send.cm/c6ffp6cuwkme
301 Moved Permanently 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /c6ffp6cuwkme HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Sat, 22 Oct 2022 18:31:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 22 Oct 2022 19:31:34 GMT
Location: https://send.cm/c6ffp6cuwkme
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tD3lwW2TZ4sU9MYq5XLf6vTysC4QWlcAiwkRVakd0OQ1R7hvhyPlsU%2B44twjRkxKXoZ7WTf8Fb6mo2dlkyOwB%2F0o5h%2B3h02RU8EAORcwx5WmxKc7X9CNdH8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75e44f8679560afe-OSL
alt-svc: h2=":443"; ma=60
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bdb8b66c705a7b996496d780f50c00b5
403ae92039fcc933870f51f913f78ccaf9652256
c923ed2539f4ce9f4d43743c402fbb2060a52a4cbedbf14c5f5742ab718073d6
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Length, Content-Type, Retry-After, Backoff
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sat, 22 Oct 2022 18:26:25 GMT
Expires: Sat, 22 Oct 2022 19:01:27 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 163cab6be16ba1fb5ee75dd6beeee0e2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P8
X-Amz-Cf-Id: 1cmxzcRJZq2iCFhwD8aL3j6QVGWLkCN3AkKlHSGLW0sAfH50RWxtcw==
Age: 309
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 73c4166ca864f777db2cc1cd8658a7c2
c56b66b0b7c8516d4d5bfafe0c166711c78f3d25
310c633350812c064e159275b6dbbdba6d6a5991a54ccfcc23459320c6513572
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "310C633350812C064E159275B6DBBDBA6D6A5991A54CCFCC23459320C6513572"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7875
Expires: Sat, 22 Oct 2022 20:42:49 GMT
Date: Sat, 22 Oct 2022 18:31:34 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ae56efd62a0d9249d98573172eb8b28b
5ff4e9959be677ad76c26ca73f9ef4feb9fa2f28
82d9ee4948fce839f7edb1f8490c4213cded3912464a4169b0bf6a61278694bd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "82D9EE4948FCE839F7EDB1F8490C4213CDED3912464A4169B0BF6A61278694BD"
Last-Modified: Sat, 22 Oct 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7892
Expires: Sat, 22 Oct 2022 20:43:06 GMT
Date: Sat, 22 Oct 2022 18:31:34 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 50kfSOV/JM0mpCaGlcdUDEz+PZsURYCuGTfB4jvAkUbJVMIPSX5Kb5u0iPoeCH5FpbGMF9HfLG8=
x-amz-request-id: TANSKS3QS87GYD5X
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 22 Oct 2022 17:37:39 GMT
age: 3235
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:34 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 5.8 kB URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
Hash af001d5571f6152fcbe3404ae694ace5
10212ed4a8a0cde49d0be53c75a40b394e5fbc62
f65487ae306230dae9e4db6dbade2d0a750cc9bfc9445003da598ddc661a7f76
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Pragma, Content-Length, Content-Type, ETag, Retry-After, Cache-Control, Last-Modified, Backoff, Expires
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sat, 22 Oct 2022 18:03:52 GMT
Cache-Control: max-age=3600
Expires: Sat, 22 Oct 2022 18:24:23 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 30ef06f785f68fc7da8b2baef8948156.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P8
X-Amz-Cf-Id: 0XGsmuKVmCqSo66QO2LoxVLA_MhHwfO2m3mGZ-VDqMGtxvEjnQHAdw==
Age: 1665
ocsp.digicert.com/
200 OK 471 B IP
Hash fecd12689ba4c6aa556814b7fac0d344
a3005f6333ce5201a73e2857c764a1b0091a91d5
83e0fb564f86df4300e8fc4b5baaf0ed13102c384922d388e02620fb3363a842
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4230
Cache-Control: max-age=139540
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "6353a495-1d7"
Expires: Mon, 24 Oct 2022 09:17:15 GMT
Last-Modified: Sat, 22 Oct 2022 08:06:45 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 9.2 kB IP
Hash 96590531702b49ca73f2c6826fb60fde
198bb203623661480e145e437bba9dd2c23e7d6a
0f04d7be675924d45022ba5013088a38634ed341583fd48d10034620d14253d4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1045
Cache-Control: max-age=106865
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "63533163-116"
Expires: Mon, 24 Oct 2022 00:12:40 GMT
Last-Modified: Fri, 21 Oct 2022 23:55:15 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 278
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 94ee541bb392e5675c1e24c94c197f8b
bce18b05a24f5e2c6743cbbe849a733091586176
82f791c205847646216d72b4ce65bc3587ca69d1da17a3a2afb477640822c4dc
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
200 OK 279 B IP
Hash 7e52e432bd9be6dcd6b3fa2b41f0a120
1322883d7042f527801ba2b7ce95ea77faaf39c1
ea750c5d9a6b3856333634465a68a6552fba34edd707a51a49ba2297618f0f6b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2808
Cache-Control: max-age=163715
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "63540892-117"
Expires: Mon, 24 Oct 2022 16:00:10 GMT
Last-Modified: Sat, 22 Oct 2022 15:13:22 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 279
www.googletagmanager.com/gtag/js?id=UA-3400026-25
200 OK 44 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=UA-3400026-25
IP
File type ASCII text, with very long lines (1588)
Hash 6ac03b29c0bc2b4f301fda6de3d923b9
3df145c107128dfbe494be2219e5b51ad740d538
70f1fdac4c4aeb9cf69c7294de275ba8626e9b9b955ade77679c4523751c7302
GET /gtag/js?id=UA-3400026-25 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 22 Oct 2022 18:31:35 GMT
expires: Sat, 22 Oct 2022 18:31:35 GMT
cache-control: private, max-age=900
last-modified: Sat, 22 Oct 2022 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 43647
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 05ee461624e2ec37f65e859afe6543ba
b99dcb558535d3d35d140e730aeeb41587622b30
576b3bf619d0a152889cc44165a229ad0100ccc319cf4d9044b2f26d4b676658
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
200 OK 278 B IP
Hash 255390792e08b2007a8bf78557a9d4d2
5fc0e511663bc577fd9a414959d995c477cf2f25
2d871be36280633a3f73e8e608b7c7a1f537dc94664003e41675297e463a6dad
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1695
Cache-Control: max-age=137389
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "6353a615-116"
Expires: Mon, 24 Oct 2022 08:41:24 GMT
Last-Modified: Sat, 22 Oct 2022 08:13:09 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 278
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9f9a0702b077f3c0cac82235921815cd
6afd80b26ebd779e84171716554316c780a94919
9f15fa99cc2d9b2a005259aa182e6b87a767f3b373cbbdb58aa07a7930c07715
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9F15FA99CC2D9B2A005259AA182E6B87A767F3B373CBBDB58AA07A7930C07715"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3803
Expires: Sat, 22 Oct 2022 19:34:58 GMT
Date: Sat, 22 Oct 2022 18:31:35 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 278 B IP
Hash d43f3455561c7fa97d7d987179228945
15a3c82ca11dfc740f22271ecbdf739be9117922
5b58e0874ad56467079eb1381de638c4e7b439c4b1db1e0ac661d3bc23569d98
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1045
Cache-Control: max-age=106865
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "63533163-116"
Expires: Mon, 24 Oct 2022 00:12:40 GMT
Last-Modified: Fri, 21 Oct 2022 23:55:15 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 278
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ZeKsW8uoAFysoCbWs2yhVw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: xubwhmyAYdMeh0jM8v6J2XQpbGg=
ocsp.digicert.com/
200 OK 279 B IP
Hash 7e52e432bd9be6dcd6b3fa2b41f0a120
1322883d7042f527801ba2b7ce95ea77faaf39c1
ea750c5d9a6b3856333634465a68a6552fba34edd707a51a49ba2297618f0f6b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2808
Cache-Control: max-age=163715
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "63540892-117"
Expires: Mon, 24 Oct 2022 16:00:10 GMT
Last-Modified: Sat, 22 Oct 2022 15:13:22 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash ebc4a356f6e4c08f8e89f702fa68073c
365719ab09259668c36fb138795e9bae2405e18e
894c4829e540e0479c983aacd7325269b6d38006c1413410a885cad1bdee13df
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3127
Cache-Control: max-age=135563
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:35 GMT
Etag: "6353995b-117"
Expires: Mon, 24 Oct 2022 08:10:58 GMT
Last-Modified: Sat, 22 Oct 2022 07:18:51 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 279
tzegilo.com/stattag.js
200 OK 5.5 kB IP
File type ASCII text, with very long lines (13017), with no line terminators
Hash ae1e8e71fdbbb03b4af85495f3401605
cee750ffee00ee8b5b299d0f745733acd0c06940
9efa145d659e60076ad7d1521dd069c33d5b826ab0cf49199533005ac76e12a5
GET /stattag.js HTTP/1.1
Host: tzegilo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: application/javascript
last-modified: Tue, 18 Oct 2022 14:05:58 GMT
etag: W/"634eb2c6-32d9"
link: <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin
cache-control: max-age=14400
cf-cache-status: HIT
age: 5722
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2F1UEck3cWZqMziubHW3%2FtL6m6mRjIVi6y8g4eXJUDoOky3MyzxTbxnXPRWSFxDiH1tO85LkXPeVLxEouU0YvIbHuTvwcQvLNTFU93PV7W4h1Xdrmh3nvr7vwMRGGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f8eb85db50c-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash ba3d26d814fd2a5d2943024442b81095
d6f5425ffe9c64156c645971bd734a38b043bfa3
557c9e9afb6b1eaead8dfb87aadff02c9e5860dc9b94f45c9c7f7bf675e938de
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 22 Oct 2022 18:31:35 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 20 Oct 2022 12:52:18 GMT
Expires: Thu, 27 Oct 2022 12:52:17 GMT
Etag: "d6f5425ffe9c64156c645971bd734a38b043bfa3"
Cache-Control: max-age=411041,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 75e44f8f9baf1c02-OSL
fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
200 OK 12 B URL HTTP/1.1 fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
Analyzer Verdict Alert quad9 Sinkholed
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f HTTP/1.1
Host: fleraprt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 887
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Sat, 22 Oct 2022 18:32:04 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://send.cm
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0b6e37f443071773c9755fb1a240d473
6c8ba1cc2b0fcfd7a3cf6cbaa9bafec09f586621
0a4249edbc5abce100dda967a8932e3fd8a7445dab7dc2eecc59e9c5b8063fc9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0A4249EDBC5ABCE100DDA967A8932E3FD8A7445DAB7DC2EECC59E9C5B8063FC9"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16284
Expires: Sat, 22 Oct 2022 23:02:59 GMT
Date: Sat, 22 Oct 2022 18:31:35 GMT
Connection: keep-alive
ocsp.sectigo.com/
200 OK 471 B IP
Hash a0599e5067cd89e17ce846b26bbd7009
9a505569f65e64258f707f6b991c97bfeece6d05
c922ca1b17506c5995aa0461360d8c08a0189e2bf0c8c48dbb2da23dc22bd2a1
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 22 Oct 2022 18:31:35 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 20 Oct 2022 18:25:22 GMT
Expires: Thu, 27 Oct 2022 18:25:21 GMT
Etag: "9a505569f65e64258f707f6b991c97bfeece6d05"
