www.tracktds.fun/go/fba4dbf1-0584-4331-b4cd-23f186b2708e
302 Found 304 B URL HTTP/1.1 www.tracktds.fun/go/fba4dbf1-0584-4331-b4cd-23f186b2708e
IP
File type HTML document, ASCII text, with very long lines (304), with no line terminators
Hash 53dc569a73fc0038b1560d1cf71c85c4
d045f7b55f720abc3538ebfee9e23cb2165451c5
3512b93cd0c3fa85c03c891796742aaa45fd032e8e65007a72f2475f66a0cb55
Analyzer Verdict Alert fortinet Malware
GET /go/fba4dbf1-0584-4331-b4cd-23f186b2708e HTTP/1.1
Host: www.tracktds.fun
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: openresty
Date: Mon, 28 Nov 2022 08:18:24 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 304
Connection: keep-alive
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Reduced
Access-Control-Allow-Origin: *
Location: https://news-mezihi.com/tds.php?sid=8051545&p1=8E9HbLB35s9rmg9LoomV7T&domain=news-mezihi.com&p1=8E9HbLB35s9rmg9LoomV7T
Set-Cookie: bemob-uniq-visit:fba4dbf1-0584-4331-b4cd-23f186b2708e=1; Domain=www.tracktds.fun; Path=/; Expires=Tue, 29 Nov 2022 08:18:24 GMT; HttpOnly
bemob-rotation:fba4dbf1-0584-4331-b4cd-23f186b2708e:random:47b33ee88c9f28e9f7264540e995fe4d=0-0-0; Domain=www.tracktds.fun; Path=/; Expires=Tue, 29 Nov 2022 08:18:24 GMT; HttpOnly
bemob-click-id=8E9HbLB35s9rmg9LoomV7T; Domain=www.tracktds.fun; Path=/; Expires=Tue, 29 Nov 2022 08:18:24 GMT; HttpOnly
Vary: Accept
X-Response-Time: 14.793ms
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cdbad2434b7d127a4fc769807a9dc3e7
fa98cd9fc2309ab4423f33f683d17bdb17d76713
560cbbb751ab2884024da3b93fba6bc45c6434797dba72a98c05e7fc2bb94bc1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "560CBBB751AB2884024DA3B93FBA6BC45C6434797DBA72A98C05E7FC2BB94BC1"
Last-Modified: Sat, 26 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14656
Expires: Mon, 28 Nov 2022 12:22:40 GMT
Date: Mon, 28 Nov 2022 08:18:24 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 64b2a23eab6e5ae8c010ec7242be930c
0673e4385ba01a5a245711bab96cafc34f765793
64751d193f7af72431e9689581faffcae1a30ff50ea425697b2b80ff61c87909
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5135
Cache-Control: max-age=99504
Content-Type: application/ocsp-response
Date: Mon, 28 Nov 2022 08:18:24 GMT
Etag: "63833c71-1d7"
Expires: Tue, 29 Nov 2022 11:56:48 GMT
Last-Modified: Sun, 27 Nov 2022 10:31:13 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 71f9c681a82440fd55e76c780a20e55d
3147768cfbcdd06e0c6e69684292e68e99917a80
5ea71ce6dd9e927f9bb3f97f59cc1ac7dc25a949024815965b29bc5835614786
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5EA71CE6DD9E927F9BB3F97F59CC1AC7DC25A949024815965B29BC5835614786"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2756
Expires: Mon, 28 Nov 2022 09:04:20 GMT
Date: Mon, 28 Nov 2022 08:18:24 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 567df7db606cf5d0871aa5bc9311b6da
4263faac7cbab2fcaf6661911dcad5091c06be17
e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 28 Nov 2022 07:19:32 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3532
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: GN4P9pHWTlw0G0KJMOLAy9yoY9UvQC0ipF5j/MGJA0IZJLFBd8MLpva+PPIe+twCGkWUoru+7X8=
x-amz-request-id: DKWKZEVV41ST759X
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 28 Nov 2022 07:41:58 GMT
age: 2186
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:24 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
zerossl.ocsp.sectigo.com/
200 OK 315 B URL HTTP/1.1 zerossl.ocsp.sectigo.com/
IP
Hash 01688225c7a668c08f05ea293b6fe25a
f7788c6e0a289e67caa418dced513b3fd52ec8c2
4c1d812932418b2fc2ede6cba44a1ba4d3367404a8489f7fd786bda8d95a638d
POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 28 Nov 2022 08:18:25 GMT
Content-Type: application/ocsp-response
Content-Length: 315
Connection: keep-alive
Last-Modified: Sun, 27 Nov 2022 16:53:16 GMT
Expires: Sun, 04 Dec 2022 16:53:15 GMT
Etag: "f7788c6e0a289e67caa418dced513b3fd52ec8c2"
Cache-Control: max-age=548689,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7711ac3a6ae4b51e-OSL
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 28 Nov 2022 08:11:12 GMT
cache-control: public,max-age=3600
age: 433
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
news-mezihi.com/revopush.js?v=4
200 OK 8.9 kB URL HTTP/2 news-mezihi.com/revopush.js?v=4
IP
ASN #63023 AS-GLOBALTELEHOST
File type ASCII text, with very long lines (8922), with no line terminators
Hash 51014cabdb246e54c6fe1c7864225e81
04390aa362cc51c8f3aa848e5f1a11b3f9ba2751
32da65acc9ea9ff95f364751b4855731358710ebeb6b25d863a1c5d02dc73bd1
Analyzer Verdict Alert fortinet Phishing
GET /revopush.js?v=4 HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: application/javascript
content-length: 8922
last-modified: Mon, 29 Aug 2022 09:05:32 GMT
etag: "630c815c-22da"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
news-mezihi.com/lands/53/css/style.css
200 OK 6.8 kB URL HTTP/2 news-mezihi.com/lands/53/css/style.css
IP
ASN #63023 AS-GLOBALTELEHOST
Hash e847018357e35201fc307010d2f273d4
dc937966829b556914867618c050d9a071cbff7f
a1f4e7ef79d0ff0e7daa8e33bbc20e8a77cfa2893f618fad12a81660ca9e90f4
GET /lands/53/css/style.css HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: text/css
content-length: 6750
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1a5e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
news-mezihi.com/lands/53/images/spinning-circles2.svg
200 OK 503 B URL HTTP/2 news-mezihi.com/lands/53/images/spinning-circles2.svg
IP
ASN #63023 AS-GLOBALTELEHOST
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 14e6f9981fa27406176056df2451d27b
aa1b6fd6071391d0031bff2d74ae77347ec2fdb4
466d361db2f130d7e3d40a671c935e3e556c3a49567657afee2e44a0a390a84f
Analyzer Verdict Alert fortinet Phishing
GET /lands/53/images/spinning-circles2.svg HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: image/svg+xml
content-length: 503
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1f7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
news-mezihi.com/lands/53/js/device.js
