ad0c46bb1b8d9cd39eacde625
45de0f50f86b45dd6fd4a1c764d47e2640126bf3
8eb8f61188f2555f5f7f0a934ebbae9e9ab703a3dc0b23191bdc7c147eb12140
GET /8d62ac139591ff0c5f17d4c5f1ff3cf6.gif HTTP/1.1
Host: kvhfff.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 565615
last-modified: Mon, 10 Oct 2022 13:11:33 GMT
etag: "63441a05-8a16f"
expires: Fri, 09 Dec 2022 15:05:17 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 259560
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eU8RC5fmJhpDYyv1BcUF6GSQwmGXrq4MC3qG3iSkB8KUtRdmSzST4cZ2lC3P%2FNqzm4hDUMRxlOjZ%2FWgA0y2Qd5gAp6srxdSf6LtNL3w8d%2F3Rz3Ui6B8oM%2Fxi7my4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033059df90b45-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvknnn.top/9b68c13628d3eda27f139dbcab11f1e5.gif
200 OK 20 kB URL HTTP/2 kvknnn.top/9b68c13628d3eda27f139dbcab11f1e5.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash b7f61bdb0706ca9b8dc0e4e68969ccb5
83e028495d819cffaaa3b0af6f298d069d66868a
a98a0838ccbb96ade4d4c5593381de618ca9c15b3bea2885f8be6d911f73a7b6
GET /9b68c13628d3eda27f139dbcab11f1e5.gif HTTP/1.1
Host: kvknnn.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 19807
last-modified: Sun, 13 Mar 2022 11:17:20 GMT
etag: "622dd2c0-4d5f"
expires: Sat, 10 Dec 2022 12:28:59 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 182538
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ks8gWAeYTAcpfTmnMuXkElOZAquzWh2xUdZFerIbSnXYOkJ5NR4r3a3YTP1kYeiF94E%2FWY5a6o50m4OECDOBlWsJvmjR1i9Us2J6FE9T6uPQWNkdsD1biFcdGZ5d"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033060e56b51d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvheee.top/92f0c144d76dd785f7c04f84ae149b33.gif
200 OK 1.0 MB URL HTTP/2 kvheee.top/92f0c144d76dd785f7c04f84ae149b33.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 1.0 MB (1024160 bytes)
Hash 52748c8ca30fe48c822541046bceafc0
8640926f83b9c0d635fb28403505a7c0f0753857
2e292531362f37bf7a1cd01330efb234450b1f836e975c55f2b2179c0be32ae6
GET /92f0c144d76dd785f7c04f84ae149b33.gif HTTP/1.1
Host: kvheee.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 1024160
last-modified: Wed, 25 May 2022 13:49:10 GMT
etag: "628e33d6-fa0a0"
expires: Fri, 25 Nov 2022 09:42:30 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1488527
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3%2FRqWrf7CykOskN9%2FY863Y7TBf%2BQvMmIqhh%2FP9FgdiHqT%2Bf%2FxbEGZUuRZcldKdEzLgjk1jtpBdaGNEX4qJpAvJc%2F7hMN0daBahI9uhz6zAUsgOe2dmG%2BkDmKJJ2i"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033059f4f88aa-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash 9dc14eed39594774b2274801dedb801f
40428ecd18e0acbde9d8736a6a97fbb3c4945fd0
5faa00e1d668277941b46c464c2bfa1847cdbf672535ea772fb0a445d47c1c4a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=97680
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Etag: "636e9225-116"
Expires: Sun, 13 Nov 2022 18:19:17 GMT
Last-Modified: Fri, 11 Nov 2022 18:19:17 GMT
Server: nginx
Content-Length: 278
kvknnn.top/ec9fcd758df74f805f29f72e8545d13b.gif
200 OK 902 kB URL HTTP/2 kvknnn.top/ec9fcd758df74f805f29f72e8545d13b.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 902 kB (902313 bytes)
Hash 8b4a95ea7cfbb7fb4d2b18efca5145f3
d2966ecbeb7369620cce5dbcd15d0fe591d79648
dd5ff25f4d6931bd3d2ef86c1a8901853ee2503fd2d6edb264a61abb37c2b002
GET /ec9fcd758df74f805f29f72e8545d13b.gif HTTP/1.1
Host: kvknnn.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 902313
last-modified: Sat, 12 Mar 2022 15:17:28 GMT
etag: "622cb988-dc4a9"
expires: Sat, 10 Dec 2022 12:08:02 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 183795
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nYBvb%2F4vSeWOWYeRMTVn%2FmkmX0SYJAXXChGkkQP9kcHCXeVyNHIlLK7IJE0kg%2FtrswLYIA77lIlVThHc3kxwA4uOzoZCai8xAqlkLnWTY9NxNfUw0vpnOHkiq%2FrN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033068ee0b51d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 850d3eac54859b7eb04bb5e4a1086aaf
a740230990592bf3aa4cf9854cf4fccff61a5dcd
f24055be4b0fb902031b365897fb66a30edd36b15daac0487e15bdb643c54e20
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "F24055BE4B0FB902031B365897FB66A30EDD36B15DAAC0487E15BDB643C54E20"
Last-Modified: Fri, 11 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7513
Expires: Sat, 12 Nov 2022 17:16:30 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
u1010.com/0ff7b2a31b1c4ea9848803459ac6daaf.gif
200 OK 70 kB URL HTTP/2 u1010.com/0ff7b2a31b1c4ea9848803459ac6daaf.gif
IP
File type GIF image data, version 89a, 180 x 180\012- data
Hash 67275b45a207b88fdb89464f1e03a46f
3c87e58ce0597a307bd6369163a39df67371b3df
5be4b853f464d46739aa80f7ebfb7f2cfdcd0cee88bc0bf697ba1d243ddc3eb5
GET /0ff7b2a31b1c4ea9848803459ac6daaf.gif HTTP/1.1
Host: u1010.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a1962-11334"
server: nginx
date: Tue, 08 Nov 2022 09:33:33 GMT
content-type: image/gif
last-modified: Tue, 08 Nov 2022 08:54:58 GMT
accept-ranges: bytes
x-cache: HIT from cloud-us4-cdnb-08
content-length: 70452
X-Firefox-Spdy: h2
kvheee.top/57d302c9956928857573010dc47c3edf.gif
200 OK 19 kB URL HTTP/2 kvheee.top/57d302c9956928857573010dc47c3edf.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash 82e93de0d6bacd9bbfc18484a9e3eb94
5f955448a7c50cfd5d10d165f93694f1c46f9586
64902a334f6802036c61101f282dcf57faf1698eae2938434527b7041fe5a1ca
GET /57d302c9956928857573010dc47c3edf.gif HTTP/1.1
Host: kvheee.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 18648
last-modified: Sat, 28 May 2022 12:27:58 GMT
etag: "6292154e-48d8"