Cache-Control: max-age=431025,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 75e44f904c551c02-OSL
my.rtmark.net/gid.js
200 OK 184 B IP
Hash acdbe9e5390d76c8836244a62744be40
28e6d7664e65aebc228b7232d74650d2b4163ed5
a8778bba5d551b4aa1823136bff3292399e59cb6aa2d096ea360c6ad4531c262
GET /gid.js HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://send.cm
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=3d03b569448547a2b6bf4f44bd297cc4; expires=Sun, 22 Oct 2023 18:31:35 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
gloaphoo.net/500/4856335?excludes=&oaid=3d03b569448547a2b6bf4f44bd297cc4&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 0 B URL HTTP/2 gloaphoo.net/500/4856335?excludes=&oaid=3d03b569448547a2b6bf4f44bd297cc4&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
OPTIONS /500/4856335?excludes=&oaid=3d03b569448547a2b6bf4f44bd297cc4&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: gloaphoo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://send.cm/
Origin: https://send.cm
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:35 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://send.cm
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-credentials: true
access-control-max-age: 600
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash 12e6731c4875e15f8708c94ddd376461
b19423c08af5c16d246017f9b8b7acb6a195856a
fb94d91dfbc623b0ff5ba27accbcbbf3ed8984c5dddbf57e421d96425763eff2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 871
Cache-Control: max-age=107384
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Etag: "63533419-116"
Expires: Mon, 24 Oct 2022 00:21:20 GMT
Last-Modified: Sat, 22 Oct 2022 00:06:49 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 278
gloaphoo.net/401/4856335
200 OK 44 kB IP
Hash 8b07ae31e069597cae8ed6d72a73941b
a10d1e2f26735be5d027d04cdbf598a9af0c0247
f2117b671153b0ead1a264e0f6f4c8e745b96f6d6d8423cdfd8a737aa201d506
Analyzer Verdict Alert quad9 Sinkholed
GET /401/4856335 HTTP/1.1
Host: gloaphoo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: application/javascript
x-trace-id: 52d8c139733c24fe5c25906ac77f0341
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
set-cookie: OAID=6d84437187744cbb93be8c01e06b7e34; expires=Sun, 22 Oct 2023 18:31:35 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
pl17142106.profitablegatetocontent.com/d2/0b/d9/d20bd9cc9099994d29386eab93410fd0.js
200 OK 13 kB URL HTTP/1.1 pl17142106.profitablegatetocontent.com/d2/0b/d9/d20bd9cc9099994d29386eab93410fd0.js
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with very long lines (37127), with no line terminators
Hash e29aee306c86c843ec4e0629ab0271f5
3e0c8c3c9440e610b1482c0512b9908a60c5a462
4384293bb7fcde93720a8728fbe113af0489c7e1b819553d3503c93948a93b02
Analyzer Verdict Alert quad9 Sinkholed
GET /d2/0b/d9/d20bd9cc9099994d29386eab93410fd0.js HTTP/1.1
Host: pl17142106.profitablegatetocontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sat, 22 Oct 2022 18:31:35 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: cf849ab9364a4fdc0e213b4f7bb2afd3
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 11 kB IP
Hash f1c78f874451361ad2a46dd075753b96
6d8a124ad5ea3d1346c9fc9c9cb29b2e45011f86
cae9e1793cbca2276e58f7c1b21676aefd009625a61db349c47d9ed02d237f62
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
securepubads.g.doubleclick.net/tag/js/gpt.js
200 OK 27 kB URL HTTP/2 securepubads.g.doubleclick.net/tag/js/gpt.js
IP
File type ASCII text, with very long lines (45029)
Hash e4b9089986d110c702a7076a75b854bd
0a9dfa2a293517c7cd87407436586e6dd4c61663
6e468f2a7c3b81a85fef0eb046e00e29b1c53498d54b01767afe50f858a3e6e8
GET /tag/js/gpt.js HTTP/1.1
Host: securepubads.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 27349
date: Sat, 22 Oct 2022 18:31:36 GMT
expires: Sat, 22 Oct 2022 18:31:36 GMT
cache-control: private, max-age=900, stale-while-revalidate=3600
etag: "1372 / 468 of 1000 / last-modified: 1666390088"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 06210a4a9db522652fd6aabfa05b2653
630b4ef71ec82a3970927a328d279035eaaa1267
5100e1703020fdef7d473c91e1c88dfb734083057f431feeefaaa24838990a21
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/xRbWGO316fQ
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/xRbWGO316fQ
IP
Hash 2953c6a504951fe3e47364e7eff54919
a4f3a68930f8170ada5492bf38b827b1f3c05691
96192f9699d1d6a87f625e055e551bc800ddcd8de75673596cc2243898b1ee9a
POST /s/gts1p5/xRbWGO316fQ HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash d2e14c5839d162805104be0fd0fd7499
ade74a8f7df247a5e4ebe9937dc09bfea5e3dc3c
54da2dcbcb43870840771c7c0596520d40f98a1a522b7f130d68a17c5ece90de
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "54DA2DCBCB43870840771C7C0596520D40F98A1A522B7F130D68A17C5ECE90DE"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8005
Expires: Sat, 22 Oct 2022 20:45:01 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash d2e14c5839d162805104be0fd0fd7499
ade74a8f7df247a5e4ebe9937dc09bfea5e3dc3c
54da2dcbcb43870840771c7c0596520d40f98a1a522b7f130d68a17c5ece90de
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "54DA2DCBCB43870840771C7C0596520D40F98A1A522B7F130D68A17C5ECE90DE"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8005
Expires: Sat, 22 Oct 2022 20:45:01 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 5eccff1b43eac3376d36c8705e6d8a25
4d475a88763bddbabd10269234fcc12d2d47f4fd
ff31ad1d1bc708e41ba89cfadb8c78a6f552d9e77f075158817d7dbb9089cbe0
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=154414
Date: Sat, 22 Oct 2022 18:31:36 GMT
Etag: "6353e282-1d7"
Expires: Mon, 24 Oct 2022 13:25:10 GMT
Last-Modified: Sat, 22 Oct 2022 12:30:58 GMT
Server: ECS (nyb/1D06)
X-Cache: Miss from cloudfront
Via: 1.1 02dcbe051a75d060274d188948821dcc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: GUNEHdZGJk-ZqCVcQXiLSVzMPwrT5zKm8gqSbsZHTqcW3MOMDsx_Ng==
Age: 3252
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash babe6973f3e282dd442c274cb1735b49
8535e28be0f416c76a104e73fa35a13ae52990db
273199f7d2b12d6ef946dc67bfb70ac087e4c71d263dd062a061c584fb95421a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "273199F7D2B12D6EF946DC67BFB70AC087E4C71D263DD062A061C584FB95421A"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14446
Expires: Sat, 22 Oct 2022 22:32:22 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
www.cloudflare.com/cdn-cgi/trace?format=json
200 OK 268 B URL HTTP/2 www.cloudflare.com/cdn-cgi/trace?format=json
IP
Hash 320b1df1f84aba8bfa267de00fba875a
44862279a36fc99fbccb775c3bb229915485c890
a1aeed1e1adcd4162b4566c00e781a5c348eae11d65f1430d8de0efcdc14c914
GET /cdn-cgi/trace?format=json HTTP/1.1
Host: www.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: text/plain
access-control-allow-origin: *
server: cloudflare
cf-ray: 75e44f8cffb6b524-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
ndbegantoti.xyz/utx?cb=viGxag0P6jgh&top=send.cm&tid=903813
204 No Content 0 B URL HTTP/2 ndbegantoti.xyz/utx?cb=viGxag0P6jgh&top=send.cm&tid=903813
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=viGxag0P6jgh&top=send.cm&tid=903813 HTTP/1.1
Host: ndbegantoti.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
date: Sat, 22 Oct 2022 18:31:36 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://send.cm
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Sat, 22 Oct 2022 18:32:36 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 c61c9cd8693e9726a85388d7d1796c76.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: GEJ8-XfnRn0SdnOLO_aboDWV2NoudY_hYmB8A8NANDiBNgX7xDcmFA==
X-Firefox-Spdy: h2
secureads.increaserev.com/InvalidAds/getcookietime.php?domain=send.cm
200 OK 1.3 kB URL HTTP/2 secureads.increaserev.com/InvalidAds/getcookietime.php?domain=send.cm
IP
File type JSON data\012- , ASCII text, with very long lines (366), with no line terminators
Hash bf7a9cbe2b555add73313f2366883273
200ce984eb097090c6ca8173066f0ea3d313b095
74d6d209241a45b7083dc89eaa6b744f96f2627dfa620c9b14a84c296b6bb384
GET /InvalidAds/getcookietime.php?domain=send.cm HTTP/1.1
Host: secureads.increaserev.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-security-policy: upgrade-insecure-requests;
access-control-allow-origin: *
x-varnish: 35709757 31584342
age: 0
x-cache: HIT
x-cache-hits: 3
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aZb4Y6ufEqheppC2Bx%2FzhVs0DXZro6srNvOkCUwlLXO820CIlPodx2NcGNuwaMwpypzs1Rd8SlvXMG649JAUbNALp%2BMY0jQ93bgA5wqhr36t0lhEZLSxSSkEDhUvhujkVilb5LxBBubn%2BXg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f8ceb9eb509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
nallytohe.xyz/OG1JWE8XUiorcmwlDw8tbTtwCghqOy0Adn43Dyx/XTgbLhcLLG8sJlxQcGh8AFx6fj9RCXRpaUsZKCw6S1B4fiZWCyZlaU5QeHZ8DEN7YWEISzxlfh4ZOTkoBVxvKDtMAXRpeQ5bfW58DVx4aHYJ
204 No Content 0 B URL HTTP/2 nallytohe.xyz/OG1JWE8XUiorcmwlDw8tbTtwCghqOy0Adn43Dyx/XTgbLhcLLG8sJlxQcGh8AFx6fj9RCXRpaUsZKCw6S1B4fiZWCyZlaU5QeHZ8DEN7YWEISzxlfh4ZOTkoBVxvKDtMAXRpeQ5bfW58DVx4aHYJ
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /OG1JWE8XUiorcmwlDw8tbTtwCghqOy0Adn43Dyx/XTgbLhcLLG8sJlxQcGh8AFx6fj9RCXRpaUsZKCw6S1B4fiZWCyZlaU5QeHZ8DEN7YWEISzxlfh4ZOTkoBVxvKDtMAXRpeQ5bfW58DVx4aHYJ HTTP/1.1
Host: nallytohe.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
date: Sat, 22 Oct 2022 18:31:36 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FF8N%2Bpa6FhfHXPJ5GhIG7Iyp26DUze6Nwz15PcjebZVTdRxOFg3SDSEpZ5cgPBL1dV3%2Fz3TdDA0ssX9kUzr9QdRCQbXcR4EGPuKNUv0%2B3yIjoyatMSG7C4qqdVKBblCU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f941f561c0a-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash 0db05e5468e961722cdbbc65b3067d47
7f3b64000c168ee28314e1856d9c4e86e8f9b9b9
5faeb84e17621d2b7cf10578ad1a35f223bb139a32524edb94518df7998076d9
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:36 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
set-cookie: uid_id2=173e9ea1-102b-4668-a03e-347fc496c9fb:1:1; expires=Tue, 19 Oct 2032 18:31:36 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
gloaphoo.net/500/4856335?excludes=&oaid=3d03b569448547a2b6bf4f44bd297cc4&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 1.5 kB URL HTTP/2 gloaphoo.net/500/4856335?excludes=&oaid=3d03b569448547a2b6bf4f44bd297cc4&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
Hash f906dd986bd2e41b56a75d904d17b2b1
3dfcc244d784a1db9b342853e1171be97800478e
a3a97c872b7fd2828d9dd4f219dd527309adf60f5ce7ae594fc9dc57e24b8b1f
Analyzer Verdict Alert quad9 Sinkholed
GET /500/4856335?excludes=&oaid=3d03b569448547a2b6bf4f44bd297cc4&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: gloaphoo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Cookie: OAID=6d84437187744cbb93be8c01e06b7e34
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: application/javascript
x-trace-id: 901d49ab28413323a6b0d83996a2f779
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://send.cm
access-control-expose-headers: Link
access-control-allow-credentials: true