200 OK 7.4 kB URL HTTP/2 news-mezihi.com/lands/53/js/device.js
IP
ASN #63023 AS-GLOBALTELEHOST
File type HTML document, ASCII text
Hash 46ce7a0522431a9a972b55b01bf0c1f1
263694d7c99de62fb4e9f4e9215ec9df92f16dc2
8b4fd7bcadd8d9e95b7aebae2f7b233dab0453cc931ba13add8a313dc3c61033
Analyzer Verdict Alert fortinet Phishing
GET /lands/53/js/device.js HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: application/javascript
content-length: 7364
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1cc4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash a6fee11dfe1b88cd768a0ca3e2bd0c89
59cec9a44a4a92467678afe65f347f68641a2174
50870c499aae4d5dfd6df25a36cd04b6d185b66ef0590e46933984bf52e2483f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5164
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 28 Nov 2022 08:18:25 GMT
Last-Modified: Mon, 28 Nov 2022 06:52:21 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471
news-mezihi.com/sw.js
200 OK 4.0 kB IP
ASN #63023 AS-GLOBALTELEHOST
File type ASCII text, with very long lines (3964), with no line terminators
Hash 7c60cc903a18857a61023bde734a757b
d53632ffe44847e798eeb6fcaacc3b3584e4a23d
dff87b88fb2ffccdadc8d3c04ffe475d848247456fa7c5b95328ccc14e7a48ea
Analyzer Verdict Alert fortinet Phishing
GET /sw.js HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: application/javascript
content-length: 3964
last-modified: Wed, 09 Nov 2022 07:32:31 GMT
etag: "636b578f-f7c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
news-mezihi.com/lands/53/images/video.gif
200 OK 500 kB URL HTTP/2 news-mezihi.com/lands/53/images/video.gif
IP
ASN #63023 AS-GLOBALTELEHOST
File type GIF image data, version 89a, 320 x 180\012- data
Size 500 kB (500082 bytes)
Hash 2e59da03066a7854825901e0c1460b52
8d5aa04f252de7a85b8387051c1321338ac32d32
63412ff22ec2f712d6e82d34889a0a48948523dedd0bfce03bba69a19a9b4433
GET /lands/53/images/video.gif HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: image/gif
content-length: 500082
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-7a172"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
news-mezihi.com/favicon.ico
200 OK 1.2 kB URL HTTP/2 news-mezihi.com/favicon.ico
IP
ASN #63023 AS-GLOBALTELEHOST
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 183cab2f5d4582ef71ae37efc8d458dd
7c230eba9c1ce7900ea9bbf53dde00ea068dc995
c96fb13d89231c5a743ca1826064cd884ed4ec629fd66f15c0dbcf173dfbbf3e
GET /favicon.ico HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: image/x-icon
content-length: 1150
last-modified: Sat, 20 Jul 2019 16:00:28 GMT
etag: "5d333a9c-47e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: xUn4hW15UPbSKpeTz9Lhyg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: qb8L1OcR+tU7CEOW0/Zulbb2qRc=
1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
200 OK 16 kB URL HTTP/2 1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
IP
ASN #63023 AS-GLOBALTELEHOST
Hash efbde664cc67ecb203b5b55456bfbf9f
537d62fe274cbbf277a9ef0fb250491ee3390876
f01ba6a986563e06d34271f0fb3718fddb70c4211582cb1e1fa182dbb5c9f224
GET /lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4= HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
pragma: no-cache
set-cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D; expires=Mon, 28-Nov-2022 09:18:25 GMT; Max-Age=3600; path=/
content-encoding: gzip
X-Firefox-Spdy: h2
1.news-mezihi.com/lands/53/css/style.css
200 OK 6.8 kB URL HTTP/2 1.news-mezihi.com/lands/53/css/style.css
IP
ASN #63023 AS-GLOBALTELEHOST
Hash e847018357e35201fc307010d2f273d4
dc937966829b556914867618c050d9a071cbff7f
a1f4e7ef79d0ff0e7daa8e33bbc20e8a77cfa2893f618fad12a81660ca9e90f4
GET /lands/53/css/style.css HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: text/css
content-length: 6750
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1a5e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
news-mezihi.com/traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53
200 OK 609 B URL HTTP/2 news-mezihi.com/traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53
IP
ASN #63023 AS-GLOBALTELEHOST
Hash 8e2d13a2f22eb331e283a9185fc63434
1a1d31ef22ce8440ffa7c2f6a1310df1115b906b
580cb425ba391103228508471b757b355c53f28e992cfb245b78043705f95b18
GET /traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53 HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
1.news-mezihi.com/lands/53/images/video.gif
200 OK 500 kB URL HTTP/2 1.news-mezihi.com/lands/53/images/video.gif
IP
ASN #63023 AS-GLOBALTELEHOST
File type GIF image data, version 89a, 320 x 180\012- data
Size 500 kB (500082 bytes)
Hash 2e59da03066a7854825901e0c1460b52
8d5aa04f252de7a85b8387051c1321338ac32d32
63412ff22ec2f712d6e82d34889a0a48948523dedd0bfce03bba69a19a9b4433
GET /lands/53/images/video.gif HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: image/gif
content-length: 500082
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-7a172"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
1.news-mezihi.com/lands/53/js/device.js
200 OK 7.4 kB URL HTTP/2 1.news-mezihi.com/lands/53/js/device.js
IP
ASN #63023 AS-GLOBALTELEHOST
File type HTML document, ASCII text
Hash 46ce7a0522431a9a972b55b01bf0c1f1
263694d7c99de62fb4e9f4e9215ec9df92f16dc2
8b4fd7bcadd8d9e95b7aebae2f7b233dab0453cc931ba13add8a313dc3c61033
Analyzer Verdict Alert fortinet Phishing
GET /lands/53/js/device.js HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: application/javascript
content-length: 7364
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1cc4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
1.news-mezihi.com/sw.js
200 OK 4.0 kB IP
ASN #63023 AS-GLOBALTELEHOST
File type ASCII text, with very long lines (3964), with no line terminators
Hash 7c60cc903a18857a61023bde734a757b
d53632ffe44847e798eeb6fcaacc3b3584e4a23d
dff87b88fb2ffccdadc8d3c04ffe475d848247456fa7c5b95328ccc14e7a48ea
Analyzer Verdict Alert fortinet Phishing
GET /sw.js HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: application/javascript
content-length: 3964
last-modified: Wed, 09 Nov 2022 07:32:31 GMT