expires: Fri, 25 Nov 2022 09:50:09 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1488068
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vjm49IWPlw%2Bp0DwbG3zseEbnifXi01wIca8DwYDK5a0Qq8X1ENdhd7wGNbmUpOH24KUpcQ3walZe2SDgc4cFsRqpHqts8lpd3sSbj07pW1YMP1WKVDcS4z0AOErw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903306a92d88aa-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvknnn.top/c70f7dd4a4c94432f7e7dfd8886c435b.gif
200 OK 1.6 MB URL HTTP/2 kvknnn.top/c70f7dd4a4c94432f7e7dfd8886c435b.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 1.6 MB (1590489 bytes)
Hash 59648e1a4d52551c26255ff6bc625648
165fbacafad21065e9faa33c5e3752cd463549ad
eb53352fe423b9358ba49249e57fe3d55746d854c681f6c45baedb23eb2196e5
GET /c70f7dd4a4c94432f7e7dfd8886c435b.gif HTTP/1.1
Host: kvknnn.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 1590489
last-modified: Sun, 26 Jun 2022 12:04:30 GMT
etag: "62b84b4e-1844d9"
expires: Sat, 10 Dec 2022 12:08:02 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 183795
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yJQRjv3X54wafur7k7IaP285SjZyLjDy5upzbU3VKwMCaRBon3xLydvkuy2Rch%2BGXNy6hzwAVRTGZDVy7YjEOvfBEA9YkW6wEIFgzByjju4mFdxXosxtZNyeC%2BkM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903306cf37b51d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 850d3eac54859b7eb04bb5e4a1086aaf
a740230990592bf3aa4cf9854cf4fccff61a5dcd
f24055be4b0fb902031b365897fb66a30edd36b15daac0487e15bdb643c54e20
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "F24055BE4B0FB902031B365897FB66A30EDD36B15DAAC0487E15BDB643C54E20"
Last-Modified: Fri, 11 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7513
Expires: Sat, 12 Nov 2022 17:16:30 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
u1055.com/2fdaab9735aa4dffa027fd9a820347a6.png
200 OK 57 kB URL HTTP/2 u1055.com/2fdaab9735aa4dffa027fd9a820347a6.png
IP
ASN #7483 Skycloud Computing co., Ltd.
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash ad178154cdc0b94a3fff47990c915c59
d8d45701aee7858d7e9500fb2daf5ef9c1e114c4
f902716fe2369343448788df7f13775c0d0728e6a1afaa8996aeed486464cde9
GET /2fdaab9735aa4dffa027fd9a820347a6.png HTTP/1.1
Host: u1055.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a199e-dd7a"
server: nginx
date: Tue, 08 Nov 2022 09:39:39 GMT
content-type: image/png
last-modified: Tue, 08 Nov 2022 08:55:58 GMT
accept-ranges: bytes
x-cache: HIT from yd11_02-cdn-g01-la2-53
content-length: 56698
X-Firefox-Spdy: h2
u1066.com/5adf5bf76d3a417c8d4ddfc5dc894e4c.png
200 OK 81 kB URL HTTP/2 u1066.com/5adf5bf76d3a417c8d4ddfc5dc894e4c.png
IP
ASN #7483 Skycloud Computing co., Ltd.
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 35e55bd418c0bb1ad4fdf2f2867e5102
7ec6859a8a7f22431ad759435dfac9337890d216
3e9a01ad36d379d7608aad2569be6dd631bab87dbd215bd23d1702a101ad2fbb
GET /5adf5bf76d3a417c8d4ddfc5dc894e4c.png HTTP/1.1
Host: u1066.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a19dd-13b91"
server: nginx
date: Tue, 08 Nov 2022 09:15:49 GMT
content-type: image/png
last-modified: Tue, 08 Nov 2022 08:57:01 GMT
accept-ranges: bytes
x-cache: HIT from yd11_02-cdn-g01-la2-38
content-length: 80785
X-Firefox-Spdy: h2
kvknnn.top/b1dec1c6aa5f13c7681a48b3a87fa578.gif
200 OK 14 kB URL HTTP/2 kvknnn.top/b1dec1c6aa5f13c7681a48b3a87fa578.gif
IP
File type GIF image data, version 89a, 120 x 120\012- data
Hash d7b1b751f7022ee8a84b6323000ad4a5
8e49bd359ae0fc13855f0dbf7ebf45c4dc5b9503
89407d3f62723c801a184698f48907109c3c79750ba52107b8c2409aaae696a8
GET /b1dec1c6aa5f13c7681a48b3a87fa578.gif HTTP/1.1
Host: kvknnn.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 14190
last-modified: Wed, 13 Apr 2022 08:15:03 GMT
etag: "62568687-376e"
expires: Mon, 12 Dec 2022 15:11:17 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5OmyCjx79Ex%2Bt%2Fh%2BZJzs4jmJ9XtsTXAkdSfEUrBncCj%2FnLcfW9ueeRKOl2NiFhN9Q%2Ba8gnpIA%2FNqjcwtiqyY%2FEQP9KggkCeE0O3dMBYoMWp4nxHr2Ct4lGfNHLAH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033064e8bb51d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvkccc.top/088dd32a701a1e73cabc4ae46ece3879.gif
200 OK 17 kB URL HTTP/2 kvkccc.top/088dd32a701a1e73cabc4ae46ece3879.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash e4cd4bfed29a4896ee214a0bc6239e34
e31d91c5c40c2abf201ffd413f0bd1aa3fca3db8
03bdd3867d389d6372988982cc09c9c18241be56ff2d00be54626e8ca6034031
GET /088dd32a701a1e73cabc4ae46ece3879.gif HTTP/1.1
Host: kvkccc.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 16669
last-modified: Sat, 28 May 2022 12:25:39 GMT
etag: "629214c3-411d"
expires: Sun, 04 Dec 2022 19:32:14 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 675543
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W1Be5zlgwPyX78cSXTuQXef%2B5nYGXlU25llfUrbymj%2BjQSNruyRxewv0ylSYZ9FNK8DD%2FmQ%2BX6H5G8%2FkSC4XZXKfW04SXrrDMjpz0PrRaxxG7kLg0d7eKoUbxM52"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7690330779d8b4f3-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
xk3.me/img/sWQr/os3rJzCf6.gif
200 OK 37 kB URL HTTP/1.1 xk3.me/img/sWQr/os3rJzCf6.gif
IP
ASN #59371 Dimension Network & Communication Limited
File type GIF image data, version 89a, 240 x 240\012- data
Hash a7d5e2fce182e61fa0610227ada28f05
f0edb65a755e97a28065ca0ca0c96f33e649d207
ce2052aa4c8b181297f162d0459eaaa8d7fd766c244770eb6afee327e6649ff3
GET /img/sWQr/os3rJzCf6.gif HTTP/1.1
Host: xk3.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"50210-1664882819000"
Last-Modified: Tue, 04 Oct 2022 11:26:59 GMT
Expires: Sun, 27 Nov 2022 15:11:16 GMT