set-cookie: OAID=3d03b569448547a2b6bf4f44bd297cc4; expires=Sun, 22 Oct 2023 18:31:35 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
pogothere.xyz/
200 OK 373 B IP
File type ASCII text, with no line terminators
Hash 2398e04336c05ca4e6491c75be91cd74
b436c8c9753eea8d66ac6dcaf0380cfddf74c32f
d5e5d1bee6bbada26ba99e2fb28f9dddeb003607bc590a8b113dce705d8f6642
GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Origin: https://send.cm
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:36 GMT
content-type: text/plain
set-cookie: csu=1202483362624294@1@1666463496; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i8fD3gEMG%2BJH5Okkey%2BPcbdYk0YddOgLjOD5suUJSEOebNLP0bpwXIiSiUlNTIXF7Lu8tDGvd1uVTWV4cYWMjksBFx21l9adFdU24RjEzbJEUu%2BKl4tymsZqof87Ihcj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f945a167731-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/xRbWGO316fQ
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/xRbWGO316fQ
IP
Hash 2953c6a504951fe3e47364e7eff54919
a4f3a68930f8170ada5492bf38b827b1f3c05691
96192f9699d1d6a87f625e055e551bc800ddcd8de75673596cc2243898b1ee9a
POST /s/gts1p5/xRbWGO316fQ HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
whairtoa.com/tag.min.js
200 OK 23 kB IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash a648aa212e840e023872d5c3410f9bc1
8caa7668e84a2f4bb891a0421a36665af3008db7
1c16281975effb99b47cd8c45e8fe39b0c25e0b3dbbdf4711bfcc42df0541bcf
Analyzer Verdict Alert quad9 Sinkholed
GET /tag.min.js HTTP/1.1
Host: whairtoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:36 GMT
content-type: text/javascript; charset=utf-8
content-length: 22986
content-encoding: br
x-trace-id: dce23dfabd2b665ec097e94813b94843
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
accept-ranges: bytes
last-modified: Thu, 20 Oct 2022 13:17:46 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
friendshipmale.com/sfp.js
200 OK 86 kB URL HTTP/1.1 friendshipmale.com/sfp.js
IP
File type Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Hash 8bf542db65f0ff20d510889d62e5e092
1b1b7cc04275b7641e2f07b0f4bf99b5387303bf
77a3bebee72af7beb49cd94b7f16852a532aac5f3db8f610160440fe75ca4711
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 22 Oct 2022 18:31:36 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 85467
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 552204a4b36f0917ab7ed0843d845321
Strict-Transport-Security: max-age=0; includeSubdomains
ocsp.digicert.com/
200 OK 471 B IP
Hash 78eb615608702c0b13883ec9a639897a
b5370eef8ce454c3cdd4c82c02e06e2c071065e5
9d400e867c4a74f3f173b5b919eab8f4b2d32f7651ce484d12df063d03825c69
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4141
Cache-Control: max-age=111383
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Etag: "635336f2-1d7"
Expires: Mon, 24 Oct 2022 01:27:59 GMT
Last-Modified: Sat, 22 Oct 2022 00:18:58 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1d0e730433d1d2e48146dcf077d4edb5
9f387a50b3c62ae45067fad173e18705ce9e890a
6de7a2536206410e28ec7405cc720c1132c5e6994f4edb29f8a28bd7620324aa
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1325)
Hash 47e6f374ca946fddd5b59871b325736c
baa9282efc8785e84d247c3bff518eaa45f101c4
16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sat, 22 Oct 2022 16:41:09 GMT
expires: Sat, 22 Oct 2022 18:41:09 GMT
cache-control: public, max-age=7200
age: 6627
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1d0e730433d1d2e48146dcf077d4edb5
9f387a50b3c62ae45067fad173e18705ce9e890a
6de7a2536206410e28ec7405cc720c1132c5e6994f4edb29f8a28bd7620324aa
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f1b833a135e4d839859e4994f349bb6c
399b607015c4d9200df20084c7396591007dc995
28db09a2a0e821b37dc1cfb710bf896c438755bfc992eb775f41128b0e52e5d1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "28DB09A2A0E821B37DC1CFB710BF896C438755BFC992EB775F41128B0E52E5D1"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8639
Expires: Sat, 22 Oct 2022 20:55:35 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f1b833a135e4d839859e4994f349bb6c
399b607015c4d9200df20084c7396591007dc995
28db09a2a0e821b37dc1cfb710bf896c438755bfc992eb775f41128b0e52e5d1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "28DB09A2A0E821B37DC1CFB710BF896C438755BFC992EB775F41128B0E52E5D1"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8639
Expires: Sat, 22 Oct 2022 20:55:35 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f1b833a135e4d839859e4994f349bb6c
399b607015c4d9200df20084c7396591007dc995
28db09a2a0e821b37dc1cfb710bf896c438755bfc992eb775f41128b0e52e5d1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "28DB09A2A0E821B37DC1CFB710BF896C438755BFC992EB775F41128B0E52E5D1"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8639
Expires: Sat, 22 Oct 2022 20:55:35 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f1b833a135e4d839859e4994f349bb6c
399b607015c4d9200df20084c7396591007dc995
28db09a2a0e821b37dc1cfb710bf896c438755bfc992eb775f41128b0e52e5d1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "28DB09A2A0E821B37DC1CFB710BF896C438755BFC992EB775F41128B0E52E5D1"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8639
Expires: Sat, 22 Oct 2022 20:55:35 GMT
Date: Sat, 22 Oct 2022 18:31:36 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff28bcb97-99c1-48e0-b7d7-8bfe823abaa7.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff28bcb97-99c1-48e0-b7d7-8bfe823abaa7.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 26c47e4b0147f8dee3e71a53a8f2830c
381edb4758da428db5ffe884f8fb38bf11044f69
b507898359abbcb1f57821c147a58df66d7e81acc198afc997527b58cd835b39
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff28bcb97-99c1-48e0-b7d7-8bfe823abaa7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11151
x-amzn-requestid: 5c32e307-f2a7-4050-a96f-a47667ec4752
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aX-NEFTKoAMFsSQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635310b9-2fc77f394ca297126abaed94;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 21:35:53 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Ib4A9F4pA6k1iYdefeQokFkEkmqlEASJ2d20BQ6gqRYj3teYDu8Cyg==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 21 Oct 2022 22:14:20 GMT
age: 73036
etag: "381edb4758da428db5ffe884f8fb38bf11044f69"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84809f37-0e01-4278-ba97-357c4a1b454e.webp
200 OK 5.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84809f37-0e01-4278-ba97-357c4a1b454e.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1ee464d6a426da49571c97060e65a4e8
aef2208c82085b4dc8472ee28bc63b9a8832fe0e
704e9800cb12b9b2927e85901b21fbb22303f11bf4b052340d0fc610414e2a6d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84809f37-0e01-4278-ba97-357c4a1b454e.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5517
x-amzn-requestid: 560e0ccc-0551-461d-98fd-f94d9a026fb8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aX-pSExDIAMFpMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6353116e-0420e4ac6cceec1749a44819;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 21:38:54 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: hitgYm684zdpmL8IbPzFxhPWRrc2-VmnlofdTiPhJzkrc26mgXTTTA==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 21 Oct 2022 22:00:41 GMT
age: 73855
etag: "aef2208c82085b4dc8472ee28bc63b9a8832fe0e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f52601f-0c98-4537-a72e-d72f9dbe4167.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f52601f-0c98-4537-a72e-d72f9dbe4167.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6bd5e942443ffd011faf10dc88d92081
beff4ae9e24599addce8a961c955788045c56645
2c59d984971e73d497975032c23700b5602fccf403f4683a8047f5f42d4e261f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f52601f-0c98-4537-a72e-d72f9dbe4167.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10973
x-amzn-requestid: 081470ca-0107-4052-be55-9c713105bb27
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aUr-TEKPoAMFZfQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6351c05b-17199f8c0fc0fb7443a902f1;Sampled=0
x-amzn-remapped-date: Thu, 20 Oct 2022 21:40:43 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: C8HRcZnP8nrEFWU_vn1olwnkXdvlqUu2_w0YIED9MSXDtO3U2mKO-w==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google
date: Fri, 21 Oct 2022 22:17:59 GMT
age: 72817
etag: "beff4ae9e24599addce8a961c955788045c56645"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f5552d5-4394-409a-9a9c-43e4ebf38ee1.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f5552d5-4394-409a-9a9c-43e4ebf38ee1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cdaacab30d73a7d05180cc16f4a96a3f
6cc0e39e0decbc20c765f171f63affd85fc9e6da
f015c3b1d838bd7d100ee104551bed2bb06a512b20ce3e5ac419d54b747fadd0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f5552d5-4394-409a-9a9c-43e4ebf38ee1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10720
x-amzn-requestid: 96267527-f482-4bfa-ba7a-12467408efe9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aX-MvGutIAMFc8g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635310b7-25f2624559b0fb7d62ced3a3;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 21:35:51 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 4--AiSTKMMOm9HnJL_ervFnd5rkQ-WZfGM-FNkxXKO892SPw67cxXA==
via: 1.1 1f6e68152880a39d72e6bf2996cd6a60.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Fri, 21 Oct 2022 22:11:42 GMT
age: 73194
etag: "6cc0e39e0decbc20c765f171f63affd85fc9e6da"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 396 B URL HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (385)
Hash aad555a550b9d588ff7e39dda8a2cbe0
b0340f1edcc2283ea30f9b3a07cb37fb4b2aeb94
7dccdd6e94ec32e4b2ebd0d127b0608fd8aaace7cdac740e2935e36905c2c586
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 22 Oct 2022 18:31:36 GMT
location: https://accounts.google.com/v3/signin/identifier?dsh=S-1861246195%3A1666463496901020&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQDHYWo0NDaY-ORgNNG0iGD8_2e3w30eMzLc9Bn-qfjGG7xcEmQ__TLiEiTm-wec759UwXFRHPqiaA
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-yTD9HszlVgQNzYLKrN3A9w' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 396
server: GSE
set-cookie: __Host-GAPS=1:No11EDhVOUbbg0qaX20Gvw-RPvIAIw:nLlXQM_OPGiT-RzR;Path=/;Expires=Mon, 21-Oct-2024 18:31:36 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd771af0d-55ee-450f-bbb3-a9e419e74a51.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd771af0d-55ee-450f-bbb3-a9e419e74a51.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 616e14aee034bbf77c3b74b3ea53961b
ebf69c1ff6dc9450f33aef5dc2403d4df17a4c2c
0ae716474e2837c90c658d635fb9db2c8d4cdb7bf025b8e4e9e802e3ff56b0c3
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd771af0d-55ee-450f-bbb3-a9e419e74a51.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7372