etag: "636b578f-f7c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
1.news-mezihi.com/favicon.ico
200 OK 1.2 kB URL HTTP/2 1.news-mezihi.com/favicon.ico
IP
ASN #63023 AS-GLOBALTELEHOST
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 183cab2f5d4582ef71ae37efc8d458dd
7c230eba9c1ce7900ea9bbf53dde00ea068dc995
c96fb13d89231c5a743ca1826064cd884ed4ec629fd66f15c0dbcf173dfbbf3e
GET /favicon.ico HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: image/x-icon
content-length: 1150
last-modified: Sat, 20 Jul 2019 16:00:28 GMT
etag: "5d333a9c-47e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/revopush.js?v=4
200 OK 8.9 kB URL HTTP/2 2.news-mezihi.com/revopush.js?v=4
IP
ASN #63023 AS-GLOBALTELEHOST
File type ASCII text, with very long lines (8922), with no line terminators
Hash 51014cabdb246e54c6fe1c7864225e81
04390aa362cc51c8f3aa848e5f1a11b3f9ba2751
32da65acc9ea9ff95f364751b4855731358710ebeb6b25d863a1c5d02dc73bd1
GET /revopush.js?v=4 HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: application/javascript
content-length: 8922
last-modified: Mon, 29 Aug 2022 09:05:32 GMT
etag: "630c815c-22da"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/lands/53/css/style.css
200 OK 6.8 kB URL HTTP/2 2.news-mezihi.com/lands/53/css/style.css
IP
ASN #63023 AS-GLOBALTELEHOST
Hash e847018357e35201fc307010d2f273d4
dc937966829b556914867618c050d9a071cbff7f
a1f4e7ef79d0ff0e7daa8e33bbc20e8a77cfa2893f618fad12a81660ca9e90f4
GET /lands/53/css/style.css HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: text/css
content-length: 6750
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1a5e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/lands/53/images/spinning-circles2.svg
200 OK 503 B URL HTTP/2 2.news-mezihi.com/lands/53/images/spinning-circles2.svg
IP
ASN #63023 AS-GLOBALTELEHOST
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 14e6f9981fa27406176056df2451d27b
aa1b6fd6071391d0031bff2d74ae77347ec2fdb4
466d361db2f130d7e3d40a671c935e3e556c3a49567657afee2e44a0a390a84f
Analyzer Verdict Alert fortinet Phishing
GET /lands/53/images/spinning-circles2.svg HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: image/svg+xml
content-length: 503
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1f7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/lands/53/images/video.gif
200 OK 500 kB URL HTTP/2 2.news-mezihi.com/lands/53/images/video.gif
IP
ASN #63023 AS-GLOBALTELEHOST
File type GIF image data, version 89a, 320 x 180\012- data
Size 500 kB (500082 bytes)
Hash 2e59da03066a7854825901e0c1460b52
8d5aa04f252de7a85b8387051c1321338ac32d32
63412ff22ec2f712d6e82d34889a0a48948523dedd0bfce03bba69a19a9b4433
GET /lands/53/images/video.gif HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: image/gif
content-length: 500082
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-7a172"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/lands/53/js/device.js
200 OK 7.4 kB URL HTTP/2 2.news-mezihi.com/lands/53/js/device.js
IP
ASN #63023 AS-GLOBALTELEHOST
File type HTML document, ASCII text
Hash 46ce7a0522431a9a972b55b01bf0c1f1
263694d7c99de62fb4e9f4e9215ec9df92f16dc2
8b4fd7bcadd8d9e95b7aebae2f7b233dab0453cc931ba13add8a313dc3c61033
Analyzer Verdict Alert fortinet Phishing
GET /lands/53/js/device.js HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: application/javascript
content-length: 7364
last-modified: Fri, 20 Aug 2021 13:24:46 GMT
etag: "611fad1e-1cc4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/sw.js
200 OK 4.0 kB IP
ASN #63023 AS-GLOBALTELEHOST
File type ASCII text, with very long lines (3964), with no line terminators
Hash 7c60cc903a18857a61023bde734a757b
d53632ffe44847e798eeb6fcaacc3b3584e4a23d
dff87b88fb2ffccdadc8d3c04ffe475d848247456fa7c5b95328ccc14e7a48ea
Analyzer Verdict Alert fortinet Phishing
GET /sw.js HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: application/javascript
content-length: 3964
last-modified: Wed, 09 Nov 2022 07:32:31 GMT
etag: "636b578f-f7c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
2.news-mezihi.com/favicon.ico
200 OK 1.2 kB URL HTTP/2 2.news-mezihi.com/favicon.ico
IP
ASN #63023 AS-GLOBALTELEHOST
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 183cab2f5d4582ef71ae37efc8d458dd
7c230eba9c1ce7900ea9bbf53dde00ea068dc995
c96fb13d89231c5a743ca1826064cd884ed4ec629fd66f15c0dbcf173dfbbf3e
GET /favicon.ico HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: image/x-icon
content-length: 1150
last-modified: Sat, 20 Jul 2019 16:00:28 GMT
etag: "5d333a9c-47e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 73886f2ef24b41109c43e4924e115cae
d44ab0113f7b391d2cefbbecc011d4b807f2be93
740836caa285c6fd53f24908a214d7ac45c5aaaa9235b919556bb0aa65577f2a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "740836CAA285C6FD53F24908A214D7AC45C5AAAA9235B919556BB0AA65577F2A"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9002
Expires: Mon, 28 Nov 2022 10:48:28 GMT
Date: Mon, 28 Nov 2022 08:18:26 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 177146e7bd19f04b81b97be918789d25
41cd53eda6b665ac319c2105035a1e2c87b3f81e
0d55076b728b94ea2e57dd1cb603419e2249d062fac38f7758fa8794fac64f0b
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "0D55076B728B94EA2E57DD1CB603419E2249D062FAC38F7758FA8794FAC64F0B"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3146
Expires: Mon, 28 Nov 2022 09:10:53 GMT
Date: Mon, 28 Nov 2022 08:18:27 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 177146e7bd19f04b81b97be918789d25
41cd53eda6b665ac319c2105035a1e2c87b3f81e
0d55076b728b94ea2e57dd1cb603419e2249d062fac38f7758fa8794fac64f0b
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "0D55076B728B94EA2E57DD1CB603419E2249D062FAC38F7758FA8794FAC64F0B"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3146
Expires: Mon, 28 Nov 2022 09:10:53 GMT
Date: Mon, 28 Nov 2022 08:18:27 GMT
Connection: keep-alive
43asc.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=2
200 OK 202 kB URL HTTP/2 43asc.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=2
IP
ASN #39572 DataWeb Global Group B.V.