Cache-Control: max-age=1296000
Content-Encoding: gzip
Nginx-Cache: EXPIRED, HIT
www.aoattsetp.vip/logotp/sw.gif
404 Not Found 590 B URL HTTP/2 www.aoattsetp.vip/logotp/sw.gif
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 0c8cbcd6e7ab6cca58640374ea9db321
1a18c7e354c932f2d439fec32807fad421f9d08d
1787595845bb5408805882648ff475669ab67120fd238968b52bb5b4d8ce523b
GET /logotp/sw.gif HTTP/1.1
Host: www.aoattsetp.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: text/html
cache-control: max-age=3600
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iIzGDfEV2QfEqz%2F8I5yLPlzS%2FjjjvRutTNmoASEQVzvafI%2FydMGQySo1xwXAl5KDDr6nVKZf1UTJ%2Br%2BIfjZoH349unOyN9WzUOdvY%2FbF7sQcsJyQGpd2NDsvnBY2beqqnw0%2FPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903303bf4eb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.globalsign.com/gsrsaovsslca2018
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP
Hash 2bbc808c40f1c32d54c3cd3ea47ea0d1
59402d1af5a28a2fe6d5e5e6b1302c397102922c
3cf2467f0ae84cb10d96a40407fa1acc226c70f41a3b0c6567b4b8a19d8fc649
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Wed, 16 Nov 2022 11:10:59 GMT
ETag: "59402d1af5a28a2fe6d5e5e6b1302c397102922c"
Last-Modified: Sat, 12 Nov 2022 11:11:00 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3338
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76903307be67b4f4-OSL
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash 16b7ac1e88a8dd7acd2018d272b5194e
e97c825b32d4e616dfb36c97e8b8ff54458cba1e
76a2a8f70407ce3ff2eee029815451150a4db9001b22f1ee04fca7b2d26e6939
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Wed, 16 Nov 2022 12:46:28 GMT
ETag: "e97c825b32d4e616dfb36c97e8b8ff54458cba1e"
Last-Modified: Sat, 12 Nov 2022 12:46:29 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 769033068ee1b51d-OSL
ocsp.digicert.com/
200 OK 279 B IP
Hash 2a5e823197daf570ba0d7fb231638453
c4ec514cf8de78fe6eb918f7df9e3c32d8536dd3
2fe149be8e8f19ebfbeabc9e898444080805f43eed49a2bb45286d821b75524a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=104148
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Etag: "636eab69-117"
Expires: Sun, 13 Nov 2022 20:07:05 GMT
Last-Modified: Fri, 11 Nov 2022 20:07:05 GMT
Server: nginx
Content-Length: 279
kvkccc.top/6fb5deabda1e984b6bd49b2baa8dfa10.gif
200 OK 919 kB URL HTTP/2 kvkccc.top/6fb5deabda1e984b6bd49b2baa8dfa10.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 919 kB (918679 bytes)
Hash 956582dd3aa22ca9b19bdd1d5e091e24
c2d80e05f59981f6ed58a8231f502bd990894d6b
88e686882e64a0e199c79bd83b7102885b67242b5d0b49a1f37674c0bb3ddd8e
GET /6fb5deabda1e984b6bd49b2baa8dfa10.gif HTTP/1.1
Host: kvkccc.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 918679
last-modified: Sat, 02 Jul 2022 13:09:08 GMT
etag: "62c04374-e0497"
expires: Tue, 29 Nov 2022 15:27:11 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1122246
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WoDiaXktiQdld5%2BzBkoaK33icIRbb2cG4H206XYpvPYjIGQNyWdBDdJRIJyf6AxRLrsP2kjJgyCdis9GBnlbmMP7FhHtKped2gaLNWr5ywO%2Bl6lOr6mFmgyeDmtw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903307ba14b4f3-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kaiyuan-advertising.oss-cn-hongkong.aliyuncs.com/150x150.gif
200 OK 55 kB URL HTTP/1.1 kaiyuan-advertising.oss-cn-hongkong.aliyuncs.com/150x150.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 150 x 150\012- data
Hash 582452b1cbd33dbd20c3287441dc3478
6ebc8fc783b55f0cb6d54263544e6aefcce534f1
b12b502c1e1fe5109718fc7004000d66ac7a6d96aaada405378c2e63e33300fb
GET /150x150.gif HTTP/1.1
Host: kaiyuan-advertising.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Content-Length: 54604
Connection: keep-alive
x-oss-request-id: 636FB795051F683132EDDB33
Accept-Ranges: bytes
ETag: "582452B1CBD33DBD20C3287441DC3478"
Last-Modified: Mon, 03 Oct 2022 10:13:12 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 18371020748093193871
x-oss-storage-class: Standard
x-oss-server-side-encryption: AES256
Content-MD5: WCRSscvTPb0gwyh0Qdw0eA==
x-oss-server-time: 2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 4db48f975060bf53e8806559f17091f0
06bcb8de12b2ef2a268a673431e646ee05a843db
5818554ccb3520ff714e8e54bc4e09605b2712a339684f57dd6d4ccc4c49a5f7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "5818554CCB3520FF714E8E54BC4E09605B2712A339684F57DD6D4CCC4C49A5F7"
Last-Modified: Thu, 10 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2791
Expires: Sat, 12 Nov 2022 15:57:48 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 4db48f975060bf53e8806559f17091f0
06bcb8de12b2ef2a268a673431e646ee05a843db
5818554ccb3520ff714e8e54bc4e09605b2712a339684f57dd6d4ccc4c49a5f7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "5818554CCB3520FF714E8E54BC4E09605B2712A339684F57DD6D4CCC4C49A5F7"
Last-Modified: Thu, 10 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2791
Expires: Sat, 12 Nov 2022 15:57:48 GMT
Date: Sat, 12 Nov 2022 15:11:17 GMT
Connection: keep-alive
kvhzzz.top/2d9e99d0532fbc12eded53b70c20d64d.gif
200 OK 52 kB URL HTTP/2 kvhzzz.top/2d9e99d0532fbc12eded53b70c20d64d.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash 04554377e02f6f2a8c2bb65542f9516b
f425b8cccee87398d104c3ac4a840c9fb3577519
3b4a6d3df41918f2c7b1cecf42bfa82089f654bd3ea92460e5b8513a3c1428d5
GET /2d9e99d0532fbc12eded53b70c20d64d.gif HTTP/1.1
Host: kvhzzz.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 51538
last-modified: Mon, 02 May 2022 18:23:43 GMT
etag: "627021af-c952"
expires: Mon, 12 Dec 2022 03:04:11 GMT
cache-control: max-age=16070400