x-amzn-requestid: 080f5f7f-51a8-4ef5-9acc-0c7f7f64defb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aX-ojEg2IAMFjPA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63531169-5106c8af6e77450c33a0c899;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 21:38:49 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: -R91mOdVOCkUp-5vOpEyQactO7SrjtbYwxTsvbR1LP6fBlFZFDTP5A==
via: 1.1 2e20768704c71ff3ce2e677251d27f3c.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Fri, 21 Oct 2022 22:00:32 GMT
age: 73864
etag: "ebf69c1ff6dc9450f33aef5dc2403d4df17a4c2c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F428e118d-55db-4b2d-9dc1-0adbc5a4021a.webp
200 OK 8.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F428e118d-55db-4b2d-9dc1-0adbc5a4021a.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a361cef05d531426819a2bffd8ab1e47
9c8050ffd0de58005705219ec70b6e4352e35b5e
0c3c48b96adb7c1dc8a8c3771878dcbab80bbbb9f2d6998038bf5d43831b578b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F428e118d-55db-4b2d-9dc1-0adbc5a4021a.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8856
x-amzn-requestid: 84cc5c28-b71f-4ada-9d3b-e67e820cd080
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aX-LzHcsoAMFuNQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635310b1-6b44e77726dc2003052ce387;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: kV1qS7kI7-DRm5Su-p133YIf_m4n6i16uBSDrGdsbMDPxD_2v1a69Q==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Fri, 21 Oct 2022 22:20:05 GMT
etag: "9c8050ffd0de58005705219ec70b6e4352e35b5e"
content-type: image/jpeg
age: 72691
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 388 B URL HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (379)
Hash e5698626423af318af1dd3e01595414f
0afee00735a8eb3983f256172a5116bdf0391f75
62cb2617d7fcd73d07a2ff4e337907ba27de176967a2c810fd8412e1aa83f332
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 22 Oct 2022 18:31:36 GMT
location: https://accounts.google.com/v3/signin/identifier?dsh=S604507540%3A1666463496945612&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQDHYWqGsICAiOb4cgbB1dRLT257QA44i0g9qCdCm4GqkD_aviVngszgHtLIsgneO8YjFkbeL3VEeQ
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: script-src 'nonce-3a8NEEYYxpei5wC4EhLpAA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 388
server: GSE
set-cookie: __Host-GAPS=1:mAl_W49l8YwbsMawMpR33fzxIy8sZQ:wNvZFPlPHRvEr2-e;Path=/;Expires=Mon, 21-Oct-2024 18:31:36 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 924935dfe678e1cafb56906ef15defec
063dc4e38a869415d29ff059c0e173966c0c96dd
12045f462e3aa1fa3d2c97f1c3c67951dedc6410db5ce75c1907de5beff81bf4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
200 OK 11 kB URL HTTP/2 www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
IP
Hash 1c0437abde2c878cd48de0a362bfe21e
3457f5a12fb11c5c647b75210f380eeec037afe7
30e69ba92262784329d9c3d50f348fe79515c58acf32ef5e5701bf36b77c5f3a
GET /login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-encoding: br
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
vary: Sec-Fetch-Site, Sec-Fetch-Mode, Accept-Encoding
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: lNj1685q1kKsl/9MRZC/mO9NSe9Ye/CqUDS8cxIpN33YJN1ANxjJCrvylxLHbjTUpZbG1QhVHjgxW9tdG3B+ZA==
date: Sat, 22 Oct 2022 18:31:36 GMT
priority: u=3,i
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1b0cd7fce51616614b5ebb265d02c2f7
6748d7df7c347bbe06afb2155fff3bbc8bf50eb0
d41beb047830bdacb772b75123c39906db8edcd49fdc8c9a00258a2556efd1c9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash d8ad2cc67fe4edf14ed9497ee349419b
b11f1d3df0e57e5967f39f8dfeb97af5138edd5f
b459e908234aaa71dd46eafb74920476176f9f8136fc2df0cdd7eecb744d35c6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
adservice.google.com/adsid/integrator.js?domain=send.cm
200 OK 100 B URL HTTP/2 adservice.google.com/adsid/integrator.js?domain=send.cm
IP
File type ASCII text, with no line terminators
Hash 917951a58be8c6c6f3680159550ba3c2
21cd25c2a4eb9ec7e0f37021ce7b69e852dab4b4
cd8c45d9a0d98ca2e23d967483ec538bcafa246afdcf434bf60c8257acfacfac
GET /adsid/integrator.js?domain=send.cm HTTP/1.1
Host: adservice.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: private, no-cache, no-store
content-type: application/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sat, 22 Oct 2022 18:31:37 GMT
server: cafe
content-length: 100
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
adservice.google.no/adsid/integrator.js?domain=send.cm
200 OK 100 B URL HTTP/2 adservice.google.no/adsid/integrator.js?domain=send.cm
IP
File type ASCII text, with no line terminators
Hash 917951a58be8c6c6f3680159550ba3c2
21cd25c2a4eb9ec7e0f37021ce7b69e852dab4b4
cd8c45d9a0d98ca2e23d967483ec538bcafa246afdcf434bf60c8257acfacfac
GET /adsid/integrator.js?domain=send.cm HTTP/1.1
Host: adservice.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: private, no-cache, no-store
content-type: application/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sat, 22 Oct 2022 18:31:37 GMT
server: cafe
content-length: 100
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
d12dky1jzngacn.cloudfront.net/meFFLWTEbPiU/Dgw4L2QISGJzaAJeOzg2XwhsKCxeLiUtIGkMB20tSxxse39dGT8sZBcdPyhkAF4wLzsMTHc/KV4TbCUwWgk+IjpZHSNtLFBFPCQjWBQ9KnwDPmRlaRRKYWMhAEl0eBsUSmEnMF8NKW5rAQBpfQYHTHR4GxRKYTkvFEsQcm8fSHhuawEfNC-gyXl1jDWsBSWF7aAFJdHlpVxEjLj9eAHR5HwhOf3t/REVg
200 OK 486 B URL HTTP/2 d12dky1jzngacn.cloudfront.net/meFFLWTEbPiU/Dgw4L2QISGJzaAJeOzg2XwhsKCxeLiUtIGkMB20tSxxse39dGT8sZBcdPyhkAF4wLzsMTHc/KV4TbCUwWgk+IjpZHSNtLFBFPCQjWBQ9KnwDPmRlaRRKYWMhAEl0eBsUSmEnMF8NKW5rAQBpfQYHTHR4GxRKYTkvFEsQcm8fSHhuawEfNC-gyXl1jDWsBSWF7aAFJdHlpVxEjLj9eAHR5HwhOf3t/REVg
IP
Hash 81cb418ce544e6b1033d8892ab615874
5430b06b3cee389f41778e02ec7023e1d7583219
8f6456da16cf32ff6b656cb24770d36d241ca226588dcd7e1545a4919aa4768c
GET /meFFLWTEbPiU/Dgw4L2QISGJzaAJeOzg2XwhsKCxeLiUtIGkMB20tSxxse39dGT8sZBcdPyhkAF4wLzsMTHc/KV4TbCUwWgk+IjpZHSNtLFBFPCQjWBQ9KnwDPmRlaRRKYWMhAEl0eBsUSmEnMF8NKW5rAQBpfQYHTHR4GxRKYTkvFEsQcm8fSHhuawEfNC-gyXl1jDWsBSWF7aAFJdHlpVxEjLj9eAHR5HwhOf3t/REVg HTTP/1.1
Host: d12dky1jzngacn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ndbegantoti.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-length: 480
date: Sat, 22 Oct 2022 18:31:37 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 e9e4350b1ded67c8df30434cb8337934.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P1
x-amz-cf-id: CQPJrLtQaIekRB589-G5JjiIF5eqldTJb7V_VlY0pSAtbsIgKDLCCA==
X-Firefox-Spdy: h2
pl15995674.profitablegatetocontent.com/9c/ed/24/9ced2453f41586bc39632e754938332a.json
200 OK 403 B URL HTTP/1.1 pl15995674.profitablegatetocontent.com/9c/ed/24/9ced2453f41586bc39632e754938332a.json
IP
File type JSON data\012- , ASCII text, with very long lines (403), with no line terminators
Hash e834b9a32a7a5e2e89366960702dbfde
22cc7ff7d3eb3cdbcec0305feff11e1fb38faca3
5a4c972e4b6aea065f59b79c99a2e9124d947ba4ba7e5c4a571666f14311f2c1
Analyzer Verdict Alert quad9 Sinkholed
GET /9c/ed/24/9ced2453f41586bc39632e754938332a.json HTTP/1.1
Host: pl15995674.profitablegatetocontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 22 Oct 2022 18:31:37 GMT
Content-Type: application/json
Content-Length: 403
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f006c70d5210405b5b4a40e40b948f93
Strict-Transport-Security: max-age=0; includeSubdomains
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash d8ad2cc67fe4edf14ed9497ee349419b
b11f1d3df0e57e5967f39f8dfeb97af5138edd5f
b459e908234aaa71dd46eafb74920476176f9f8136fc2df0cdd7eecb744d35c6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash d5b7317597accee92adba4a839b1630c
abf23578e2d14b21b1469290cca96cf3ed53ad2c
fbba887c0a0a585a9619e755f6d2bf4eaf6fb410c39d3bb334d64d03ccdab079
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "FBBA887C0A0A585A9619E755F6D2BF4EAF6FB410C39D3BB334D64D03CCDAB079"
Last-Modified: Fri, 21 Oct 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4718
Expires: Sat, 22 Oct 2022 19:50:15 GMT
Date: Sat, 22 Oct 2022 18:31:37 GMT
Connection: keep-alive
afacf9395b93c3ae22ac5b58c2a41e84.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
200 OK 3.1 kB URL HTTP/2 afacf9395b93c3ae22ac5b58c2a41e84.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5835)
Hash 3fa5e95a358d660ddb3c45769ae1357f
5f6164fbaf8cfbccfd061b00ae48dedfc16bbcd9
d32f4b680031c0e11222eb17385aa9d3b11d2903b05bff34c3d4eb6292631137
GET /safeframe/1-0-38/html/container.html HTTP/1.1
Host: afacf9395b93c3ae22ac5b58c2a41e84.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sat, 22 Oct 2022 18:31:37 GMT
expires: Sun, 22 Oct 2023 18:31:37 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1c06830928e4daafa151c51876ac5214
72e6ebbebae68a15f0f13522e17fd80a102f08fc
be1cbf244680fa00eacf673029b9cf087655d0d7bbac9a5a239cfcc9a97df774
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE1CBF244680FA00EACF673029B9CF087655D0D7BBAC9A5A239CFCC9A97DF774"
Last-Modified: Fri, 21 Oct 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9645
Expires: Sat, 22 Oct 2022 21:12:22 GMT
Date: Sat, 22 Oct 2022 18:31:37 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash d5b7317597accee92adba4a839b1630c
abf23578e2d14b21b1469290cca96cf3ed53ad2c
fbba887c0a0a585a9619e755f6d2bf4eaf6fb410c39d3bb334d64d03ccdab079
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "FBBA887C0A0A585A9619E755F6D2BF4EAF6FB410C39D3BB334D64D03CCDAB079"
Last-Modified: Fri, 21 Oct 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4718
Expires: Sat, 22 Oct 2022 19:50:15 GMT
Date: Sat, 22 Oct 2022 18:31:37 GMT
Connection: keep-alive
insistinestimable.com/sbar.json?key=d20bd9cc9099994d29386eab93410fd0&uuid=652d7f53-2df5-45f6-af88-94cf4b4e173f%3A1%3A1
200 OK 4.1 kB URL HTTP/1.1 insistinestimable.com/sbar.json?key=d20bd9cc9099994d29386eab93410fd0&uuid=652d7f53-2df5-45f6-af88-94cf4b4e173f%3A1%3A1
IP
File type JSON data\012- , ASCII text, with very long lines (5694), with no line terminators
Hash 8d492976e9e2691d639a05eafabe36fe
2705e15b4774f55de606d7dfb6eadb1a8e9e8395
d626c1777118e9f3bc25418d5f358c82269825849ae1513b9608b14d819ed79d
Analyzer Verdict Alert quad9 Sinkholed
GET /sbar.json?key=d20bd9cc9099994d29386eab93410fd0&uuid=652d7f53-2df5-45f6-af88-94cf4b4e173f%3A1%3A1 HTTP/1.1
Host: insistinestimable.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 22 Oct 2022 18:31:37 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://send.cm
Access-Control-Allow-Origin: https://send.cm
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=17041607; expires=Sun, 23 Oct 2022 18:31:37 GMT; secure; SameSite=None
uid_id2=652d7f53-2df5-45f6-af88-94cf4b4e173f:1:1; expires=Sat, 29 Oct 2022 18:31:37 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 23 Oct 2022 18:31:37 GMT; secure; SameSite=None
uncs=1; expires=Sun, 23 Oct 2022 18:31:37 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sun, 23 Oct 2022 18:31:37 GMT; secure; SameSite=None
uncs29=1; expires=Sun, 23 Oct 2022 18:31:37 GMT; secure; SameSite=None
slecd20bd9cc9099994d29386eab93410fd0=[3364845]; expires=Sat, 22 Oct 2022 18:31:42 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 172af75bdedddf125db745bae8812f1c