Size 202 kB (201915 bytes)
Hash 04244f520ec239ba4528b1e56cd50390
56767e7639ba19e56b1d3882ddd0bef5f4e223bb
ad72d64a38f70faff5dfccaa03dbb027a708eea637e338dd93e6da23122c5c50
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=2 HTTP/1.1
Host: 43asc.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://7fieg.haxbyq.com/
Cookie: truniq=1; ufp2=41deec88d0d24bcbe967485bdc4447ab01eabd80
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:27 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
ulmoyc.com/v1/sdk.js?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6MiwicG0iOjF9eyJ&d=haxbyq.com&tpl=63&pbd=iOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksImkiOiIxIn0=eyJwaWQ
200 OK 4.2 kB URL HTTP/2 ulmoyc.com/v1/sdk.js?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6MiwicG0iOjF9eyJ&d=haxbyq.com&tpl=63&pbd=iOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksImkiOiIxIn0=eyJwaWQ
IP
File type ASCII text, with very long lines (11265), with no line terminators
Hash 5768db2187fc3e8facc149e844744fb8
8f18b8062680b756f4488eccf821acd5c04f25db
f4f429898250ec67530ef3cb10023125572849c1c1c29aa4cdba75c292788a73
GET /v1/sdk.js?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6MiwicG0iOjF9eyJ&d=haxbyq.com&tpl=63&pbd=iOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksImkiOiIxIn0=eyJwaWQ HTTP/1.1
Host: ulmoyc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://7fieg.haxbyq.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 28 Nov 2022 08:18:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-origin: https://haxbyq.com
etag: W/"8+dPzOx2W8D6ALTHrlPnt24vCWw"
x-zone: eu
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Idxa6juXk1%2F5T9fWlUSoOE%2BsMKnbFcnmFbx591r4rMNn3E8d4kk4LbGTvHApr1ir%2BSOUM8Yf02Jd0vpj5cOVNm%2BK%2Bu%2BTUbVwoXoftLMvsoKPb0ewwEsULr%2BNBLFh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7711ac47ee6cb4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11130
Expires: Mon, 28 Nov 2022 11:23:57 GMT
Date: Mon, 28 Nov 2022 08:18:27 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11130
Expires: Mon, 28 Nov 2022 11:23:57 GMT
Date: Mon, 28 Nov 2022 08:18:27 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11130
Expires: Mon, 28 Nov 2022 11:23:57 GMT
Date: Mon, 28 Nov 2022 08:18:27 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb4908162-9f1d-4654-8d78-fe85386ce233.jpeg
200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb4908162-9f1d-4654-8d78-fe85386ce233.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7e5051d8c06f69e1842a9295ce256a36
1a542a53ba0b1cd0fb23257ebed8166555f16dfb
a7c0dbbb4d0d9138f5ca318cc2aa44e12dadf7ed6263ec204ba756da64b29c41
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb4908162-9f1d-4654-8d78-fe85386ce233.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7556
x-amzn-requestid: 1cda5313-2256-4830-bf84-2e6e15949d3e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cR78KFTmoAMF4yg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6383d9e7-452e36d718a298d12a2374a9;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 21:43:03 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: OWVkuAw6-nRNU_CVOgvsSSenSXnfSYSmJiKa60JvSaiJgPuXjJByZw==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 21:46:41 GMT
age: 37906
etag: "1a542a53ba0b1cd0fb23257ebed8166555f16dfb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcd94c980-e701-4603-9381-0bd47116d31d.jpeg
200 OK 6.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcd94c980-e701-4603-9381-0bd47116d31d.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash fa848cb85e85df184b078fe7aa95ae52
21aa6418f3a0d2b64925b66d5fb9079b7e84a11c
37d299c166e3350dee6dee647e98a86f8bd916d186bae12c42764ed0a3177085
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcd94c980-e701-4603-9381-0bd47116d31d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5989
x-amzn-requestid: db10fcc5-80ab-4650-af49-d5afe36706f3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cR78LHQqIAMF9_g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6383d9e7-4cbd19e3227894844807742c;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 21:43:03 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: P0Nx-FcvcV-f5cRPwZr5sEMb8pH3AoYFr185q_D0X2bE7z40nDn91w==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 21:51:04 GMT
age: 37643
etag: "21aa6418f3a0d2b64925b66d5fb9079b7e84a11c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
7fieg.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=1
200 OK 208 kB URL HTTP/2 7fieg.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=1
IP
ASN #39572 DataWeb Global Group B.V.
Size 208 kB (207674 bytes)
Hash d4b7a8adad099c44ed52b0aa459086a0
e098d9da9da444247811b2402b72f59fa181c08f
3e182ab9ff44aeece45732db65809debdedf7d50c49ab9ae403fe1c35236a1bb
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=1 HTTP/1.1
Host: 7fieg.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://haxbyq.com/
Cookie: truniq=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
ulmoyc.com/fp.js?d=7fieg.haxbyq.com
200 OK 9.3 kB URL HTTP/2 ulmoyc.com/fp.js?d=7fieg.haxbyq.com
IP
File type ASCII text, with very long lines (1187), with no line terminators
Hash 9e8a6c7c79569456484b6f0855a11530
ba1389bdf8c7dfdc5d5cff0d8e35ca568b9204fd
5d66ac44ac8f9c40dc2316a11d19437c5ac93bfad09ce5882f52a5fec25a8b80
GET /fp.js?d=7fieg.haxbyq.com HTTP/1.1
Host: ulmoyc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://7fieg.haxbyq.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 28 Nov 2022 08:18:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: max-age=14400
max-age: 0
access-control-allow-origin: https://7fieg.haxbyq.com
x-zone: eu
last-modified: Mon, 28 Nov 2022 08:18:27 GMT
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wybMQ90NdVgtPPenSHAtAyd56yeOgpffPOYei03n6Y79y6ZcHlauOqGaW%2BTaxuLt4yQasOEDUiXu%2F%2BqaVdh6woUDJGcw8BeDWVCHv1443dY7%2Bw6lieq6IU6i6NY0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7711ac485eefb4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F165667de-df17-4cc6-832c-94f49703bdf2.jpeg
200 OK 9.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F165667de-df17-4cc6-832c-94f49703bdf2.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1f434933b5bd6377d299ada22d1ae7ef
075531f525e625b117b2497f31139c9824d0e9c5
b587a3249e4f20112088608e3651c2ccbc44225a5c9d88d3bf5884d7f0e9029c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F165667de-df17-4cc6-832c-94f49703bdf2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9430
x-amzn-requestid: 454ca8bd-a256-45f2-8b41-feee86c5af82
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cR7wyGCIIAMFhgw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6383d99e-1488f8ce71a91ebc3ad6b7e0;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 21:41:50 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ibLuLI6j9EWh0dgk51O7kiPBRyURZ0UdNtlgbBD-SXnDg_GT_tJm8Q==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 22:01:16 GMT
age: 37031
etag: "075531f525e625b117b2497f31139c9824d0e9c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F17eed5ca-e7b1-43be-b937-69356fce9d8a.jpeg
200 OK 4.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F17eed5ca-e7b1-43be-b937-69356fce9d8a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4060284252d32701c42e2df4a83970a0
a73feecd0e221f7c7a3b74b75aeaa81bd9baa1da
53eca0f8435d6e2e62962ef80d4597afad2773a582746d523f7f5d30c3e07b8e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F17eed5ca-e7b1-43be-b937-69356fce9d8a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4708
x-amzn-requestid: 6efd15cd-c944-42e7-8142-01360fbe4a25
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cR6_JFbXIAMFc_g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6383d860-3c7d91eb7a2f3a9669f89d88;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 21:36:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GDQn-_Np3qSCYR2kQJnoh6j3-aS25bPTNl13D6MkZpF1fkOhokkFbA==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 22:02:24 GMT
age: 36963
etag: "a73feecd0e221f7c7a3b74b75aeaa81bd9baa1da"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
uapoj.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=5
200 OK 205 kB URL HTTP/2 uapoj.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=5
IP
ASN #39572 DataWeb Global Group B.V.
