GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8b4e10c31932a559912f415b65fba92c.json
200 OK 1.3 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8b4e10c31932a559912f415b65fba92c.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 499d57f89b2bf5fed52d984d865fd72c
f3dd138886f2c1e257d3ac2214b7e3cba57e56b2
9467cf5576ce2a97d9e44e53915a9c4ae529c134cc1ea5a3c62ea304eebda0c8
GET /genfiles/cms/1-285/desktop/media_asset/8b4e10c31932a559912f415b65fba92c.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
traceparent: 00-72e344ce2d0e3502bdc4d7333bda209e-2dace1da028ae294-01
last-modified: Thu, 27 Feb 2025 08:17:13 GMT
etag: W/"499d57f89b2bf5fed52d984d865fd72c"
content-encoding: gzip
expires: Thu, 27 Feb 2025 11:06:29 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2
200 OK 64 kB URL GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 63748, version 1.0
Hash 6887b6f24414dbc612dbf42ccdc76b70
8068d3abfbc6cbf35b55919da45b1f4d2d136238
fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c
GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:22 GMT
content-type: font/woff2
content-length: 63748
traceparent: 00-7226deca913be44b328c5adaa7927cab-343adf9c2a96d90e-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "6887b6f24414dbc612dbf42ccdc76b70"
expires: Thu, 16 Jan 2025 10:32:14 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 353
cache: HIT
x-cached-since: 2025-06-04T01:33:29+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET v3.traincdn.com/sys-static/shared-assets/Desktop/__shared_css_6142be.css
200 OK 4.2 kB URL GET v3.traincdn.com/sys-static/shared-assets/Desktop/__shared_css_6142be.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (3743)
Hash 171e9a7475c71887ff37d52e24605a97
e48eb9f3fa6407ba31f405ed2320f18889e5f388
6142be1be0200ed42b10d14b9f5ffa06c4fcf9d2445d15c64d5bc16eb21a8fe5
GET /sys-static/shared-assets/Desktop/__shared_css_6142be.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
traceparent: 00-baa455f4c8403a0a54ac88ba28fd9747-d5e62d7c551b6083-01
last-modified: Tue, 03 Jun 2025 10:46:13 GMT
etag: W/"171e9a7475c71887ff37d52e24605a97"
x-amz-meta-mtime: 1748947257.423837192
content-encoding: gzip
expires: Wed, 04 Jun 2025 10:55:23 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 52701
cache: HIT
x-cached-since: 2025-06-03T11:00:50+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_forgot_password/en/dictionary_55fae06a27e076f807e5a905ef7d7f4f.json
200 OK 3.7 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_forgot_password/en/dictionary_55fae06a27e076f807e5a905ef7d7f4f.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 3bb9d2b7d86ab36f93b8bad3586b177e
eb93ea7aee3987f2bde876f649e99c957ead117b
733d240febdc9d69f40692b57c1e4de1c71fcfd29ef401ddda5adf3abb8380b7
GET /genfiles/web-app-v2/dictionary2/v3_forgot_password/en/dictionary_55fae06a27e076f807e5a905ef7d7f4f.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-344c3a3b53453595563ab5c16778e882-e36c874c0f6d77ad-01
last-modified: Thu, 22 May 2025 14:06:33 GMT
etag: W/"3bb9d2b7d86ab36f93b8bad3586b177e"
cache-control: max-age=3600
content-encoding: gzip
expires: Thu, 22 May 2025 15:25:54 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 820
cache: HIT
x-cached-since: 2025-06-04T01:25:32+00:00
X-Firefox-Spdy: h2
POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
200 OK 23 B URL POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 40b178eeb81c6c3e2c17ebaac6ef8e63
f516b324382247aa2abaf061c3281db9ac03aa91
81cea6a667339895ce2265dab224ed2fb546acd644c598e9c51ec191af473326
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: application/json
X-Lang: en
X-Uuid: 09e86881-54a9-4423-97db-9c2c566eb491
Content-Length: 88
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
content-length: 23
x-dt: 285
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.125, wf-uht;dur=0.012
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/analytics-30df90a6.js
200 OK 7.8 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/analytics-30df90a6.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (7765), with no line terminators
Hash 50b21acde5f65a1d70ae90b09708b846
32883d9e038227f6a51a1a012d8ddcd611c28433
f651e26b34aa951fd3a6ee08ad76c6b9074d74605325f2c8e1ef0f300c86ead8
GET /main-static/947c84bd/desktop/default/analytics-30df90a6.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:23 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-bcdbf5ce29670f619658dc184ca182ff-0c8b2de412194ac1-01