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.digicert.com/
200 OK 279 B IP
Hash 58d772ad226fe26d655443f4e72ac15d
70b893702c7075a9a00043698176cb775f1bbeba
e8885a2b537732dd4afdbcf458902e0df544b86df6baa1c185fc10cc84134aba
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 634
Cache-Control: max-age=169449
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:37 GMT
Etag: "63542778-117"
Expires: Mon, 24 Oct 2022 17:35:46 GMT
Last-Modified: Sat, 22 Oct 2022 17:25:12 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 279
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 77a64616e0f80f0869387d5cc4b51e29
8e26ed6151bd1b0e47d9ffd9cfeaf718c4eefaad
25807197a518cbff92d17ef570506850442aee626a05f11b705c088d53160609
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "25807197A518CBFF92D17EF570506850442AEE626A05F11B705C088D53160609"
Last-Modified: Fri, 21 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9570
Expires: Sat, 22 Oct 2022 21:11:07 GMT
Date: Sat, 22 Oct 2022 18:31:37 GMT
Connection: keep-alive
insistinestimable.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSMWwcRRSdTVwEQRMUCpBAV1CAhM%2B7e3t7t6SICMHIwomjJCh0MDszex48u7Oa2b09u7KIQCmPAoly%2Fc6OFYgQSLRE6BzJhSUkH5ULXNNQIKRUFOguFgdfWv3%2F9r3i%2Fffni53ylLgo6cm163pLKkWX2k238cZHnne5sSqzctAYdMOPw%2BByw%2FTfjsKm%2B2bjfcE29JLveq7ruV5jWRqR6MHSlITMH0VeM3Kbgd%2F02gEG5v%2FYlg4sdcD7p%2BRFSD5ZeOJcgmRjZOn314TdKHT%2B1ntpqWihDfp8%2F8NsI9NVhnQ%2BJsZBku2fqaHt8fJj6GxvZhe6%2F68wlhPiHD5GnO2fmUTc3535jBVEhpg%2Fj6o%2FhlBjSDoG0%2Fcg%2BTEBGMeNNWTpgxvaVHTzGUun7IQsPP0LspqQhd8uIUu%2Fu6rkoHFbq7KQOrMYJDXkYAzZGyMvD1BsnYOsDsCKzyD5L2Tp6SqydHfNKg3JT14P2z7vJO3Wos%2BT9mLQTsJFmnS7i1HAkiAOhNdpJbOApBxDJmMoMQS1DsrpJx2UiYMyd5DykwbzPK%2FjckbdbsRYi3dEHHLXo53Eo54bdlGy6Q5DFPkQTA3BzDZys40NOYQpf4Zdr2G5A1sQ9HmNShBUlqCiBJUkqAqCql%2FvcWV9Wz%2Fgypaxd9b9s96qR7ro7dA9XfRERnbyU3JxGpyzcOEQG%2BKkwX035hFjkRtFURRwP2p1Q0HjqBV4bsJdWFlD2nOzNbfkhLz0%2B1fI5fELXyOmB7DqAExeBC1fBa1GHd8FXR8FXRdb2b4VGW%2ByFFzXyIsFFJvOjjolL88u17r7BwQ7uvJJfH3y58O%2FwUyN3NT4VD4h6Kn7o1u6Iru3dGXJD2t5IVO5RadXvV3QQpz%2F5gOxWWnDV67Z4cN32JSYjo%2FuCFus0ozLrGfJt1cl58Isa8ME%2BWnF3hXxzdKuXy1NVuarN99dXklzI6yVOhuDygkhh0dgckIu%2FLg3e7CvfF5BmjFMWSMtj8hZQeoDsHwbNp%2F7t%2Fo8jJpr4txBVdYj48fzn0oSKDHHNK5h%2F4Pj%2Bbxj76NnXgMt7iFLa%2FRNjb6qQdUQtjw%2FKnJzdOXX1qwQK2cUK%2BPsxsqoL5%2BFa%2BVJo9NquTSM2l6nQ0UnDvxuEnqcUj8I%2FTCkLRR2wu50nvsHAAD%2F%2FwEAAP%2F%2F8TEo5HsEAAA%3D
200 OK 7 B URL HTTP/1.1 insistinestimable.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSMWwcRRSdTVwEQRMUCpBAV1CAhM%2B7e3t7t6SICMHIwomjJCh0MDszex48u7Oa2b09u7KIQCmPAoly%2Fc6OFYgQSLRE6BzJhSUkH5ULXNNQIKRUFOguFgdfWv3%2F9r3i%2Fffni53ylLgo6cm163pLKkWX2k238cZHnne5sSqzctAYdMOPw%2BByw%2FTfjsKm%2B2bjfcE29JLveq7ruV5jWRqR6MHSlITMH0VeM3Kbgd%2F02gEG5v%2FYlg4sdcD7p%2BRFSD5ZeOJcgmRjZOn314TdKHT%2B1ntpqWihDfp8%2F8NsI9NVhnQ%2BJsZBku2fqaHt8fJj6GxvZhe6%2F68wlhPiHD5GnO2fmUTc3535jBVEhpg%2Fj6o%2FhlBjSDoG0%2Fcg%2BTEBGMeNNWTpgxvaVHTzGUun7IQsPP0LspqQhd8uIUu%2Fu6rkoHFbq7KQOrMYJDXkYAzZGyMvD1BsnYOsDsCKzyD5L2Tp6SqydHfNKg3JT14P2z7vJO3Wos%2BT9mLQTsJFmnS7i1HAkiAOhNdpJbOApBxDJmMoMQS1DsrpJx2UiYMyd5DykwbzPK%2FjckbdbsRYi3dEHHLXo53Eo54bdlGy6Q5DFPkQTA3BzDZys40NOYQpf4Zdr2G5A1sQ9HmNShBUlqCiBJUkqAqCql%2FvcWV9Wz%2Fgypaxd9b9s96qR7ro7dA9XfRERnbyU3JxGpyzcOEQG%2BKkwX035hFjkRtFURRwP2p1Q0HjqBV4bsJdWFlD2nOzNbfkhLz0%2B1fI5fELXyOmB7DqAExeBC1fBa1GHd8FXR8FXRdb2b4VGW%2ByFFzXyIsFFJvOjjolL88u17r7BwQ7uvJJfH3y58O%2FwUyN3NT4VD4h6Kn7o1u6Iru3dGXJD2t5IVO5RadXvV3QQpz%2F5gOxWWnDV67Z4cN32JSYjo%2FuCFus0ozLrGfJt1cl58Isa8ME%2BWnF3hXxzdKuXy1NVuarN99dXklzI6yVOhuDygkhh0dgckIu%2FLg3e7CvfF5BmjFMWSMtj8hZQeoDsHwbNp%2F7t%2Fo8jJpr4txBVdYj48fzn0oSKDHHNK5h%2F4Pj%2Bbxj76NnXgMt7iFLa%2FRNjb6qQdUQtjw%2FKnJzdOXX1qwQK2cUK%2BPsxsqoL5%2BFa%2BVJo9NquTSM2l6nQ0UnDvxuEnqcUj8I%2FTCkLRR2wu50nvsHAAD%2F%2FwEAAP%2F%2F8TEo5HsEAAA%3D
IP
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert quad9 Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSMWwcRRSdTVwEQRMUCpBAV1CAhM%2B7e3t7t6SICMHIwomjJCh0MDszex48u7Oa2b09u7KIQCmPAoly%2Fc6OFYgQSLRE6BzJhSUkH5ULXNNQIKRUFOguFgdfWv3%2F9r3i%2Fffni53ylLgo6cm163pLKkWX2k238cZHnne5sSqzctAYdMOPw%2BByw%2FTfjsKm%2B2bjfcE29JLveq7ruV5jWRqR6MHSlITMH0VeM3Kbgd%2F02gEG5v%2FYlg4sdcD7p%2BRFSD5ZeOJcgmRjZOn314TdKHT%2B1ntpqWihDfp8%2F8NsI9NVhnQ%2BJsZBku2fqaHt8fJj6GxvZhe6%2F68wlhPiHD5GnO2fmUTc3535jBVEhpg%2Fj6o%2FhlBjSDoG0%2Fcg%2BTEBGMeNNWTpgxvaVHTzGUun7IQsPP0LspqQhd8uIUu%2Fu6rkoHFbq7KQOrMYJDXkYAzZGyMvD1BsnYOsDsCKzyD5L2Tp6SqydHfNKg3JT14P2z7vJO3Wos%2BT9mLQTsJFmnS7i1HAkiAOhNdpJbOApBxDJmMoMQS1DsrpJx2UiYMyd5DykwbzPK%2FjckbdbsRYi3dEHHLXo53Eo54bdlGy6Q5DFPkQTA3BzDZys40NOYQpf4Zdr2G5A1sQ9HmNShBUlqCiBJUkqAqCql%2FvcWV9Wz%2Fgypaxd9b9s96qR7ro7dA9XfRERnbyU3JxGpyzcOEQG%2BKkwX035hFjkRtFURRwP2p1Q0HjqBV4bsJdWFlD2nOzNbfkhLz0%2B1fI5fELXyOmB7DqAExeBC1fBa1GHd8FXR8FXRdb2b4VGW%2ByFFzXyIsFFJvOjjolL88u17r7BwQ7uvJJfH3y58O%2FwUyN3NT4VD4h6Kn7o1u6Iru3dGXJD2t5IVO5RadXvV3QQpz%2F5gOxWWnDV67Z4cN32JSYjo%2FuCFus0ozLrGfJt1cl58Isa8ME%2BWnF3hXxzdKuXy1NVuarN99dXklzI6yVOhuDygkhh0dgckIu%2FLg3e7CvfF5BmjFMWSMtj8hZQeoDsHwbNp%2F7t%2Fo8jJpr4txBVdYj48fzn0oSKDHHNK5h%2F4Pj%2Bbxj76NnXgMt7iFLa%2FRNjb6qQdUQtjw%2FKnJzdOXX1qwQK2cUK%2BPsxsqoL5%2BFa%2BVJo9NquTSM2l6nQ0UnDvxuEnqcUj8I%2FTCkLRR2wu50nvsHAAD%2F%2FwEAAP%2F%2F8TEo5HsEAAA%3D HTTP/1.1
Host: insistinestimable.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Cookie: u_pl=17041607; uid_id2=652d7f53-2df5-45f6-af88-94cf4b4e173f:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 22 Oct 2022 18:31:37 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 45c32b3b36e8c4a3bd8d4b8c5ffa0e3b
Strict-Transport-Security: max-age=0; includeSubdomains
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 4edffadddd10f1c49cb6de63a8c7b1a9
6d075c04bab3c4e6ff7530043c54eaf99c4dcfa7
f3811781a1be62bec2fb1983f882ac84121cddf28dcc4c3f2f69179a2d7e751c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "F3811781A1BE62BEC2FB1983F882AC84121CDDF28DCC4C3F2F69179A2D7E751C"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14160
Expires: Sat, 22 Oct 2022 22:27:37 GMT
Date: Sat, 22 Oct 2022 18:31:37 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 4edffadddd10f1c49cb6de63a8c7b1a9
6d075c04bab3c4e6ff7530043c54eaf99c4dcfa7
f3811781a1be62bec2fb1983f882ac84121cddf28dcc4c3f2f69179a2d7e751c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "F3811781A1BE62BEC2FB1983F882AC84121CDDF28DCC4C3F2F69179A2D7E751C"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14160
Expires: Sat, 22 Oct 2022 22:27:37 GMT
Date: Sat, 22 Oct 2022 18:31:37 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 794a6d2df00fc15e8b4ed6ff4992525e
f8d67c7fd506709d7232298859fe2b3daf374f29
02d38690754b5d99178d576fe6df6c1ca881a2bbd806a75c633c371fac0221da
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/img/icon.jpg
200 OK 74 kB URL HTTP/2 cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/img/icon.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=821, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1232], progressive, precision 8, 500x333, components 3\012- data
Hash edc025c8802080bcfb154c337fdb21a4
41d8d08c7984fcffbeeffee40e680e0a23d7f7e7
343eec76860bcb772bd3b2db18b495c7bd557cc20635141b3173c933b1df8592
GET /sb/interstitial/utility/default/blog/flip_icon_fullpage/16/img/icon.jpg HTTP/1.1
Host: cdn.sb4you1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: image/jpeg
content-length: 73837
last-modified: Thu, 10 Feb 2022 09:31:00 GMT
etag: "6204db54-1206d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 6942418
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gekO0dB5JUiIHVcp4w3wpioGbpjsKlrFhcnEZd7I6rB0DR0wHNaYV7Dmd3zmi66COhv%2F07J8OasIXIWgWWp5wCvN4O8iokqs26s79n3Oj8FSlMK8AKXm6TVHtfXsfscTPHY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f9e3a3273f7-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/img/close.svg
200 OK 920 B URL HTTP/2 cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/img/close.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- exported SGML document, ASCII text
Hash 7a666d133605060a77749fff6d389125
99b8877ff211f35fef1d087fef6469f5b7f247a3
dffeb568033c6da9ec888175b8065d7fb2074d4a63e7cc4601abdb1320b93fb1
GET /sb/interstitial/utility/default/blog/flip_icon_fullpage/16/img/close.svg HTTP/1.1
Host: cdn.sb4you1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: image/svg+xml
last-modified: Thu, 10 Feb 2022 09:30:59 GMT
etag: W/"6204db53-4ff"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 6942418
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=coAy1WjYMe1iGBkt2E6gl5rsn3%2BRZs53UbAvRv0P%2F%2FimEhz2amFwTP7yGDwWxVHXJ16tRJCwxxQsAc6fMWVhXsbbI809Q2C1S%2Fk%2F3VUW3H6oi52SsVrwiNLYCW0wVi5RmVk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f9e3a3073f7-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 794a6d2df00fc15e8b4ed6ff4992525e
f8d67c7fd506709d7232298859fe2b3daf374f29
02d38690754b5d99178d576fe6df6c1ca881a2bbd806a75c633c371fac0221da
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
dismantlepenantiterrorist.com/pxf.gif?uuid=173e9ea1-102b-4668-a03e-347fc496c9fb&eb=571189e4c7fd56c848e0c687526c64f1&te=94d4becc704af97ad9b7161ef0f8c2eb&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=d20bd9cc9099994d29386eab93410fd0&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=18
200 OK 36 B URL HTTP/1.1 dismantlepenantiterrorist.com/pxf.gif?uuid=173e9ea1-102b-4668-a03e-347fc496c9fb&eb=571189e4c7fd56c848e0c687526c64f1&te=94d4becc704af97ad9b7161ef0f8c2eb&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=d20bd9cc9099994d29386eab93410fd0&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=18
IP
ASN #39572 DataWeb Global Group B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad6a6cb23b0391c6652e018b9ac3bfc7
d38bd8446c3505f9b4797660388a8d6e8fd3d450
be4f754acf2dd33169add8976c1264f647470efdc993927040e23c4d310a835f
Analyzer Verdict Alert quad9 Sinkholed
GET /pxf.gif?uuid=173e9ea1-102b-4668-a03e-347fc496c9fb&eb=571189e4c7fd56c848e0c687526c64f1&te=94d4becc704af97ad9b7161ef0f8c2eb&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=d20bd9cc9099994d29386eab93410fd0&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=18 HTTP/1.1
Host: dismantlepenantiterrorist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sat, 22 Oct 2022 18:31:38 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9491fa39355bda6eb111391ff88fe393
Strict-Transport-Security: max-age=0; includeSubdomains
dismantlepenantiterrorist.com/pxf.gif?uuid=173e9ea1-102b-4668-a03e-347fc496c9fb&eb=571189e4c7fd56c848e0c687526c64f1&te=94d4becc704af97ad9b7161ef0f8c2eb&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=9ced2453f41586bc39632e754938332a&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=18
200 OK 1 B URL HTTP/1.1 dismantlepenantiterrorist.com/pxf.gif?uuid=173e9ea1-102b-4668-a03e-347fc496c9fb&eb=571189e4c7fd56c848e0c687526c64f1&te=94d4becc704af97ad9b7161ef0f8c2eb&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=9ced2453f41586bc39632e754938332a&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=18
IP
ASN #39572 DataWeb Global Group B.V.