Size 205 kB (205139 bytes)
Hash 3611e35d62544fdc959764fd90e3a132
21caa75443298828891484edc0ed441348627b0c
cc9d45545f102a2f7d75da4d30518add484590daa350d70adf2c65f2b98607c6
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=5 HTTP/1.1
Host: uapoj.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://i7gve.haxbyq.com/
Cookie: truniq=1; ufp2=41deec88d0d24bcbe967485bdc4447ab01eabd80
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 05e71eda899dd6459af2dc6308d4a036
8848e587e4d1f42f26d26a88dbc4a6d4c96f49bf
1e071aa131760b1ae1ccbd01b62a94c86632f3666b4ada326174f1a1397d1a41
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1E071AA131760B1AE1CCBD01B62A94C86632F3666B4ADA326174F1A1397D1A41"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11034
Expires: Mon, 28 Nov 2022 11:22:24 GMT
Date: Mon, 28 Nov 2022 08:18:30 GMT
Connection: keep-alive
tratbc.com/tb?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=9
302 Found 3.7 kB URL HTTP/1.1 tratbc.com/tb?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=9
IP
ASN #14061 DIGITALOCEAN-ASN
Hash 7619343b895261caeac7821be39ea48f
507073d9bf3e110c2e7edb00596660baf13639c7
f210cff48b85391fd855be03b2b586144b60e3cc2fda2b5f3a6869082ab0a4bb
GET /tb?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=9 HTTP/1.1
Host: tratbc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://luxi2.haxbyq.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.15.0
Date: Mon, 28 Nov 2022 08:18:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://www.brainstredd.com/?sl=5532534-93862&website=pro
X-Zone: eu
www.brainstredd.com/?sl=5532534-93862&website=pro
200 OK 6.3 kB URL HTTP/1.1 www.brainstredd.com/?sl=5532534-93862&website=pro
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5553)
Hash 51c6a88554d3882a802357d83cfcfbb7
ae42183e95b3158df178964d30361d001c6ff1b9
45ffedcfa63d500a3cf40f1a6e4bdccf6907778a7289342e7933c24f8ad70d65
GET /?sl=5532534-93862&website=pro HTTP/1.1
Host: www.brainstredd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://luxi2.haxbyq.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Mon, 28 Nov 2022 08:18:30 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-transform
Accept-CH: Sec-CH-UA-Platform-Version
io46t.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=6
200 OK 205 kB URL HTTP/2 io46t.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=6
IP
ASN #39572 DataWeb Global Group B.V.
Size 205 kB (205141 bytes)
Hash d782cee5f87033cc807ca5f9516808e0
87621d8141a4b6389c4b8aa0a495e1173159870b
463940ac5566b15c6de8e589e1ccf6dd0c47f8f64d5fe2cded1d930d88cb5bf9
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=6 HTTP/1.1
Host: io46t.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://uapoj.haxbyq.com/
Cookie: truniq=1; ufp2=41deec88d0d24bcbe967485bdc4447ab01eabd80
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
www.brainstredd.com/?sl=5532534-93862&website=pro&eyeg=3&eyer=0.3975073049645601&eyei=0&eyew=1280&eyeh=939&eyetd=222211224000&eyef=https%3A%2F%2Fluxi2.haxbyq.com%2F
302 Found 0 B URL HTTP/1.1 www.brainstredd.com/?sl=5532534-93862&website=pro&eyeg=3&eyer=0.3975073049645601&eyei=0&eyew=1280&eyeh=939&eyetd=222211224000&eyef=https%3A%2F%2Fluxi2.haxbyq.com%2F
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5532534-93862&website=pro&eyeg=3&eyer=0.3975073049645601&eyei=0&eyew=1280&eyeh=939&eyetd=222211224000&eyef=https%3A%2F%2Fluxi2.haxbyq.com%2F HTTP/1.1
Host: www.brainstredd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
HTTP/1.1 302 Found
Date: Mon, 28 Nov 2022 08:18:30 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://admoustache.go2affise.com/sl?id=59a83ff913943bff7e8b4571&pid=503&sub1=33000bfee6a3282c176ee31a12e117d2dbb8f1128-202211-flb*5532534-93862**sl_5532534-93862*12eb29bb4c6697c5a79bae5359cea994c385b4b0*pro*
www.brainstredd.com/favicon.ico
204 No Content 0 B URL HTTP/1.1 www.brainstredd.com/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: www.brainstredd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 204 No Content
Date: Mon, 28 Nov 2022 08:18:30 GMT
Connection: keep-alive
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 88142f4ad3d1da6ec640bdbc409036d6
dab6dd1c3af0c62e27309756f934823f62cddfbd
65518006b79d9395fa11e64ee880261da29ba243b556f988c84ef9c1d70cdaea
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Mon, 28 Nov 2022 08:18:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 27 Nov 2022 20:45:52 GMT
Expires: Mon, 28 Nov 2022 20:45:52 GMT
ETag: "dab6dd1c3af0c62e27309756f934823f62cddfbd"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
admoustache.go2affise.com/sl?id=59a83ff913943bff7e8b4571&pid=503&sub1=33000bfee6a3282c176ee31a12e117d2dbb8f1128-202211-flb*5532534-93862**sl_5532534-93862*12eb29bb4c6697c5a79bae5359cea994c385b4b0*pro*
302 Found 0 B URL HTTP/2 admoustache.go2affise.com/sl?id=59a83ff913943bff7e8b4571&pid=503&sub1=33000bfee6a3282c176ee31a12e117d2dbb8f1128-202211-flb*5532534-93862**sl_5532534-93862*12eb29bb4c6697c5a79bae5359cea994c385b4b0*pro*
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sl?id=59a83ff913943bff7e8b4571&pid=503&sub1=33000bfee6a3282c176ee31a12e117d2dbb8f1128-202211-flb*5532534-93862**sl_5532534-93862*12eb29bb4c6697c5a79bae5359cea994c385b4b0*pro* HTTP/1.1
Host: admoustache.go2affise.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Mon, 28 Nov 2022 08:18:30 GMT
content-length: 0
location: https://d7fffce7.isohnut.com/rc/86b528a829?affclick=63846ed6ea9e7e00019ee479&pubid=503
x-adjust-use-original-forwarded-for: 1
referer:
referrer-policy: no-referrer
set-cookie: afclick=63846ed6ea9e7e00019ee479; expires=Tue, 28 Nov 2023 08:18:30 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash 1380fb3b167b9791aaae1af1b4790147
43f4515dde107dc71640ec3d8c7a8d7129c70c9a
a292473fc332b616fe4025484bee7a6f8a9dfbaf2ded4d09b03ba5faeab8f29e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=102660
Content-Type: application/ocsp-response