cf-cache-status: HIT
age: 43626
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vuegR1j%2BzgMokvAnoSGh0T6h50of45U5eqRBtA8Z1i3c3rU0QMV1fpk%2BvWRx8u2ayOwa6jQcwedOUx83Vbs7ifnIxtuJ%2BCcwZIF1PMw1l8WKh3W0EVjUzW0aOREa"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033083a15b4e8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvhzzz.top/99462c01e85acc1311bebac224df6cce.gif
200 OK 845 kB URL HTTP/2 kvhzzz.top/99462c01e85acc1311bebac224df6cce.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 845 kB (845326 bytes)
Hash c3e13dfb200737af2e68b42c07f28465
4d8262aecd8d789494afca5d63b5dd50600870dc
3e962d14b678808967d50df163581b65c6052144cb6239d72da58cceb7bf04ac
GET /99462c01e85acc1311bebac224df6cce.gif HTTP/1.1
Host: kvhzzz.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 845326
last-modified: Mon, 15 Aug 2022 06:10:27 GMT
etag: "62f9e353-ce60e"
expires: Sun, 04 Dec 2022 23:49:26 GMT
cache-control: max-age=16070400
cf-cache-status: HIT
age: 660111
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7EK1hqcaCNDFWwfPTDiW0va%2FSGQVnc0YFr2f9WgyM7XVM903cv1JloOCvlX0sFuJ0XmuwuacAq1RhbMHT4VLhzzXP4RNttVjgAaJlXCeK8Y2YykJ%2B4Ty5LpgxOJ4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033083a1fb4e8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
u1077.com/8957a21676be40739ca2dd25362b86d5.gif
200 OK 383 kB URL HTTP/2 u1077.com/8957a21676be40739ca2dd25362b86d5.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 100\012- data
Size 383 kB (382842 bytes)
Hash 3ee8c68d9bcee9dba9e18883f7a79dd7
ca6173103323ab2685f5c50c81c2e80d50583ab9
150795ba625225a034b7d362f7f69c1523bbbafb9820610a47b9abad1c030af9
GET /8957a21676be40739ca2dd25362b86d5.gif HTTP/1.1
Host: u1077.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a321b-5d77a"
server: nginx
date: Tue, 08 Nov 2022 10:41:42 GMT
content-type: image/gif
last-modified: Tue, 08 Nov 2022 10:40:27 GMT
accept-ranges: bytes
x-cache: HIT from yd11_02-cdn-g01-la2-53
content-length: 382842
X-Firefox-Spdy: h2
u1055.com/cd0079ce40f14b38b2f6853acacc905e.png
200 OK 81 kB URL HTTP/2 u1055.com/cd0079ce40f14b38b2f6853acacc905e.png
IP
ASN #7483 Skycloud Computing co., Ltd.
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 35e55bd418c0bb1ad4fdf2f2867e5102
7ec6859a8a7f22431ad759435dfac9337890d216
3e9a01ad36d379d7608aad2569be6dd631bab87dbd215bd23d1702a101ad2fbb
GET /cd0079ce40f14b38b2f6853acacc905e.png HTTP/1.1
Host: u1055.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a3448-13b91"
server: nginx
date: Sat, 12 Nov 2022 02:42:26 GMT
content-type: image/png
last-modified: Tue, 08 Nov 2022 10:49:44 GMT
accept-ranges: bytes
x-cache: HIT from yd11_02-cdn-g01-la2-53
content-length: 80785
X-Firefox-Spdy: h2
kvkooo.top/8fdce7479dd03f1ee73805e8d2e9bab8.gif
200 OK 864 kB URL HTTP/2 kvkooo.top/8fdce7479dd03f1ee73805e8d2e9bab8.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 864 kB (864004 bytes)
Hash d2c820747a9b9b8c3abaab0775436ab7
99651afd10bd3874fb84d7973845482cd2c81f23
8aa3c7b05ba9bb5176a7155ead2a0ea562b07fb0dd7b27a9cf91c38e95ed43ed
GET /8fdce7479dd03f1ee73805e8d2e9bab8.gif HTTP/1.1
Host: kvkooo.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 864004
last-modified: Sun, 04 Sep 2022 09:11:53 GMT
etag: "63146bd9-d2f04"
expires: Sat, 10 Dec 2022 12:21:22 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 182995
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pHKpzi%2BSs74F%2FtmCPP9WsmReFz1xqYkEtC4b1FxZ%2BDJMlEzCmAUCKGeRmstGEGyhnkcT%2BrUfkxTqBsnuFhfUI%2FLWgZ0gZFVdM01GsyWV4AILmEvkfwy9uQnDlWjV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033085f97b500-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvkooo.top/2dafd276863e05cd86626a2b7b394960.gif
200 OK 19 kB URL HTTP/2 kvkooo.top/2dafd276863e05cd86626a2b7b394960.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash fe02bebb3cbbf8cd029504e748ad437a
08e06dff48f5dd378b31684cd4d48375f19b1e5f
8d2f2df857ef73c5b13658bb7d6289d6dc4b840fce5b8bbcdc779f5db9741509
GET /2dafd276863e05cd86626a2b7b394960.gif HTTP/1.1
Host: kvkooo.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 19403
last-modified: Sat, 28 May 2022 12:31:18 GMT
etag: "62921616-4bcb"
expires: Sat, 10 Dec 2022 14:02:47 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 176910
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WfIONQWNbNwTLLzqLqXx3ZrrUmAU08KZDC568yJsVs%2FN8UlJEWPzV3vezQd1CqtN901vwHkTS8C3jWvWIhe%2FxvOiC3h96rYJKjeHppfPvnen%2BDXsrXauLMB4bu9g"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903308afe2b500-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
u1033.com/e0dfdc2ccf2e4423b73e8685cc955bde.gif
200 OK 410 kB URL HTTP/2 u1033.com/e0dfdc2ccf2e4423b73e8685cc955bde.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 100\012- data
Size 410 kB (410376 bytes)
Hash 252024a9012d1d0f83a322d14e716acf
ec9ad2ce7bcc69a66f1a71cd08f4b085e5d8e5be
2a70782d0c3bc5b56f96e9393a9c212fdd55282dd0adb21eb10c39cc5e8be52a
GET /e0dfdc2ccf2e4423b73e8685cc955bde.gif HTTP/1.1
Host: u1033.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a19ca-64308"
server: nginx
date: Tue, 08 Nov 2022 09:15:49 GMT
content-type: image/gif
last-modified: Tue, 08 Nov 2022 08:56:42 GMT
accept-ranges: bytes
x-cache: HIT from yd11_02-cdn-g01-la2-38
content-length: 410376
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash 802d6cb3dce4552d70b2204630aa921f
aae9d2b7addcade10a0e66889f07d5e2ce93e16c
2eb9ae2e1051f6e139da69a9cc0d96e4c66db7699a87d9b36c06d2b8ee9568ab
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 12 Nov 2022 10:05:43 GMT