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert quad9 Sinkholed
GET /pxf.gif?uuid=173e9ea1-102b-4668-a03e-347fc496c9fb&eb=571189e4c7fd56c848e0c687526c64f1&te=94d4becc704af97ad9b7161ef0f8c2eb&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=9ced2453f41586bc39632e754938332a&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=18 HTTP/1.1
Host: dismantlepenantiterrorist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sat, 22 Oct 2022 18:31:38 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c9b9fcf5d9a7b1f32a7ddeeab20faebb
Strict-Transport-Security: max-age=0; includeSubdomains
pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022101901&st=env
200 OK 11 kB URL HTTP/2 pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022101901&st=env
IP
File type JSON data\012- , ASCII text, with very long lines (14691), with no line terminators
Hash b804476df79915edc836ed94c036b83e
7e16903639985e0471b47b98097cc31eb322b13e
5aa5f39dd8166615eaf3001753ccae331204fcb3c8bd92bb54bf817db162f727
GET /getconfig/sodar?sv=200&tid=gpt&tv=2022101901&st=env HTTP/1.1
Host: pagead2.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-type: application/json; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sat, 22 Oct 2022 18:31:38 GMT
server: cafe
cache-control: private
content-length: 11157
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9548c9753766c064281382773a5bb5fb
9fd0ffcca2333027d6b127080ab97d6fb8d06712
2195932a1137889394b79e3acf2a6cf8d0a0711d5fe1d487d483453a2b1dfbad
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
tpc.googlesyndication.com/sodar/sodar2.js
200 OK 6.4 kB URL HTTP/2 tpc.googlesyndication.com/sodar/sodar2.js
IP
File type ASCII text, with very long lines (1321)
Hash ac906814ed812c4ecdbb624a3bd2f6c3
8e4547eaffaa66a1ee61b36028dbcd7091d0e7de
8ab8cef6156022c4547455defd8252b48b6bcb8b734072849345bb99758705fe
GET /sodar/sodar2.js HTTP/1.1
Host: tpc.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 6386
date: Sat, 22 Oct 2022 18:31:38 GMT
expires: Sat, 22 Oct 2022 18:31:38 GMT
cache-control: private, max-age=3000
etag: "1637097310169751"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
tpc.googlesyndication.com/sodar/sodar2/225/runner.html
200 OK 5.0 kB URL HTTP/2 tpc.googlesyndication.com/sodar/sodar2/225/runner.html
IP
File type HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2020)
Hash f530c16b248be97e10df228df6a41c24
ca3c3a38bbeef6906682b3e0b2a7be40c08b0925
f45287dcfd79a2411e79f98c834c6f7eff8a281a9b4fdba0124be9d204987786
GET /sodar/sodar2/225/runner.html HTTP/1.1
Host: tpc.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Oct 2022 13:50:45 GMT
expires: Sat, 21 Oct 2023 13:50:45 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 103253
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.yourwebbars.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/index.html
200 OK 915 B URL HTTP/2 cdn.yourwebbars.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/index.html
IP
File type HTML document text\012- HTML document, ASCII text
Hash fcc746b0eb3e89b6fbffe93796088bb1
a916a5d1cf29cff703a99428d2de1e3d41c26685
71c91eefb3c3954a5c5f1e5fd26e892d31986b0a009ece82c0e0e3c03ddee6c6
GET /sb/interstitial/utility/default/blog/flip_icon_fullpage/16/index.html HTTP/1.1
Host: cdn.yourwebbars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: text/html
last-modified: Thu, 10 Feb 2022 09:30:55 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 164313
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o7ttS7th7Okc1ok30v6eaF0Q8Re2W25uznmAZxnEKR90GIVNwLMA0rB1dzJqpu%2BE3Hb90x8muEENdMHmolyUyDMsqwV8Vl1auVmPU1iHYFC0W9GBb9FtANlcD4774JbFJml3n6k%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f9d5f1b1bfa-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.google.com/recaptcha/api2/aframe
200 OK 515 B URL HTTP/2 www.google.com/recaptcha/api2/aframe
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (783), with no line terminators
Hash 02a5b2aea6f30375aaa08a04b182e8f8
b8f98e3c665e5629e878d8da4ada5ffefa8cb792
5c0a895b91ad6ea9f8045f7cada291382a33e30f83d2af0c4a385d084a58dc6b
GET /recaptcha/api2/aframe HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sat, 22 Oct 2022 18:31:38 GMT
date: Sat, 22 Oct 2022 18:31:38 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'nonce-lssPNXVzNZbAXYB095vnkQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/js/script.js
200 OK 73 kB URL HTTP/2 cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/js/script.js
IP
Hash 5d53b1c3b91e712c0b4c045455b7d15e
28593ffaf9fda4d092386289dbe74d46f49b21e7
ea45be75616b344c5a32a7e7cf9f3ae71f76cdd838235bfbd7f56d515b3f555a
GET /sb/interstitial/utility/default/blog/flip_icon_fullpage/16/js/script.js HTTP/1.1
Host: cdn.sb4you1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: application/javascript
last-modified: Thu, 10 Feb 2022 09:31:01 GMT
etag: W/"6204db55-18d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 330388
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kwmXbhLm%2FItXYPV%2BuhDcgmZ0XRz8NMgxQpdzRQqKAL2rv4kQ4xlc5qnIMxUBHWRtsnPPFDg5fJreZOuBCwpl1Wk%2BXP81QxrcGu9ECl0uaJQztloDAeDmATKCDKm2%2F2AKmaw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f9df9cf73f7-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 9f84a11cd39c014fffc187f2a8b0d8df
1875e117dec3fc707db902e87df9ec691b2cc763
bf0c0ac413147f09128a7af625499402eea897c3efad12828347efaba9b9d3a1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/css/style.css
200 OK 17 kB URL HTTP/2 cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/css/style.css
IP
Hash 5459a89f4cf11d157bd296b3277662c1
96c21c1ac888ff20c4a5add35c01da6957660174
db56d2986059737bc6000ca7c6140360742a83b7cb411cc7a2e42e2946e28146
GET /sb/interstitial/utility/default/blog/flip_icon_fullpage/16/css/style.css HTTP/1.1
Host: cdn.sb4you1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: text/css
last-modified: Thu, 10 Feb 2022 09:30:56 GMT
etag: W/"6204db50-15b8"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 330388
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=szIPbm%2FDMeWxyHq0do411k4TwAyiDTOXIzPt5i2fwH55ekt6o3%2FIuEtVxYBzvW2FQgUEvjMkr2CKGUN3JYTCujVzQy8I8f581wd9jRUSBdovBfqB%2FFAZ85i1Oqlc6ap%2BTVY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f9e19fd73f7-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
insistinestimable.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRidTVwEQRMUCpBAV1CAhM%2B7d3s%2FS4qIEIwsnDhKgkIH87fnwbM7q5nd27MriwiU8iiQKNfv7FiBCIFES4TOkVxYQvJRucA1DQVCSkWB7mJx8Emr73v7XvG%2B980XO8Up8VHQk2vXzZbSmi616n7tjY%2BC4HJtVaXFoDbotj9uh5drtv921K77b9bel3zDLDX8wPcDP6gtKytjM1iaklDZoyioR349bNSDVoiB%2FT92hQdHPYj%2BKXkRSkwWnniXoPgYafL9Nek2cpO99V5SaJobi77Y%2FzDdSE2ZIpmPsfUQp%2Ftnahh3vPwYJt2b2YXp%2FytkakK8w8dg6f6ZSbD%2B7swn05ApmHgeZX8MqcdQdAxu7kGJYwJwgRtrSJMHN4wt6eYzlk7ZCVl4%2BhdUOSELv11Cmnx3VatB7bbRRa5M6jCIK6jBGKo3RlYcIN86B1UegOefQYlfyNLTVaTJ7prTBkqcvN5uNUQnbjUXGyJuLYatuL1I4253MQp5HLJQBp1mPAtIqTFUPIaWQ1DnoZh%2BykMReygyD4k4qfEgCDq%2B4NTvRpw3RUeytvAD2okDGvjtLgo%2B3WGIPBuC6yG43UZmt7GhhrDFz3DrFZzw4HKCvqhQSoLSEZSUoFQEZU5Q9qs9oV3DVQ%2BEdgULznrjrDerkcl7O3TP5D2Zkp3slFycBuctXDjEhjypiYbPRMR55EdRFIWiETW7bUlZ1AwDPxY%2BnKqg3LnZmltqQl76%2FStk6viFr8HoAZw%2BAFcXQYtXQctRp%2BGDro%2FCro%2BtdN%2FJVNR5AmEqZPkC8k1vR5%2BSl2eXa979A5IfXfmEXZ%2F8%2BfBvcFshsxU%2BVU8Ievr%2B6JYpye4tUzryw1qWq0Rt0elVb%2Bc0l%2Be%2F%2BUBulsaKlWtu%2BPAdPiWm46M70uWrNBUq7Tny7VUlhLTLxnJJflpxdyW7Wbj1q4VNi2z15rvLK0lmpXPKpGNQNSHk8AhcTciFH%2FdmD%2FaVz0soO4YtKiTFETkrKHMAnm3DZXP%2FzpyH1XMNyzyURTWyDTb%2FqRWBlnNMWQX3H8zm8467j559DTS%2FhzSp0LcV%2BroC1UO44vwoz%2BzRlV%2BbswLT3ohp6%2B0ybfWXz8J16qTW9EWHyVh2mAxbYSy5YK0W83nMWVN0uxy5m%2FA7nef%2BAQAA%2F%2F8BAAD%2F%2F3Hl%2FQx7BAAA
200 OK 7 B URL HTTP/1.1 insistinestimable.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRidTVwEQRMUCpBAV1CAhM%2B7d3s%2FS4qIEIwsnDhKgkIH87fnwbM7q5nd27MriwiU8iiQKNfv7FiBCIFES4TOkVxYQvJRucA1DQVCSkWB7mJx8Emr73v7XvG%2B980XO8Up8VHQk2vXzZbSmi616n7tjY%2BC4HJtVaXFoDbotj9uh5drtv921K77b9bel3zDLDX8wPcDP6gtKytjM1iaklDZoyioR349bNSDVoiB%2FT92hQdHPYj%2BKXkRSkwWnniXoPgYafL9Nek2cpO99V5SaJobi77Y%2FzDdSE2ZIpmPsfUQp%2Ftnahh3vPwYJt2b2YXp%2FytkakK8w8dg6f6ZSbD%2B7swn05ApmHgeZX8MqcdQdAxu7kGJYwJwgRtrSJMHN4wt6eYzlk7ZCVl4%2BhdUOSELv11Cmnx3VatB7bbRRa5M6jCIK6jBGKo3RlYcIN86B1UegOefQYlfyNLTVaTJ7prTBkqcvN5uNUQnbjUXGyJuLYatuL1I4253MQp5HLJQBp1mPAtIqTFUPIaWQ1DnoZh%2BykMReygyD4k4qfEgCDq%2B4NTvRpw3RUeytvAD2okDGvjtLgo%2B3WGIPBuC6yG43UZmt7GhhrDFz3DrFZzw4HKCvqhQSoLSEZSUoFQEZU5Q9qs9oV3DVQ%2BEdgULznrjrDerkcl7O3TP5D2Zkp3slFycBuctXDjEhjypiYbPRMR55EdRFIWiETW7bUlZ1AwDPxY%2BnKqg3LnZmltqQl76%2FStk6viFr8HoAZw%2BAFcXQYtXQctRp%2BGDro%2FCro%2BtdN%2FJVNR5AmEqZPkC8k1vR5%2BSl2eXa979A5IfXfmEXZ%2F8%2BfBvcFshsxU%2BVU8Ievr%2B6JYpye4tUzryw1qWq0Rt0elVb%2Bc0l%2Be%2F%2BUBulsaKlWtu%2BPAdPiWm46M70uWrNBUq7Tny7VUlhLTLxnJJflpxdyW7Wbj1q4VNi2z15rvLK0lmpXPKpGNQNSHk8AhcTciFH%2FdmD%2FaVz0soO4YtKiTFETkrKHMAnm3DZXP%2FzpyH1XMNyzyURTWyDTb%2FqRWBlnNMWQX3H8zm8467j559DTS%2FhzSp0LcV%2BroC1UO44vwoz%2BzRlV%2BbswLT3ohp6%2B0ybfWXz8J16qTW9EWHyVh2mAxbYSy5YK0W83nMWVN0uxy5m%2FA7nef%2BAQAA%2F%2F8BAAD%2F%2F3Hl%2FQx7BAAA
IP