Date: Mon, 28 Nov 2022 08:18:30 GMT
Etag: "63835cda-118"
Expires: Tue, 29 Nov 2022 12:49:30 GMT
Last-Modified: Sun, 27 Nov 2022 12:49:30 GMT
Server: nginx
Content-Length: 280
ocsp.digicert.com/
200 OK 280 B IP
Hash 1380fb3b167b9791aaae1af1b4790147
43f4515dde107dc71640ec3d8c7a8d7129c70c9a
a292473fc332b616fe4025484bee7a6f8a9dfbaf2ded4d09b03ba5faeab8f29e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1
Cache-Control: max-age=102660
Content-Type: application/ocsp-response
Date: Mon, 28 Nov 2022 08:18:31 GMT
Etag: "63835cda-118"
Expires: Tue, 29 Nov 2022 12:49:31 GMT
Last-Modified: Sun, 27 Nov 2022 12:49:30 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 280
ocsp.digicert.com/
200 OK 280 B IP
Hash 7958b4fb78f2a234b6c5f908b20e9232
c81cd646bc4e44c0d3cfa5124b7efa0ebb597291
a5481322dbcc20a6aed8b4f8292371156ad41c565211b6ca6146150ad8f2122f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 136
Cache-Control: max-age=164330
Content-Type: application/ocsp-response
Date: Mon, 28 Nov 2022 08:18:31 GMT
Etag: "63844d39-118"
Expires: Wed, 30 Nov 2022 05:57:21 GMT
Last-Modified: Mon, 28 Nov 2022 05:55:05 GMT
Server: ECS (amb/6B79)
X-Cache: HIT
Content-Length: 280
ocsp.digicert.com/
200 OK 280 B IP
Hash 7958b4fb78f2a234b6c5f908b20e9232
c81cd646bc4e44c0d3cfa5124b7efa0ebb597291
a5481322dbcc20a6aed8b4f8292371156ad41c565211b6ca6146150ad8f2122f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 136
Cache-Control: max-age=164330
Content-Type: application/ocsp-response
Date: Mon, 28 Nov 2022 08:18:31 GMT
Etag: "63844d39-118"
Expires: Wed, 30 Nov 2022 05:57:21 GMT
Last-Modified: Mon, 28 Nov 2022 05:55:05 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 280
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cc7471893e448c4bb2495d6fdd870505
828fea0de6fc239677f571385fd3b7381f7e538f
d8cb89584173d9acc58159a9ad93533c85ef74d952e102f1b4ced2971ad7c255
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8CB89584173D9ACC58159A9AD93533C85EF74D952E102F1B4CED2971AD7C255"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7707
Expires: Mon, 28 Nov 2022 10:26:58 GMT
Date: Mon, 28 Nov 2022 08:18:31 GMT
Connection: keep-alive
www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
200 OK 15 kB URL HTTP/2 www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (521)
Hash 71f0590c83e8170679f5b095dcfefe9b
3f23ba1dce8bdd1f3e3bf448bba005bfadad628e
5440dfed720c49515bb76aebfcae91c92f4b640fe4e351e1ea18d485e332761f
GET /Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d7fffce7.isohnut.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
set-cookie: w=45580; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
ws=8063a697_503; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
wt=pub7468e2831045467c8d1d54704bd9951f; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; expires=Wed, 30-Nov-2022 10:18:31 GMT; Max-Age=180000; path=/; SameSite=Strict
CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511; expires=Mon, 28-Nov-2022 08:48:31 GMT; Max-Age=1800; path=/; SameSite=Strict
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
content-length: 15202
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
cdn.addlnk.com/redirect.css
200 OK 117 kB URL HTTP/2 cdn.addlnk.com/redirect.css
IP
File type ASCII text, with very long lines (1242), with no line terminators
Size 117 kB (116630 bytes)
Hash 5563a95e2c39f0d40d3c1b349d308e69
5162fdc3b2e78412de83e163b95fd0f0335a0f40
68d8a9279d1f415b3ffcbd7bb9f6da71f3b9e2aeddf090ffc139baff52efe3a1
GET /redirect.css HTTP/1.1
Host: cdn.addlnk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d7fffce7.isohnut.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 28 Nov 2022 08:18:31 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=1680
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
x-amz-id-2: hoKGF2DENF0Fxpfk9aX2Txj0orTMbszygnDmGFSC4SoL/4C3WQsM9k4Y5ZmrshXNgXN64qzAUMY=
x-amz-request-id: 9NDC432NBG524RW1
cf-cache-status: HIT
age: 858
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HDLY9RnuRPb3%2BQPltzWAtnr8uf%2BrOS1Ih7R9O3mUhIV8n9wf85Bt3N6A9m1RnG%2FkptJflP50CmBqGUg%2FjFQkExrLNFQCY%2BXSeYpjyTtbrhtrJQZBlvC6VDjnGN4735T7zw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7711ac6039470b65-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/search_icon.gif
200 OK 31 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/search_icon.gif
IP
File type GIF image data, version 89a, 200 x 200\012- data
Hash 96de9ab9fabda706a3fa92c1a416de0e
ca8f2337b90bcd5f7f772c11cf2da87451216c19
0da91a11fa7e9c73d8ade4d23fb0fd208f481cadb780fb5f5d3719e12ec56b5e
GET /DynBanner/PreUmfrage7/img/search_icon.gif HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
etag: "2238"
last-modified: Tue, 01 Feb 2022 08:45:51 GMT
content-length: 30740
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/check.png
200 OK 450 B URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/check.png
IP
File type PNG image data, 20 x 12, 8-bit colormap, non-interlaced\012- data
Hash 6236c50ab93e996fe641c5e5d0f34fc7
8e4960ff36414baac421cc8429afbf651bc8a139
f698ac4872d38c500078200c87fccbc05c7e30b099b35c7c9f0c4cabe7ea5aaf
GET /DynBanner/PreUmfrage7/img/check.png HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/png
etag: "1073745424"
last-modified: Tue, 01 Feb 2022 08:45:51 GMT
content-length: 450
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/bundle.ca7750858eed0989f83d.js
200 OK 49 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/bundle.ca7750858eed0989f83d.js
IP
File type Unicode text, UTF-8 text, with very long lines (35742), with NEL line terminators
Hash 8890f324edf2b67aa0b081f077d62cc0
a1433f09211a47c9d4e5956ad3bdef53c713406b
84906b4f6e9297afd1aeb990ca42a8fb24b6e87f1618a5338081b8cf777cd7a9
GET /DynBanner/PreUmfrage7/bundle.ca7750858eed0989f83d.js HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: text/javascript
etag: "1140853350-br"