Expires: Sat, 19 Nov 2022 10:05:42 GMT
Etag: "aae9d2b7addcade10a0e66889f07d5e2ce93e16c"
Cache-Control: max-age=585864,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769033077e1bb4eb-OSL
kvhuuu.top/0385a02384cf8bb1f4b429d18548cbd7.gif
200 OK 211 kB URL HTTP/2 kvhuuu.top/0385a02384cf8bb1f4b429d18548cbd7.gif
IP
File type GIF image data, version 89a, 960 x 60\012- data
Size 211 kB (211127 bytes)
Hash 88d9d5281cc8399fc9a5a866857fea84
4abe7059410209993012e28e4716b51bf6cf7575
6e5d5a54f87917acb45b64a2708004f72dcae06a1626336a01c290c0dfba5aa2
GET /0385a02384cf8bb1f4b429d18548cbd7.gif HTTP/1.1
Host: kvhuuu.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: image/gif
content-length: 211127
last-modified: Wed, 20 Apr 2022 12:41:47 GMT
etag: "625fff8b-338b7"
expires: Tue, 29 Nov 2022 04:27:49 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1161808
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2PalcstSdSk1rVDrQrnrE57NVQ%2BKCwtY2Z%2FfBWh2x2H0axxGqjJXqI3eEwRZg1%2BwN8Pr06yICMUNcuJfKJ97A5jHXupxxrFLzf6NzLhsjWzafqNa%2FsWztiur9oyq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903308281bdd7c-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ali2.a.yximgs.com/udata/music/music_c00869cdb55a4e77917f34d9a55757490.jpg
200 OK 498 kB URL HTTP/1.1 ali2.a.yximgs.com/udata/music/music_c00869cdb55a4e77917f34d9a55757490.jpg
IP
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type GIF image data, version 89a, 960 x 70\012- data
Size 498 kB (497844 bytes)
Hash 9d43f768f1897d7d3fd5ba803e1a770a
ff8fb3f427df7b6cfef65fcae162e0abab9474a4
00fe4f1ccfc623639abadf4e745aca22b946365e932a7a794d6c108fee0d85af
GET /udata/music/music_c00869cdb55a4e77917f34d9a55757490.jpg HTTP/1.1
Host: ali2.a.yximgs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/jpeg
Content-Length: 497844
Connection: keep-alive
Date: Fri, 21 Oct 2022 13:10:37 GMT
Cache-Control: max-age=2592000
Expires: Fri, 28 Oct 2022 13:10:37 GMT
Last-Modified: Fri, 21 Oct 2022 07:01:31 GMT
x-amz-request-id: 98b871ebf1c7413d8d61d3bf6864da97
x-amz-id-2: YmtladlyC5Brv61SXMcXgNnxlrT3jEqmdZzcFWxrdeFWqF9zMBQ=
Accept-Ranges: bytes
ETag: "9D43F768F1897D7D3FD5BA803E1A770A"
x-amz-storage-class: STANDARD
x-bs-object-status: 0
X-KSLOGID: 666357837400535051
X-Rsp-Code: 060,040
X-Ks-Cache: HIT from 47.246.44.230
X-Kimg: egae
Ali-Swift-Global-Savetime: 1666357837
Via: cache78.l2nm125[0,0,200-0,H], cache66.l2nm125[0,0], cache4.l2de2[0,0,200-0,H], cache12.l2de2[3,0], cache2.se1[0,1,200-0,H], cache8.se1[4,0]
Age: 1908040
X-Cache: HIT TCP_HIT dirn:3:389740421
X-Swift-SaveTime: Fri, 21 Oct 2022 18:55:25 GMT
X-Swift-CacheTime: 31083312
kwaisign: null
X-Ks-Request-ID: 2ff62c9c16682658777475682e
x-ks-client-ip: 91.90.42.154
Access-Control-Expose-Headers: x-ks-request-id,x-ks-client-ip,Content-Length
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
EagleId: 2ff62c9c16682658777475682e
ocsp.digicert.com/
200 OK 278 B IP
Hash d4dec5aa7852f9e1d997efcdeb91a189
6972f505e607c6304eec77e098febd85e68eff80
519832828fbeeaa98240206974528027f80632cab7ebbeec19b520a894ea2907
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5864
Cache-Control: max-age=138804
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Etag: "636f1be1-116"
Expires: Mon, 14 Nov 2022 05:44:41 GMT
Last-Modified: Sat, 12 Nov 2022 04:06:57 GMT
Server: ECS (amb/6B9F)
X-Cache: HIT
Content-Length: 278
u1033.com/70338b026fcd4559831427cd99362e0f.gif
200 OK 528 kB URL HTTP/2 u1033.com/70338b026fcd4559831427cd99362e0f.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 100\012- data
Size 528 kB (528107 bytes)
Hash b835921ae97148cb73e491e4288ae077
392c16f2ee23667d7956bc601ee2f5927c16160d
acbe56eb9498265786e993eebf99780215d02e1cb27ea3a755f43a6134f10a55
GET /70338b026fcd4559831427cd99362e0f.gif HTTP/1.1
Host: u1033.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
etag: "636a194b-80eeb"
server: nginx
date: Tue, 08 Nov 2022 09:15:49 GMT
content-type: image/gif
last-modified: Tue, 08 Nov 2022 08:54:35 GMT
accept-ranges: bytes
x-cache: HIT from yd11_02-cdn-g01-la2-38
content-length: 528107
X-Firefox-Spdy: h2
628536nyv.com/a560e00e7bb844119014562b6f612399.gif
200 OK 654 kB URL HTTP/1.1 628536nyv.com/a560e00e7bb844119014562b6f612399.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 60\012- data
Size 654 kB (653713 bytes)
Hash 6e1b913d233fb64271527a796618f37b
a858c96c304244dfa9d5cd159a3a5c80c6b98598
4dc0708abb2de56eaee1961f8143ec911357863a2b259c4154701ddd128d3a37
Analyzer Verdict Alert quad9 Sinkholed
GET /a560e00e7bb844119014562b6f612399.gif HTTP/1.1
Host: 628536nyv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635b8daa-9f991"
Date: Wed, 09 Nov 2022 19:43:37 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 08:07:06 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-13
Content-Length: 653713
kveii.com/f67b410855efed07dc1783436baaa5f7.gif
301 Moved Permanently 162 B URL HTTP/2 kveii.com/f67b410855efed07dc1783436baaa5f7.gif
IP
ASN #201106 Spartan Host Ltd
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /f67b410855efed07dc1783436baaa5f7.gif HTTP/1.1
Host: kveii.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 12 Nov 2022 15:11:17 GMT
content-type: text/html
content-length: 162
location: https://kvkppp.top/f67b410855efed07dc1783436baaa5f7.gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
vns86.oss-cn-hongkong.aliyuncs.com/sstu/st.gif
200 OK 402 kB URL HTTP/1.1 vns86.oss-cn-hongkong.aliyuncs.com/sstu/st.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 960 x 80\012- data
Size 402 kB (401949 bytes)