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert quad9 Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRidTVwEQRMUCpBAV1CAhM%2B7d3s%2FS4qIEIwsnDhKgkIH87fnwbM7q5nd27MriwiU8iiQKNfv7FiBCIFES4TOkVxYQvJRucA1DQVCSkWB7mJx8Emr73v7XvG%2B980XO8Up8VHQk2vXzZbSmi616n7tjY%2BC4HJtVaXFoDbotj9uh5drtv921K77b9bel3zDLDX8wPcDP6gtKytjM1iaklDZoyioR349bNSDVoiB%2FT92hQdHPYj%2BKXkRSkwWnniXoPgYafL9Nek2cpO99V5SaJobi77Y%2FzDdSE2ZIpmPsfUQp%2Ftnahh3vPwYJt2b2YXp%2FytkakK8w8dg6f6ZSbD%2B7swn05ApmHgeZX8MqcdQdAxu7kGJYwJwgRtrSJMHN4wt6eYzlk7ZCVl4%2BhdUOSELv11Cmnx3VatB7bbRRa5M6jCIK6jBGKo3RlYcIN86B1UegOefQYlfyNLTVaTJ7prTBkqcvN5uNUQnbjUXGyJuLYatuL1I4253MQp5HLJQBp1mPAtIqTFUPIaWQ1DnoZh%2BykMReygyD4k4qfEgCDq%2B4NTvRpw3RUeytvAD2okDGvjtLgo%2B3WGIPBuC6yG43UZmt7GhhrDFz3DrFZzw4HKCvqhQSoLSEZSUoFQEZU5Q9qs9oV3DVQ%2BEdgULznrjrDerkcl7O3TP5D2Zkp3slFycBuctXDjEhjypiYbPRMR55EdRFIWiETW7bUlZ1AwDPxY%2BnKqg3LnZmltqQl76%2FStk6viFr8HoAZw%2BAFcXQYtXQctRp%2BGDro%2FCro%2BtdN%2FJVNR5AmEqZPkC8k1vR5%2BSl2eXa979A5IfXfmEXZ%2F8%2BfBvcFshsxU%2BVU8Ievr%2B6JYpye4tUzryw1qWq0Rt0elVb%2Bc0l%2Be%2F%2BUBulsaKlWtu%2BPAdPiWm46M70uWrNBUq7Tny7VUlhLTLxnJJflpxdyW7Wbj1q4VNi2z15rvLK0lmpXPKpGNQNSHk8AhcTciFH%2FdmD%2FaVz0soO4YtKiTFETkrKHMAnm3DZXP%2FzpyH1XMNyzyURTWyDTb%2FqRWBlnNMWQX3H8zm8467j559DTS%2FhzSp0LcV%2BroC1UO44vwoz%2BzRlV%2BbswLT3ohp6%2B0ybfWXz8J16qTW9EWHyVh2mAxbYSy5YK0W83nMWVN0uxy5m%2FA7nef%2BAQAA%2F%2F8BAAD%2F%2F3Hl%2FQx7BAAA HTTP/1.1
Host: insistinestimable.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Cookie: u_pl=17041607; uid_id2=652d7f53-2df5-45f6-af88-94cf4b4e173f:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 22 Oct 2022 18:31:38 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 976f599e7ee94dae4d4828fde4d88ef1
Strict-Transport-Security: max-age=0; includeSubdomains
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 9f84a11cd39c014fffc187f2a8b0d8df
1875e117dec3fc707db902e87df9ec691b2cc763
bf0c0ac413147f09128a7af625499402eea897c3efad12828347efaba9b9d3a1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
200 OK 29 kB URL HTTP/2 fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
IP
File type gzip compressed data, max compression\012- data
Hash 939209d057cd987b968ddf347451e4b7
f09df88329647db187f664bd34746a9fe612cdf7
6268301b2bb6abb784f8201b8e6e15afeda27945436cc436292652cdd014769c
GET /s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://send.cm
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 28288
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Oct 2022 15:21:36 GMT
expires: Thu, 19 Oct 2023 15:21:36 GMT
cache-control: public, max-age=31536000
age: 270602
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash faad9f338c317937daf3fdd17f4cc365
28df386a2e09d9a08d04fb49986a1c36d5f707ce
76340243040de6646f3e50995f4049f9c7cea796cbc5e2c5628c3b8d23fcd66e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash faad9f338c317937daf3fdd17f4cc365
28df386a2e09d9a08d04fb49986a1c36d5f707ce
76340243040de6646f3e50995f4049f9c7cea796cbc5e2c5628c3b8d23fcd66e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash faad9f338c317937daf3fdd17f4cc365
28df386a2e09d9a08d04fb49986a1c36d5f707ce
76340243040de6646f3e50995f4049f9c7cea796cbc5e2c5628c3b8d23fcd66e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
insistinestimable.com/pixel/sbs?c=1
200 OK 0 B URL HTTP/1.1 insistinestimable.com/pixel/sbs?c=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: insistinestimable.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Cookie: u_pl=17041607; uid_id2=652d7f53-2df5-45f6-af88-94cf4b4e173f:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 22 Oct 2022 18:31:38 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
cdn.ampproject.org/rtv/012210071758000/amp4ads-v0.mjs
200 OK 62 kB URL HTTP/2 cdn.ampproject.org/rtv/012210071758000/amp4ads-v0.mjs
IP
File type Unicode text, UTF-8 text, with very long lines (65008)
Hash 2f819ab9e88bf4783f9dccbe3282ef51
26847b07cda02fd43a89cd1fc31aae270520e3e4
79e01757002fad51145fd068c5d0bf4b938cc319172c7f2306f63264638b064b
GET /rtv/012210071758000/amp4ads-v0.mjs HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 61557
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Oct 2022 01:43:26 GMT
expires: Sun, 22 Oct 2023 01:43:26 GMT
cache-control: public, max-age=31536000
etag: "6f919b986f193e5c"
content-type: text/javascript; charset=UTF-8
age: 60492
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d595e8c08309e34785e9aa9658796692
0e0638e44feeaff71e1cf238d433efa6e55cfc84
d10bffa0d95627c7328d30cd91625067221676985dca5f8f04d66248b10ca6f1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.ampproject.org/rtv/012210071758000/v0/amp-analytics-0.1.mjs
200 OK 29 kB URL HTTP/2 cdn.ampproject.org/rtv/012210071758000/v0/amp-analytics-0.1.mjs
IP
File type ASCII text, with very long lines (65534)
Hash 0620379bcf511bbba0b7a1ea515195c3
2151380ebf3ead16e149dc44b063a00ffd9f7198
ae9ce691f598b8b75919cb3774dfb5a404f69a91619b9620cf9cedc89fb8bb21
GET /rtv/012210071758000/v0/amp-analytics-0.1.mjs HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 28805
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Oct 2022 04:54:51 GMT
expires: Sun, 22 Oct 2023 04:54:51 GMT
cache-control: public, max-age=31536000
etag: "61ef65d2d2d03d2c"
content-type: text/javascript; charset=UTF-8
age: 49007
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.ampproject.org/rtv/012210071758000/v0/amp-ad-exit-0.1.mjs
200 OK 5.2 kB URL HTTP/2 cdn.ampproject.org/rtv/012210071758000/v0/amp-ad-exit-0.1.mjs
IP
File type ASCII text, with very long lines (14697)
Hash bd8bcdc460cb8256fe3ebab112e18dd7
ba37e1cb0e725e63b8a5c106bb080f440c61959c
b935d5a127db329d29fc8e2015b570a5a539a6bda6038a1517811f65889f3e48
GET /rtv/012210071758000/v0/amp-ad-exit-0.1.mjs HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 5208
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Oct 2022 20:45:26 GMT
expires: Sat, 21 Oct 2023 20:45:26 GMT
cache-control: public, max-age=31536000
etag: "79c6a9d24c248711"
content-type: text/javascript; charset=UTF-8
age: 78372
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.ampproject.org/rtv/012210071758000/v0/amp-fit-text-0.1.mjs
200 OK 1.9 kB URL HTTP/2 cdn.ampproject.org/rtv/012210071758000/v0/amp-fit-text-0.1.mjs
IP
File type ASCII text, with very long lines (5021)
Hash 7462c705d733aa72a8b4d2df3662548c
bfe5fb25bb8aca24c64dfcc2ce859d2360ecc46a
91ef78b66de76ad799647815b502eb7aefac8fbb15388048d4696f23eea9fb78
GET /rtv/012210071758000/v0/amp-fit-text-0.1.mjs HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 1904
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Oct 2022 05:54:03 GMT
expires: Sat, 21 Oct 2023 05:54:03 GMT
cache-control: public, max-age=31536000
etag: "cd31ad97eaf70e3d"
content-type: text/javascript; charset=UTF-8
age: 131855
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.ampproject.org/rtv/012210071758000/v0/amp-form-0.1.mjs
200 OK 13 kB URL HTTP/2 cdn.ampproject.org/rtv/012210071758000/v0/amp-form-0.1.mjs
IP
File type Unicode text, UTF-8 text, with very long lines (41068)
Hash a5183113bb974a73ab3c97d435c1cfd5
fc82f54e296356e67c7fdad68394b83055a86127
144a3976246abc534435200728f70e622400a7d255bb70970c97af987f2863b7
GET /rtv/012210071758000/v0/amp-form-0.1.mjs HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 12962
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Oct 2022 18:46:27 GMT
expires: Sat, 21 Oct 2023 18:46:27 GMT
cache-control: public, max-age=31536000
etag: "81bd7ae64421add4"
content-type: text/javascript; charset=UTF-8
age: 85511
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash faad9f338c317937daf3fdd17f4cc365
28df386a2e09d9a08d04fb49986a1c36d5f707ce
76340243040de6646f3e50995f4049f9c7cea796cbc5e2c5628c3b8d23fcd66e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2022 18:31:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
200 OK 0 B URL HTTP/2 googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pagead/drt/si?st=NO_DATA HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 22 Oct 2022 18:31:39 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 22-Oct-2022 19:31:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
test_cookie=CheckForPermission; expires=Sat, 22-Oct-2022 18:46:39 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 22 Oct 2022 18:31:39 GMT
cache-control: private
X-Firefox-Spdy: h2
secureads.increaserev.com/InvalidAds/addRequest.php?ip=91.90.42.154&domain=send.cm&os=Linux&adstype={%22_336x280%22:1}
200 OK 46 B URL HTTP/2 secureads.increaserev.com/InvalidAds/addRequest.php?ip=91.90.42.154&domain=send.cm&os=Linux&adstype={%22_336x280%22:1}
IP
Hash f17403e3d590a5f047ef0aca8c4f0a9a
337408d544d427462fb26636361440e244644239
a1fabe21596a471d9b9acdc7451504c988d11cf65580e47011182004ca70c4e9
GET /InvalidAds/addRequest.php?ip=91.90.42.154&domain=send.cm&os=Linux&adstype={%22_336x280%22:1} HTTP/1.1
Host: secureads.increaserev.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-security-policy: upgrade-insecure-requests;
access-control-allow-origin: *
x-varnish: 44371448
age: 0
x-cache: MISS
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LxhKXbmn1s8rSOGoznh2WiaOjtGHdhG4AT33WoxYBUI1EBkFdwi9cc3lSWqdZoZStYKRm9YZCJNj73EB51DKx11dpMNNxJR1gVW1H4CPcdbeUlR%2F8jSk1JzB%2BwEyaokyMLRVWHokOcOEHi8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44fabfd14b509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