last-modified: Tue, 01 Feb 2022 08:45:51 GMT
content-length: 48776
cache-control: public
vary: Accept-Encoding
content-encoding: br
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/16/3.gif
200 OK 456 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/16/3.gif
IP
File type GIF image data, version 89a, 480 x 320\012- data
Size 456 kB (455881 bytes)
Hash ed392d6797c48ef794e72e19208d505f
8ee4f233fe0f1baf094f1763649b73d4cc0fe4af
a05e2250272bbb379ea7745e9e4dd78b499f4087aeaf7f5f1fd518ca1845ad77
GET /DynBanner/PreUmfrage7/img/16/3.gif HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
etag: "201330293"
last-modified: Fri, 04 Feb 2022 07:44:39 GMT
content-length: 455881
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/16/1.gif
200 OK 641 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/16/1.gif
IP
File type GIF image data, version 89a, 480 x 320\012- data
Size 641 kB (641133 bytes)
Hash 15181c2f9d55030c52445bec421d9dac
83a32c4d4f242a6192b0827d0aab9208c8012241
8b845651ca26bf49c4c3289af72bc3cd1d1c195723c61496c813a46c369da8ad
GET /DynBanner/PreUmfrage7/img/16/1.gif HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
etag: "301992794"
last-modified: Tue, 01 Feb 2022 08:45:51 GMT
content-length: 641133
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/16/4.gif
200 OK 811 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/16/4.gif
IP
File type GIF image data, version 89a, 480 x 320\012- data
Size 811 kB (810889 bytes)
Hash 9986f538b39195b5998906592ce3cd4a
7e803829ae95ce19f8434934d1d3a5426444112c
95fc401e12188c87bbad2b0269ccf9791014a44c0683c3ecdd303f6c5078a83f
GET /DynBanner/PreUmfrage7/img/16/4.gif HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
etag: "3623881823"
last-modified: Fri, 04 Feb 2022 07:44:39 GMT
content-length: 810889
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/16/5.gif
200 OK 808 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/16/5.gif
IP
File type GIF image data, version 89a, 480 x 320\012- data
Size 808 kB (807578 bytes)
Hash 23df7b217af1b20a2e0f61ef2a425553
84c11c90293daf0b9c2d8fd3cde82ad3b04a2328
f1f862b48a8e36cfcf3fe652bf8c35d58b68058fbac223494578ad00dd650bed
GET /DynBanner/PreUmfrage7/img/16/5.gif HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
etag: "2550140100"
last-modified: Fri, 04 Feb 2022 07:44:39 GMT
content-length: 807578
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/DynBanner/PreUmfrage7/img/16/2.gif
200 OK 889 kB URL HTTP/2 www.wazazu.com/DynBanner/PreUmfrage7/img/16/2.gif
IP
File type GIF image data, version 89a, 480 x 320\012- data
Size 889 kB (889113 bytes)
Hash 4c75e9fa813ae08a5181d9d70629891a
7ca226a86250669e5bdb83942810d6628f0edd21
da15628e49e4176dbd0a20a2607b9bc30d9535c020b92491a5222f57a4c65f3a
GET /DynBanner/PreUmfrage7/img/16/2.gif HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
etag: "1509951724"
last-modified: Tue, 01 Feb 2022 08:45:51 GMT
content-length: 889113
cache-control: public
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/Dyn/Webpush/Pre?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f&js=1&age=16
200 OK 7.0 kB URL HTTP/2 www.wazazu.com/Dyn/Webpush/Pre?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f&js=1&age=16
IP
File type HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (18846)
Hash b6b93211d9d998ae3dfd2fb2959fbbe1
65cb90f139dcae6f60059cf716470bb15e499496
db679426e5c735917d3648f5b66ee6f3502bc7e358e4bb22d46fb894decfc654
GET /Dyn/Webpush/Pre?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f&js=1&age=16 HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
set-cookie: w=45580; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
ws=8063a697_503; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
wt=pub7468e2831045467c8d1d54704bd9951f; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; expires=Wed, 30-Nov-2022 10:18:31 GMT; Max-Age=180000; path=/; SameSite=Strict
CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511; expires=Mon, 28-Nov-2022 08:48:31 GMT; Max-Age=1800; path=/; SameSite=Strict
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
content-length: 6977
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/CrM/Close/Smart/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f&gkf=1&adtv=14394.11154_7e0f85_ef71c&referer=https%3A%2F%2Fd7fffce7.isohnut.com%2F&js=1&age=16&initial=DynBanner%3A14382.11154_484b33_e736c&gk_zone=ext_preumfrage7&__idAd=
200 OK 18 kB URL HTTP/2 www.wazazu.com/CrM/Close/Smart/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f&gkf=1&adtv=14394.11154_7e0f85_ef71c&referer=https%3A%2F%2Fd7fffce7.isohnut.com%2F&js=1&age=16&initial=DynBanner%3A14382.11154_484b33_e736c&gk_zone=ext_preumfrage7&__idAd=
IP
File type HTML document text\012- HTML document, ASCII text, with very long lines (25220)
Hash 6fbb8ad7fe869f157818887e5545d1ca
21bebc180e0c722e64b73832d597bbf86ac0363e
f6d94d1bac4f9680484ccd2811e2ba81c8c7001d9bfe18c85b69dfaaff1afa7b
GET /CrM/Close/Smart/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f&gkf=1&adtv=14394.11154_7e0f85_ef71c&referer=https%3A%2F%2Fd7fffce7.isohnut.com%2F&js=1&age=16&initial=DynBanner%3A14382.11154_484b33_e736c&gk_zone=ext_preumfrage7&__idAd= HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
set-cookie: w=45580; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
ws=8063a697_503; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
wt=pub7468e2831045467c8d1d54704bd9951f; expires=Mon, 28-Nov-2022 08:18:31 GMT; Max-Age=0; SameSite=Lax
sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; expires=Wed, 30-Nov-2022 10:18:31 GMT; Max-Age=180000; path=/; SameSite=Strict
CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511; expires=Mon, 28-Nov-2022 08:48:31 GMT; Max-Age=1800; path=/; SameSite=Strict
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
content-length: 18208
date: Mon, 28 Nov 2022 08:18:31 GMT
server: Webserver
X-Firefox-Spdy: h2