Hash 84f5e7e4907b6cd9053b363f33b77c53
309a705272fea6d84c805fd12b0f1a65563f823b
ebfe8fe0061adb9df1abb8739d4975acaffedc85d286190e92148e5cd8b658b2
GET /sstu/st.gif HTTP/1.1
Host: vns86.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: image/gif
Content-Length: 401949
Connection: keep-alive
x-oss-request-id: 636FB794FDBA0C3636FDC6F7
Accept-Ranges: bytes
ETag: "84F5E7E4907B6CD9053B363F33B77C53"
Last-Modified: Thu, 15 Sep 2022 05:03:18 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 1766787816591418203
x-oss-storage-class: Standard
x-oss-version-id: CAEQPxiBgICkqI_.mRgiIGMyOGU5YjM3M2Y5OTQ2N2M4NzA0MDg4OTQ3ZTBhMTNl
Content-MD5: hPXn5JB7bNkFOzY/M7d8Uw==
x-oss-server-time: 2
362728tdg.com/5d94a04b442545bdb59d7d2fba1b2897..gif
200 OK 423 kB URL HTTP/1.1 362728tdg.com/5d94a04b442545bdb59d7d2fba1b2897..gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 60\012- data
Size 423 kB (422791 bytes)
Hash bdeb53a7d3c2f219a7ae903a7346cd91
e5349fa31f22ce3605b9256c0a6e37def92b13b6
316319f597bb6dd3d686c46a51e67693243868108b798fa8174f8a124b6422b4
Analyzer Verdict Alert quad9 Sinkholed
GET /5d94a04b442545bdb59d7d2fba1b2897..gif HTTP/1.1
Host: 362728tdg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635b9164-67387"
Date: Sun, 06 Nov 2022 14:33:03 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 08:23:00 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-13
Content-Length: 422791
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aa3dac7065bb72205733e4bbb5ea1021
11c6b4e73fd6733a252e214ddab9b84fd06e63af
3d0f1b3df86eb23d0ade2a462e570fe64d788d99960bb7788cae442d9580c02f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3D0F1B3DF86EB23D0ADE2A462E570FE64D788D99960BB7788CAE442D9580C02F"
Last-Modified: Thu, 10 Nov 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12055
Expires: Sat, 12 Nov 2022 18:32:13 GMT
Date: Sat, 12 Nov 2022 15:11:18 GMT
Connection: keep-alive
ocsp.sectigo.com/
200 OK 471 B IP
Hash 5123890cd85473952454e78e6cdd92ad
c3c7deee349ddc32774280ea997467bc8d8a340b
92ab0ee50bfe6678460df63745a2daee8f979fc527b8d9a664d988b49c6743fe
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:18 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 05:58:46 GMT
Expires: Thu, 17 Nov 2022 05:58:45 GMT
Etag: "c3c7deee349ddc32774280ea997467bc8d8a340b"
Cache-Control: max-age=398247,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769033087f83b4eb-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aa3dac7065bb72205733e4bbb5ea1021
11c6b4e73fd6733a252e214ddab9b84fd06e63af
3d0f1b3df86eb23d0ade2a462e570fe64d788d99960bb7788cae442d9580c02f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3D0F1B3DF86EB23D0ADE2A462E570FE64D788D99960BB7788CAE442D9580C02F"
Last-Modified: Thu, 10 Nov 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12055
Expires: Sat, 12 Nov 2022 18:32:13 GMT
Date: Sat, 12 Nov 2022 15:11:18 GMT
Connection: keep-alive
kvhyyy.top/62c32c04c4566524981b72086b0c545b.gif
200 OK 13 kB URL HTTP/2 kvhyyy.top/62c32c04c4566524981b72086b0c545b.gif
IP
File type GIF image data, version 89a, 150 x 150\012- data
Hash a690f8caf2cb5e11ff99032b9a32c805
5e97e13e5d3fe285799de6be6d4ebfb25693ea9b
a8a13df22e12832c04680d33294029a2b0baad76ac970d9031fe6d66cbeaceee
GET /62c32c04c4566524981b72086b0c545b.gif HTTP/1.1
Host: kvhyyy.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:18 GMT
content-type: image/gif
content-length: 13205
last-modified: Wed, 14 Sep 2022 06:19:23 GMT
etag: "6321726b-3395"
expires: Mon, 12 Dec 2022 15:11:17 GMT
cache-control: max-age=16070400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nhpx8ahW8VrYIZ%2B863QcISsg9KllivfffsLcYeVYdWei8IL8tA9kqh9hh9uSIxNuzvPHi6MkW8GNWd1ZiciaGFPWSbbLbvuKK0VWzytNxxbVC2ez%2FlfuTIpBQVnP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 769033077fa51c06-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 7fcd7ac46ab92f90339f620feb34a629
d8839d496f75aaecff8e30cc25b335cd535ec1e2
1f54e2d58fe8e4d7e543ad9d18038f427b47bab82a9ab9a06ce1d0f0b2c6125a
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "1F54E2D58FE8E4D7E543AD9D18038F427B47BAB82A9AB9A06CE1D0F0B2C6125A"
Last-Modified: Thu, 10 Nov 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15650
Expires: Sat, 12 Nov 2022 19:32:08 GMT
Date: Sat, 12 Nov 2022 15:11:18 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 278 B IP
Hash d4dec5aa7852f9e1d997efcdeb91a189
6972f505e607c6304eec77e098febd85e68eff80
519832828fbeeaa98240206974528027f80632cab7ebbeec19b520a894ea2907
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=132940
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:17 GMT
Etag: "636f1be1-116"
Expires: Mon, 14 Nov 2022 04:06:59 GMT
Last-Modified: Sat, 12 Nov 2022 04:06:57 GMT
Server: nginx
Content-Length: 278
ocsp.sectigo.com/
200 OK 471 B IP
Hash 8084ee212ed570c762dbe95f22e2fce5
2eca79a6c31c6f23cefd5b6cc28b33f97de3884d
2b7947b6695d2be9104e81e98f9abf27d47a45a047bc878a40665cf81db26198
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:18 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 12 Nov 2022 00:51:34 GMT
Expires: Sat, 19 Nov 2022 00:51:33 GMT
Etag: "2eca79a6c31c6f23cefd5b6cc28b33f97de3884d"
Cache-Control: max-age=552614,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76903308794bb527-OSL
xk3.me/img/sWQr/onusRhIGa.gif
200 OK 101 kB URL HTTP/1.1 xk3.me/img/sWQr/onusRhIGa.gif
IP
ASN #59371 Dimension Network & Communication Limited
File type GIF image data, version 89a, 960 x 60\012- data
Size 101 kB (101378 bytes)
Hash 7ee65d5fd569b773795d78e69c9259a5