last-modified: Tue, 03 Jun 2025 12:12:23 GMT
etag: W/"50b21acde5f65a1d70ae90b09708b846"
x-amz-meta-mtime: 1748952741.050299039
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:24:12 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47615
cache: HIT
x-cached-since: 2025-06-03T12:25:48+00:00
X-Firefox-Spdy: h2
POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
200 OK 23 B URL POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 9dbc73321b15864365dd1b82951cad9d
babe7f7711fe6d9ac25e91e6dfed937544d62c6e
2738c6da1ad53d62d2ac0df0bdda33cba9319c5182ff63023048ecf85dd8501b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: application/json
X-Lang: en
X-Uuid: 09e86881-54a9-4423-97db-9c2c566eb491
Content-Length: 48
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1920
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
content-length: 23
x-dt: 285
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.113, wf-uht;dur=0.013
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/Betting.Core-10632eb2.js
200 OK 2.1 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/Betting.Core-10632eb2.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (2072), with no line terminators
Hash 7e49515a3fe752de5d8440f8dbd8d45d
cc105b1b58f91d1e70b3fe21f63827f73512784b
f1d05d962eeb23ecc159e57bbc007e0d88ee5f460634b1d64a761f14cf914ca4
GET /main-static/947c84bd/desktop/default/Betting.Core-10632eb2.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-749fbf983a1a7ff42bbf6eb121c8b204-d47ce3ead348477b-01
last-modified: Tue, 03 Jun 2025 12:12:23 GMT
etag: W/"7e49515a3fe752de5d8440f8dbd8d45d"
x-amz-meta-mtime: 1748952741.046299027
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:24:01 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47619
cache: HIT
x-cached-since: 2025-06-03T12:25:33+00:00
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtag/destination?id=DC-14030178&cx=c>m=45He5630h2v9180563600za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964
200 OK 299 kB URL GET www.googletagmanager.com/gtag/destination?id=DC-14030178&cx=c>m=45He5630h2v9180563600za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint10:76:57:2F:C3:21:F2:5F:71:E4:85:A5:DB:F7:65:3F:51:03:55:07
ValidityMon, 12 May 2025 08:42:57 GMT - Mon, 04 Aug 2025 08:42:56 GMT
File type JavaScript source, ASCII text, with very long lines (6944)
Size 299 kB (299042 bytes)
Hash 7e294ea6ae0d27efb76300baf67b5c66
b58bb6aec906e31830932820ff1880de9ff119e7
d964aa1bdaf174117f118dbc21328adcff7046ffb7e70c8a0ce37de984096e1e
GET /gtag/destination?id=DC-14030178&cx=c>m=45He5630h2v9180563600za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 04 Jun 2025 01:39:23 GMT
expires: Wed, 04 Jun 2025 01:39:23 GMT
cache-control: private, max-age=900
last-modified: Wed, 04 Jun 2025 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcysghrgc:42:0
report-to: {"group":"ascgcysghrgc:42:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
server: Google Tag Manager
content-length: 105051
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET www.googletagmanager.com/gtag/destination?id=AW-16664555628&cx=c>m=45He5630h2v9180563600za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964
200 OK 344 kB URL GET www.googletagmanager.com/gtag/destination?id=AW-16664555628&cx=c>m=45He5630h2v9180563600za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint10:76:57:2F:C3:21:F2:5F:71:E4:85:A5:DB:F7:65:3F:51:03:55:07
ValidityMon, 12 May 2025 08:42:57 GMT - Mon, 04 Aug 2025 08:42:56 GMT
File type JavaScript source, ASCII text, with very long lines (6944)
Size 344 kB (344227 bytes)
Hash f321e19d74ee19c13ea84d1d1123b28d
daff87e5ecee23d609eb1b604ab2b0290e04af90
092858567d0502cb02d3255461ed9e0731912bd1d52978fedffad3d723c7e09a
GET /gtag/destination?id=AW-16664555628&cx=c>m=45He5630h2v9180563600za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 04 Jun 2025 01:39:23 GMT
expires: Wed, 04 Jun 2025 01:39:23 GMT
cache-control: private, max-age=900
last-modified: Wed, 04 Jun 2025 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcysghrgc:42:0
report-to: {"group":"ascgcysghrgc:42:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
server: Google Tag Manager
content-length: 118392
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2
200 OK 64 kB URL GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 63920, version 1.0
Hash a65527fcb58f66a7cfbc0e6b160538b4
45d260e7fa343401b5bb0df982a014f53e2d253b
fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45
GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: font/woff2
content-length: 63920
traceparent: 00-0ea9b202d16673cab3ec491c57f966aa-c274cc6d51880f99-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "a65527fcb58f66a7cfbc0e6b160538b4"
expires: Thu, 16 Jan 2025 10:45:34 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1950
cache: HIT
x-cached-since: 2025-06-04T01:06:41+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_reset_password/en/dictionary_612c6e919ca15d39cc751a619a3952c7.json
200 OK 765 B URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_reset_password/en/dictionary_612c6e919ca15d39cc751a619a3952c7.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 00f980f23f1b4c1ccee99ed49e0a8feb
4cb07094de9bffff1bf81d94446280b91013b660
bb3be3377fbb8e66a4b5a8a3866dfd865a37cb4a96482ab2f439981e03b57cea
GET /genfiles/web-app-v2/dictionary2/v3_reset_password/en/dictionary_612c6e919ca15d39cc751a619a3952c7.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
content-length: 765
traceparent: 00-a46d6c0572f0ab98889799c85e94e5a8-417571e6c745dbbd-01
last-modified: Wed, 11 Oct 2023 12:52:53 GMT
etag: "00f980f23f1b4c1ccee99ed49e0a8feb"
cache-control: max-age=3600
expires: Thu, 16 Jan 2025 10:53:47 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3100
cache: HIT
x-cached-since: 2025-06-04T00:47:32+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtm.js?id=GTM-KFGPRJ2V
200 OK 338 kB URL GET www.googletagmanager.com/gtm.js?id=GTM-KFGPRJ2V
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint10:76:57:2F:C3:21:F2:5F:71:E4:85:A5:DB:F7:65:3F:51:03:55:07
ValidityMon, 12 May 2025 08:42:57 GMT - Mon, 04 Aug 2025 08:42:56 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (4828)
Size 338 kB (338463 bytes)
Hash e18e64ec9de30c6b9cbc814f4d1a52de
adb800e4f5f0294efe153c67bcd1f68e0d871f09
ffa51009ae8f290180e253d004550adbd7ce0f1d4424699f6227eeb73fbbf484
GET /gtm.js?id=GTM-KFGPRJ2V HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 04 Jun 2025 01:39:23 GMT
expires: Wed, 04 Jun 2025 01:39:23 GMT
cache-control: private, max-age=900
last-modified: Wed, 04 Jun 2025 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1319:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1319:0
report-to: {"group":"ascgcycc:1319:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1319:0"}],}
server: Google Tag Manager
content-length: 117662
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
200 OK 790 kB URL GET 1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (22825)
Size 790 kB (790193 bytes)
Hash e071809984b55de161268aac251b558c
c1f9162bef3284e66ac92178afc1c7b0f8e9e414
9d919131b467b216f6d01840ac25b1e65c6fc91a7167bab83b77d8dd587c2e9b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:47 GMT
etag: W/"e071809984b55de161268aac251b558c"
x-amz-meta-mtime: 1748958578.368584667
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.015
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_game/en/dictionary_c475e7b28b6b22307751b2c2c28273a7.json
200 OK 23 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_game/en/dictionary_c475e7b28b6b22307751b2c2c28273a7.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 7889ae7db096d748d942dbf58bd893b6
e9fc563f031d510363a597702fd9c4ca070aa870
a5145ccfed8e62882a5e36ab1bacad3c6fd36f203bf8b37e0ec20298fe7df20c
GET /genfiles/web-app-v2/dictionary2/v3_game/en/dictionary_c475e7b28b6b22307751b2c2c28273a7.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-96407f6bd6087f718188f5bf203e85fd-16030d273370e8a9-01
last-modified: Tue, 03 Jun 2025 08:06:56 GMT
etag: W/"c08ec4640f6ba3d9b8a7363620465d67"
cache-control: max-age=3600
content-encoding: gzip
expires: Tue, 03 Jun 2025 09:40:13 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3114
cache: HIT
x-cached-since: 2025-06-04T00:47:18+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/commons/app-702216cd.js
200 OK 138 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/commons/app-702216cd.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65476)
Size 138 kB (138079 bytes)
Hash cf45700ae9f6a5dbf7c6e043aa9cf6f5
9e4409146aaa00a19029dc8ebe687c191c083583
89b47c2389b877a5095b2a4c3adb1213a282c5e8c5069a0f8e06494d7705b11c
GET /main-static/947c84bd/desktop/default/commons/app-702216cd.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-61d77ce8f1f09dc7a4d0434b50ddec34-3997394e3ec6495c-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"cf45700ae9f6a5dbf7c6e043aa9cf6f5"
x-amz-meta-mtime: 1748952741.0702991