www.wazazu.com/icons/ext.png
200 OK 2.2 kB URL HTTP/2 www.wazazu.com/icons/ext.png
IP
File type PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Hash 3b58b839ade1bae5069a4eb40822322d
e326255ec2882ce0dcca92fb9b3eeb1050362076
4b06e0a2080f0c0ccd4442b336ab382bbf45de1092b28c4db7f1e2825daee07f
GET /icons/ext.png HTTP/1.1
Host: www.wazazu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/Smartlink/Dating/Soft?w=45580&ws=8063a697_503&wt=pub7468e2831045467c8d1d54704bd9951f
Cookie: sid=%96%B6%C9%B5%9C%22o%22%1Fu%8E%27%8D%DD%C5%A3%B6%CF%D2%F2E%82%7B%18%ED%01%F5-%8A%8D%D5s; CSRFToken=a903741d639422c749a7811731340f167efe7e8f72722beec0ff1ed27149c4ca.1669623511
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/png
etag: "3018"
last-modified: Wed, 02 Dec 2020 08:15:40 GMT
content-length: 2169
cache-control: public
date: Mon, 28 Nov 2022 08:18:33 GMT
server: Webserver
X-Firefox-Spdy: h2
cdn.koketti.com/dynbanner/webpush/52_webpush_7835398.jpg
200 OK 122 kB URL HTTP/1.1 cdn.koketti.com/dynbanner/webpush/52_webpush_7835398.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6], baseline, precision 8, 360x360, components 3\012- data
Size 122 kB (122349 bytes)
Hash 3658b6d4cd520d8c8a6be92cafb00744
ffa7feca981fb1acea0121a751a9623ade595bf2
3da4030c4a3aa818a8f27c8fc31a5504e6de95cdbf51a601c0f1ba0a7383098a
GET /dynbanner/webpush/52_webpush_7835398.jpg HTTP/1.1
Host: cdn.koketti.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.wazazu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Headers: X-Requested-With,Content-Range,If-Range,Range,Content-Type,Authorization,X-Request,Accept
Access-Control-Allow-Methods: *
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Last-Modified: Tue, 12 Jul 2022 12:34:34 GMT
P3p: CP="OTI DSP COR IVDo IVAo PSA PSD TAI DEV ADM CUR CONo OUR IND PHY ONL UNI PUR FIN COM NAV INT CNT PRE", policyref="/w3c/p3p.xml"
Date: Sun, 27 Nov 2022 14:35:04 GMT
Content-Length: 122349
Content-Type: image/jpeg
Accept-Ranges: bytes
Connection: keep-alive
tpik4.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=3
200 OK 0 B URL HTTP/2 tpik4.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=3
IP
ASN #39572 DataWeb Global Group B.V.
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=3 HTTP/1.1
Host: tpik4.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://43asc.haxbyq.com/
Cookie: truniq=1; ufp2=41deec88d0d24bcbe967485bdc4447ab01eabd80
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:27 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
i7gve.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=4
200 OK 0 B URL HTTP/2 i7gve.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=4
IP
ASN #39572 DataWeb Global Group B.V.
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=4 HTTP/1.1
Host: i7gve.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tpik4.haxbyq.com/
Cookie: truniq=1; ufp2=41deec88d0d24bcbe967485bdc4447ab01eabd80
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
news-mezihi.com/tds.php?sid=8051545&p1=8E9HbLB35s9rmg9LoomV7T&domain=news-mezihi.com&p1=8E9HbLB35s9rmg9LoomV7T
302 Found 0 B URL HTTP/2 news-mezihi.com/tds.php?sid=8051545&p1=8E9HbLB35s9rmg9LoomV7T&domain=news-mezihi.com&p1=8E9HbLB35s9rmg9LoomV7T
IP
ASN #63023 AS-GLOBALTELEHOST
GET /tds.php?sid=8051545&p1=8E9HbLB35s9rmg9LoomV7T&domain=news-mezihi.com&p1=8E9HbLB35s9rmg9LoomV7T HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 302 Found
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: text/html; charset=UTF-8
location: https://news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
cache-control: no-cache, must-revalidate
pragma: no-cache
X-Firefox-Spdy: h2
1.news-mezihi.com/traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53
200 OK 0 B URL HTTP/2 1.news-mezihi.com/traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53
IP
ASN #63023 AS-GLOBALTELEHOST
GET /traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53 HTTP/1.1
Host: 1.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
200 OK 0 B URL HTTP/2 news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
IP
ASN #63023 AS-GLOBALTELEHOST
GET /lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4= HTTP/1.1
Host: news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:25 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
pragma: no-cache
set-cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D; expires=Mon, 28-Nov-2022 09:18:25 GMT; Max-Age=3600; path=/
content-encoding: gzip
X-Firefox-Spdy: h2
2.news-mezihi.com/traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53
200 OK 0 B URL HTTP/2 2.news-mezihi.com/traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53
IP
ASN #63023 AS-GLOBALTELEHOST
GET /traffback.php?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=&land=53 HTTP/1.1
Host: 2.news-mezihi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2.news-mezihi.com/lands/53/?site=8051545&sub1=8E9HbLB35s9rmg9LoomV7T&sub2=&sub3=&sub4=
Cookie: clickdata=ODA1MTU0NXw6fDUzfDp8OEU5SGJMQjM1czlybWc5TG9vbVY3VHw6fHw6fHw6fA%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 28 Nov 2022 08:18:26 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
d4yig.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=8
200 OK 0 B URL HTTP/2 d4yig.haxbyq.com/video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=8
IP
ASN #39572 DataWeb Global Group B.V.
GET /video-14?h=waWQiOjEwMjQ3MjgsInNpZCI6MTE2OTg3NSwid2lkIjozOTU5MzksInNyYyI6Mn0=eyJ&i=8 HTTP/1.1
Host: d4yig.haxbyq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3ockp.haxbyq.com/
Cookie: truniq=1; ufp2=41deec88d0d24bcbe967485bdc4447ab01eabd80
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Mon, 28 Nov 2022 08:18:29 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu4
content-encoding: gzip
X-Firefox-Spdy: h2
3.70.16.242
34.102.187.140
23.36.77.32
194.116.151.11
185.56.234.205
104.21.74.141
93.184.220.29
51.68.82.147