912aa662437a126f1968fd227b2e3776c67e54cc
b17effd8c4f1d0f6ec366b792ede1b9729d57411f723d53cd57c7d971ffbc859
GET /img/sWQr/onusRhIGa.gif HTTP/1.1
Host: xk3.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:16 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"102652-1667570973000"
Last-Modified: Fri, 04 Nov 2022 14:09:33 GMT
Expires: Sun, 27 Nov 2022 15:11:16 GMT
Cache-Control: max-age=1296000
Content-Encoding: gzip
Nginx-Cache: EXPIRED, HIT
538936vxn.com/d435373888944b359330ac8c9bcff8c1.gif
200 OK 553 kB URL HTTP/1.1 538936vxn.com/d435373888944b359330ac8c9bcff8c1.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 960 x 60\012- data
Size 553 kB (552818 bytes)
Hash 097e6fa9314192dc3dd55cb1c5023ee5
c30366c4c910616f1a3c1b773ffb4af967e20eb5
db020d7293807326453f5848c0bf219e2b835f2530468a9d816a3c1c7941023a
Analyzer Verdict Alert quad9 Sinkholed
GET /d435373888944b359330ac8c9bcff8c1.gif HTTP/1.1
Host: 538936vxn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635b9374-86f72"
Date: Mon, 07 Nov 2022 18:28:45 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Fri, 28 Oct 2022 08:31:48 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-23
Content-Length: 552818
yaoji666.oss-cn-hongkong.aliyuncs.com/gg/66X66.gif
200 OK 36 kB URL HTTP/1.1 yaoji666.oss-cn-hongkong.aliyuncs.com/gg/66X66.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
File type GIF image data, version 89a, 66 x 66\012- data
Hash da0800a5f4df960bb85a5b03e50f9f77
4d122c3c786b367c1d94c57e79e55fb933695209
8d78241171490168d4378bfd35ee6a474423fcf0d644a92d36b9b09b180c17f2
GET /gg/66X66.gif HTTP/1.1
Host: yaoji666.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Content-Length: 36349
Connection: keep-alive
x-oss-request-id: 636FB7958A23F73132F13792
Accept-Ranges: bytes
ETag: "DA0800A5F4DF960BB85A5B03E50F9F77"
Last-Modified: Sat, 09 Jul 2022 12:36:44 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 18107319261392544870
x-oss-storage-class: Standard
x-oss-server-side-encryption: AES256
Content-MD5: 2ggApfTflgu4WlsD5Q+fdw==
x-oss-server-time: 1
ocsp2.globalsign.com/gsorganizationvalsha2g2
200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP
Hash 0dddd5584ed5b7dd2a8a8958edbbe865
9f59d5d133f808112b8d28acb1677249bc283292
1631a6141cc993654b93e0ea7b4bc8bbda166910b61365742685fc14e45a0383
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:18 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Wed, 16 Nov 2022 11:04:15 GMT
ETag: "9f59d5d133f808112b8d28acb1677249bc283292"
Last-Modified: Sat, 12 Nov 2022 11:04:16 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3110
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7690330a8fe80b59-OSL
339282bdb.com/51af2492ce0f44c3bc75c996ee311b15.gif
200 OK 21 kB URL HTTP/1.1 339282bdb.com/51af2492ce0f44c3bc75c996ee311b15.gif
IP
ASN #7483 Skycloud Computing co., Ltd.
File type GIF image data, version 89a, 180 x 180\012- data
Hash 07ccc0b877ff07608500e45e78915a0a
e9972b6f1517b3c5dadcde11212bcfd3a51c2abd
5623987f3399652066ac075bbf5ff8e116e13c846219fdafd4fb8d48e2b643ed
Analyzer Verdict Alert quad9 Sinkholed
GET /51af2492ce0f44c3bc75c996ee311b15.gif HTTP/1.1
Host: 339282bdb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=604800
ETag: "635e20c7-51df"
Date: Sun, 30 Oct 2022 07:38:30 GMT
Content-Type: image/gif
Server: nginx
Last-Modified: Sun, 30 Oct 2022 06:59:19 GMT
Accept-Ranges: bytes
X-Cache: HIT from yd11_13-cdn-g01-la2-39
Content-Length: 20959
ocsp.pki.goog/s/gts1p5/t1eJGFHGm7w
200 OK 471 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/t1eJGFHGm7w
IP
Hash 183d58ed5186cc91a86aa56ec4159de2
0c5374b8345ec403f31fa34f5fa57c2852691712
45433b6de39ae016469ee8323ec67f042eff4c7855fa2aa3463f55018cb6d9cc
POST /s/gts1p5/t1eJGFHGm7w HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 15:11:18 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 12bd908b6d003ba90be24b0cdf08c321
f7ebb136a9aa8f5b238653b50a8ce7d666e5f5fc
55301f467fb78df76a704245d5eebb975c28574d3438257408f8512d7e6d167c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "55301F467FB78DF76A704245D5EEBB975C28574D3438257408F8512D7E6D167C"
Last-Modified: Fri, 11 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2498
Expires: Sat, 12 Nov 2022 15:52:56 GMT
Date: Sat, 12 Nov 2022 15:11:18 GMT
Connection: keep-alive
img.8717x.com/images/635243c85fe50f0585d3ef94.gif
302 Found 0 B URL HTTP/2 img.8717x.com/images/635243c85fe50f0585d3ef94.gif
IP
GET /images/635243c85fe50f0585d3ef94.gif HTTP/1.1
Host: img.8717x.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
referrer-policy: no-referrer
location: https://ali2.a.yximgs.com/udata/music/music_c00869cdb55a4e77917f34d9a55757490.jpg
cache-control: max-age=3600
X-Firefox-Spdy: h2
yaoji666.oss-cn-hongkong.aliyuncs.com/gg/960X120.gif
200 OK 0 B URL HTTP/1.1 yaoji666.oss-cn-hongkong.aliyuncs.com/gg/960X120.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
GET /gg/960X120.gif HTTP/1.1
Host: yaoji666.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Content-Length: 212323
Connection: keep-alive
x-oss-request-id: 636FB795FC567C32388E32EA
Accept-Ranges: bytes
ETag: "1E7356E466A72B7C5D137501DA414A9E"
Last-Modified: Sat, 17 Sep 2022 09:20:48 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 14666006998441618956
x-oss-storage-class: Standard
x-oss-server-side-encryption: AES256
Content-MD5: HnNW5GanK3xdE3UB2kFKng==
x-oss-server-time: 1
sszhan.oss-cn-shenzhen.aliyuncs.com/sz20.gif
200 OK 0 B URL HTTP/1.1 sszhan.oss-cn-shenzhen.aliyuncs.com/sz20.gif
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