pogothere.xyz/asd100.bin
200 OK 16 kB IP
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /asd100.bin HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Origin: https://send.cm
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:36 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 692
last-modified: Sat, 22 Oct 2022 18:20:04 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jHukujIjfOzJcH5LA2xSOhyiKsqwnYB0%2BmsJyTHFlXGoYF7Op1%2B%2F%2FFdAwXRyW44%2Fjerdv7FHwmnJ63YIof9HqCzuzm4X61iZJazkCJ3ZKAYdK0%2Fv7uDFrrO0mugQZq4S"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f945a207731-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
send.cm/c6ffp6cuwkme
200 OK 0 B IP
GET /c6ffp6cuwkme HTTP/1.1
Host: send.cm
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=0;includeSubDomains;
expires: Fri, 21 Oct 2022 18:31:34 GMT
set-cookie: lang=english; domain=.send.cm; path=/
c_7hyj5tegwm4sd1=c6ffp6cuwkme; domain=.send.cm; path=/
aff=40684; domain=.send.cm; path=/; expires=Sat, 05-Nov-2022 18:31:34 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mxJuUEtc1YADeUlRcl6NCWF%2FKDpMdrmrC9nMdb7LnPVmgQzegVEFy%2Fpe9cDswbRicokcVs9KWGwNgAn3f82Zr3jaMMlxXp1fh1VS3R5cV15v%2FtRYUackCCE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f87bee60b45-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
whairtoa.com/?rb=f9I7gyZDY5QNEvoyaTKFoaM0Wuy6T-PVw6pBHM7TL3SUhVQqmLWtu3PiikThFHW9Fb-5plXkJAVzzZzHluq4jDwQrpj-xAeHrIxjuTkmQCAYmWH3_FxhILXFZmQeqfHzveTsoO9Gy390x80LbgeDQQTTdN4tiPGI3gQt6qXw6N2hFXJ8M1EavoxHQUtY0_YK8QUWDo3EUJY28-wc&request_ab2=0&zoneid=4277204&js_build=iclick-v1.438.0&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1268&wih=939&wiw=1280&wfc=4&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.438.0&bs=43fda975-fb28-4340-8c15-5730bb3bd5bd&userId=3d03b569448547a2b6bf4f44bd297cc4&m=link
200 OK 0 B URL HTTP/2 whairtoa.com/?rb=f9I7gyZDY5QNEvoyaTKFoaM0Wuy6T-PVw6pBHM7TL3SUhVQqmLWtu3PiikThFHW9Fb-5plXkJAVzzZzHluq4jDwQrpj-xAeHrIxjuTkmQCAYmWH3_FxhILXFZmQeqfHzveTsoO9Gy390x80LbgeDQQTTdN4tiPGI3gQt6qXw6N2hFXJ8M1EavoxHQUtY0_YK8QUWDo3EUJY28-wc&request_ab2=0&zoneid=4277204&js_build=iclick-v1.438.0&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1268&wih=939&wiw=1280&wfc=4&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.438.0&bs=43fda975-fb28-4340-8c15-5730bb3bd5bd&userId=3d03b569448547a2b6bf4f44bd297cc4&m=link
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /?rb=f9I7gyZDY5QNEvoyaTKFoaM0Wuy6T-PVw6pBHM7TL3SUhVQqmLWtu3PiikThFHW9Fb-5plXkJAVzzZzHluq4jDwQrpj-xAeHrIxjuTkmQCAYmWH3_FxhILXFZmQeqfHzveTsoO9Gy390x80LbgeDQQTTdN4tiPGI3gQt6qXw6N2hFXJ8M1EavoxHQUtY0_YK8QUWDo3EUJY28-wc&request_ab2=0&zoneid=4277204&js_build=iclick-v1.438.0&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1268&wih=939&wiw=1280&wfc=4&pl=https%3A%2F%2Fsend.cm%2Fc6ffp6cuwkme&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.438.0&bs=43fda975-fb28-4340-8c15-5730bb3bd5bd&userId=3d03b569448547a2b6bf4f44bd297cc4&m=link HTTP/1.1
Host: whairtoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://send.cm/
Origin: https://send.cm
Connection: keep-alive
Cookie: OAID=30884b2c792e477984850bf12ba64ea8; oaidts=1666463496
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:36 GMT
content-type: application/json
x-trace-id: ff1a4307ab9a446526484e4248f0e3a4
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=3d03b569448547a2b6bf4f44bd297cc4; expires=Sun, 22 Oct 2023 18:31:36 GMT; path=/; secure; SameSite=None
oaidts=1666463496; expires=Sun, 22 Oct 2023 18:31:36 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Sat, 29 Oct 2022 18:31:36 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
addresseepaper.com/sfp.js
200 OK 0 B URL HTTP/2 addresseepaper.com/sfp.js
IP
GET /sfp.js HTTP/1.1
Host: addresseepaper.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: e2ca293836b19f905728a347abe8131c
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sat, 22 Oct 2022 18:31:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Qf9OTzpzpsGqUpnHjXDepv05%2B99mQk42zotssy8BTNd2hOu%2BFa%2B%2FsL4pE5n7drBfujwxum%2BYos%2FKux%2FIV1P18Rqrvc4pBYNuYUIILgh3WNZYWbL3oOsW8yPjO8NYfq21r5hH1c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f99ba92747c-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
secureads.increaserev.com/InvalidAds/checkblock.php?ip=91.90.42.154&domain=send.cm
200 OK 0 B URL HTTP/2 secureads.increaserev.com/InvalidAds/checkblock.php?ip=91.90.42.154&domain=send.cm
IP
GET /InvalidAds/checkblock.php?ip=91.90.42.154&domain=send.cm HTTP/1.1
Host: secureads.increaserev.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-security-policy: upgrade-insecure-requests;
access-control-allow-origin: *
x-varnish: 35964664
age: 0
x-cache: MISS
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ussSmoHvaDmp5MUCy%2FOdao1r4m3oMFh9o9x9Pv74EYDDaeqoPGqjOHcDqlbfnuKYH65IFFofC1Kt5AOd2f6Fu2dFYaApWspUm0MrkCbHN8fSAbcLXYQjgseVWJmnVenan9PUUShJ3yQ7WnQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f8d4bf4b509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/css/animate.css
200 OK 0 B URL HTTP/2 cdn.sb4you1.com/sb/interstitial/utility/default/blog/flip_icon_fullpage/16/css/animate.css
IP
GET /sb/interstitial/utility/default/blog/flip_icon_fullpage/16/css/animate.css HTTP/1.1
Host: cdn.sb4you1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:37 GMT
content-type: text/css
last-modified: Thu, 10 Feb 2022 09:30:57 GMT
etag: W/"6204db51-13591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 211241
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CScYDmK01J0Min8holOiXLtm2J2f7tuJn5VcXeWBkQDMlqNWxBQAY2S7F3RGXfOIiQdH%2F8Lwtqfpt%2FIqc5gyAvYW0AHIJWA6xGomhUasfO5ARXV1i2mHGk1PafmYGj0yb5Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75e44f9e09e373f7-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
secureads.increaserev.com/InvalidAds/track.php?ip=undefined&domain=send.cm&type=send.js___default
200 OK 0 B URL HTTP/2 secureads.increaserev.com/InvalidAds/track.php?ip=undefined&domain=send.cm&type=send.js___default
IP
GET /InvalidAds/track.php?ip=undefined&domain=send.cm&type=send.js___default HTTP/1.1
Host: secureads.increaserev.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-security-policy: upgrade-insecure-requests;
access-control-allow-origin: *
x-varnish: 31584346 24704593
age: 1
x-cache: HIT
x-cache-hits: 8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gxoxkbH1Wv5hCra7cxWL3DAP9%2B0Af6IvfhXLjm0ZgpxJhcu7IG6MzZeiIdoZKGLik1OYZHSGWXtS%2BTJOIH0y%2FqdxX8XKusnZNN3l4Y8JArNNsjdQW5JPQbgyiHnKf4xcnxnK86NioNqSXqo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f8ceb96b509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
api.hostip.info/get_json.php
200 OK 0 B URL HTTP/2 api.hostip.info/get_json.php
IP
GET /get_json.php HTTP/1.1
Host: api.hostip.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: application/json; charset=iso-8859-1
expires: Sun, 23 Oct 2022 18:31:35 GMT
last-modified: Sat, 22 Oct 2022 18:31:35 GMT
cache-control: public, max-age=86400
pragma: !invalid
access-control-allow-origin: *
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KFt5YbhVdJBmf4JZQDNTZyZVHhr26wwOSA0sbvgk7sLZyWNeDhpsm4ZHTOWepVko2UUs9FV1qnsLlatRtDMvTbsoqP0126nOWxNoBLTRho2L%2F9eUi9OppbBgf%2BxLdTfsTPE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f8cbc770b69-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 22 Oct 2022 18:31:38 GMT
date: Sat, 22 Oct 2022 18:31:38 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
increaserev.com/ads/ob/tagf/send.js
200 OK 0 B URL HTTP/2 increaserev.com/ads/ob/tagf/send.js
IP
GET /ads/ob/tagf/send.js HTTP/1.1
Host: increaserev.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 22 Oct 2022 18:31:35 GMT
content-type: application/javascript
last-modified: Thu, 25 Aug 2022 12:43:53 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-origin: *
access-control-allow-headers: origin, x-requested-with, content-type
access-control-allow-methods: PUT, GET, POST, DELETE, OPTIONS
cache-control: max-age=31536000
cf-cache-status: HIT
age: 592
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gAeN%2BhWfYbBAdJgVcGXGOBQMzwWqf%2FKs8ezzER7Fd0Q54bDXKbCpF8f0tXazrhE%2FKiS33DWrGkQpVw%2BXaCMxAS8KszeWC6B6WnsamILbirTgqeZxKvgPX5YH0nuFDTShsw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75e44f8c5e92b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
whairtoa.com/5/4277204/?oo=1&aab=1
200 OK 0 B URL HTTP/2 whairtoa.com/5/4277204/?oo=1&aab=1
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /5/4277204/?oo=1&aab=1 HTTP/1.1
Host: whairtoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://send.cm
Connection: keep-alive
Referer: https://send.cm/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 22 Oct 2022 18:31:36 GMT
content-type: application/json
x-trace-id: 74b5bbef45493c40dbab04082391f60b
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-allow-origin: https://send.cm
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=30884b2c792e477984850bf12ba64ea8; expires=Sun, 22 Oct 2023 18:31:36 GMT; path=/; secure; SameSite=None
oaidts=1666463496; expires=Sun, 22 Oct 2023 18:31:36 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
104.26.2.171
139.45.195.254
23.36.76.226
104.21.84.149
3.74.98.52