GET /sz20.gif HTTP/1.1
Host: sszhan.oss-cn-shenzhen.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Content-Length: 116940
Connection: keep-alive
x-oss-request-id: 636FB795C197983330488A5A
Accept-Ranges: bytes
ETag: "D81EEFC98ADC4601E81B037D4A4ECF84"
Last-Modified: Sat, 15 Oct 2022 10:24:17 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 8991706160939897550
x-oss-storage-class: Standard
Content-Disposition: attachment
x-oss-force-download: true
Content-MD5: 2B7vyYrcRgHoGwN9Sk7PhA==
x-oss-server-time: 1
gg72a1.com/gg/960x60-2.gif
200 OK 0 B URL HTTP/2 gg72a1.com/gg/960x60-2.gif
IP
GET /gg/960x60-2.gif HTTP/1.1
Host: gg72a1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 15:13:24 GMT
content-type: image/gif
content-length: 566629
last-modified: Tue, 01 Nov 2022 07:49:47 GMT
etag: "6360cf9b-8a565"
expires: Mon, 12 Dec 2022 15:13:24 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
pic.picnewsss.com/tu-2022290039/960-70.gif
200 OK 0 B URL HTTP/2 pic.picnewsss.com/tu-2022290039/960-70.gif
IP
GET /tu-2022290039/960-70.gif HTTP/1.1
Host: pic.picnewsss.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=2592000
content-type: image/gif
date: Sat, 12 Nov 2022 14:35:07 GMT
etag: "1668264717"
expires: Mon, 12 Dec 2022 14:35:07 GMT
last-modified: Sat, 12 Nov 2022 14:51:57 GMT
server: nginx
x-cache: HIT, policy, memory
content-length: 260363
X-Firefox-Spdy: h2
kvteee.top/68a7807de3933bf7079116fa9df99e6f.gif
200 OK 0 B URL HTTP/2 kvteee.top/68a7807de3933bf7079116fa9df99e6f.gif
IP
GET /68a7807de3933bf7079116fa9df99e6f.gif HTTP/1.1
Host: kvteee.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://aseywi-qwuenc-uersn-01.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:18 GMT
content-type: image/gif
content-length: 366444
last-modified: Fri, 19 Aug 2022 17:02:28 GMT
etag: "62ffc224-5976c"
expires: Sat, 26 Nov 2022 15:09:31 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 1382507
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4PFNwg1NaKrxlrhhDAEmXf%2BqeaO96mmCtRr7HGKN3Rq6o50xiLYpg1e3iW1qSIWSmBjrklvGgcEiNpzZk0iEmVuS9p4EwgcsfkS4Hi2bOLVLJ5eZd7Zn%2F0HkfjgB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76903309ba24406c-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kvteee.top/5acaa66e30e443214f59a6b31654a54e.gif
200 OK 0 B URL HTTP/2 kvteee.top/5acaa66e30e443214f59a6b31654a54e.gif
IP
GET /5acaa66e30e443214f59a6b31654a54e.gif HTTP/1.1
Host: kvteee.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 15:11:18 GMT
content-type: image/gif
content-length: 549098
last-modified: Tue, 16 Aug 2022 11:19:44 GMT
etag: "62fb7d50-860ea"
expires: Fri, 09 Dec 2022 16:36:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 254117
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E5FEinmVQee%2Fj7N4YAK1Vc8OoOmmRQozZeasF19icU1DxXzdj1IMFHNPAJsRibAhC0ulSAFlIogWq0HzwoLwUQYmGJ%2BW8mw2wtwzJZ15zweJKPRsGfFsBTDCSNUJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7690330a5adf406c-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kaiyuan-advertising.oss-cn-hongkong.aliyuncs.com/960X60.gif
200 OK 0 B URL HTTP/1.1 kaiyuan-advertising.oss-cn-hongkong.aliyuncs.com/960X60.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
GET /960X60.gif HTTP/1.1
Host: kaiyuan-advertising.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Content-Length: 253519
Connection: keep-alive
x-oss-request-id: 636FB795B37484303759CC51
Accept-Ranges: bytes
ETag: "F744E995971941B6A95FCD2636F5A545"
Last-Modified: Thu, 13 Oct 2022 11:11:01 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 17987192695826819902
x-oss-storage-class: Standard
x-oss-server-side-encryption: AES256
Content-MD5: 90TplZcZQbapX80mNvWlRQ==
x-oss-server-time: 2
yaoji666.oss-cn-hongkong.aliyuncs.com/gg/500X281.gif
200 OK 0 B URL HTTP/1.1 yaoji666.oss-cn-hongkong.aliyuncs.com/gg/500X281.gif
IP
ASN #45102 Alibaba US Technology Co., Ltd.
GET /gg/500X281.gif HTTP/1.1
Host: yaoji666.oss-cn-hongkong.aliyuncs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Content-Length: 301367
Connection: keep-alive
x-oss-request-id: 636FB7959DB5783638F6206B
Accept-Ranges: bytes
ETag: "79411F72E54FE27BAF645B5C97CA51A2"
Last-Modified: Fri, 29 Jul 2022 10:40:31 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 2039214089364561757
x-oss-storage-class: Standard
x-oss-server-side-encryption: AES256
Content-MD5: eUEfcuVP4nuvZFtcl8pRog==
x-oss-server-time: 2
xk3.me/img/sWQr/os1ownH3f.gif
200 OK 0 B URL HTTP/1.1 xk3.me/img/sWQr/os1ownH3f.gif
IP
ASN #59371 Dimension Network & Communication Limited
GET /img/sWQr/os1ownH3f.gif HTTP/1.1
Host: xk3.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"241580-1664950919000"
Last-Modified: Wed, 05 Oct 2022 06:21:59 GMT
Expires: Sun, 27 Nov 2022 15:11:17 GMT
Cache-Control: max-age=1296000
Content-Encoding: gzip
Nginx-Cache: HIT, HIT
n0499.com/0dae943a97e34efcafe1bba39e7b3ec7.gif
200 OK 0 B URL HTTP/1.1 n0499.com/0dae943a97e34efcafe1bba39e7b3ec7.gif
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
GET /0dae943a97e34efcafe1bba39e7b3ec7.gif HTTP/1.1
Host: n0499.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://aseywi-qwuenc-uersn-01.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 15:11:17 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Tue, 08 Nov 2022 08:55:36 GMT
ETag: W/"636a1988-57818"
Server: WAF/2.4-12.1
X-Cache-Status: HIT
Content-Encoding: gzip
154.203.231.103
104.21.9.78
120.77.166.5
34.117.237.239
103.170.15.109
23.36.76.226
93.184.220.29
47.246.44.230
3.36.126.81
78.46.107.74