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:57 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47624
cache: HIT
x-cached-since: 2025-06-03T12:25:27+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/site-admin/css_vars/29b5cda95fa390c124de39b6aeca6d24.css
200 OK 46 B URL GET v3.traincdn.com/genfiles/site-admin/css_vars/29b5cda95fa390c124de39b6aeca6d24.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 29b5cda95fa390c124de39b6aeca6d24
46f68f69533c1fdc737eb36e8e7af7672178e610
6021ec0aede22eadcb8401fe945d345202320437c7be01b157f0cb282ebe7c88
GET /genfiles/site-admin/css_vars/29b5cda95fa390c124de39b6aeca6d24.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/css
content-length: 46
traceparent: 00-7fc72328c3e4aa58793e9eb24cf3d23e-0d37bb63eadae190-01
last-modified: Thu, 20 Mar 2025 13:29:31 GMT
etag: "29b5cda95fa390c124de39b6aeca6d24"
cache-control: max-age=3600
expires: Thu, 20 Mar 2025 14:32:37 GMT
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 866
cache: HIT
x-cached-since: 2025-06-04T01:24:46+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/63937a8066.js
200 OK 1.2 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/63937a8066.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (833)
Hash e8c6a2f12cea1a1f02c689bc4c87e52a
2be2df37092e2114931a8bee4640a4c5617697fb
f960e91791da697c0877887e3efdd7076b0e09fe1ced131bb140315da0576eb2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/63937a8066.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"e8c6a2f12cea1a1f02c689bc4c87e52a"
x-amz-meta-mtime: 1748957395.671592023
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET 1xlite-376866.top/hd-api/external/01973897-c9dc-7cc5-92a4-67823f903c9d.js
200 OK 300 kB URL GET 1xlite-376866.top/hd-api/external/01973897-c9dc-7cc5-92a4-67823f903c9d.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 300 kB (299853 bytes)
Hash 56454826ebbfb842f4f78c2c992b79a5
f0ecde9accb5b7df000763648476840a1b526264
9d2d872b3422eb1a762034741be50c990110a71643844d42e588365014448c6c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hd-api/external/01973897-c9dc-7cc5-92a4-67823f903c9d.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374; SESSION=050e662002452791339b17b11e3ea7be
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:21 GMT
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=0, must-revalidate
content-encoding: gzip
vary: Accept-Encoding
x-dt: 285
x-hd-trace-id: 71719a3c-7c74-433b-93dc-abb2dc3ab119
x-request-guid: 0ea88aa18bd83da68d4a1d52d49ef97c
x-time-ng: 0.003
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.008, wf-uht;dur=0.022
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/site-admin/colors/36a2f2c752c18f6b2e7cecfbe7cf653a.css
200 OK 40 kB URL GET v3.traincdn.com/genfiles/site-admin/colors/36a2f2c752c18f6b2e7cecfbe7cf653a.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (39717), with no line terminators
Hash 36a2f2c752c18f6b2e7cecfbe7cf653a
e1a72a0f6f2baf41ec485ff2e498eaa94a0d6f26
0f5847c5df6c94b3469fb57a350a897df106a6dfaea008002c226a8b63f16db7
GET /genfiles/site-admin/colors/36a2f2c752c18f6b2e7cecfbe7cf653a.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/css
traceparent: 00-e98e29b8cfa737c1a9793079364544fb-61642c35df336c19-01
last-modified: Fri, 30 May 2025 09:26:06 GMT
etag: W/"36a2f2c752c18f6b2e7cecfbe7cf653a"
cache-control: max-age=3600
content-encoding: gzip
expires: Fri, 30 May 2025 11:40:20 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3204
cache: HIT
x-cached-since: 2025-06-04T00:45:48+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/DC-a2e556af.js
200 OK 2.7 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/DC-a2e556af.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (2653), with no line terminators
Hash 3df86389f1c4b065ad62accc502a9480
889cf2a121590160554296995b785aff89aabe04
532fffbd9cb8d3b26148e8180c5809b85d8d46c830fb3dbe0d7c09dda1f89de0
GET /main-static/947c84bd/desktop/default/DC-a2e556af.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-6a5fe9d632c1e7b56cf083a9a5135a08-f7892d4758472449-01
last-modified: Tue, 03 Jun 2025 12:12:23 GMT
etag: W/"3df86389f1c4b065ad62accc502a9480"
x-amz-meta-mtime: 1748952741.046299027
content-encoding: gzip
expires: Wed, 04 Jun 2025 16:23:10 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 33362
cache: HIT
x-cached-since: 2025-06-03T16:23:10+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2
200 OK 64 kB URL GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 63920, version 1.0
Hash a65527fcb58f66a7cfbc0e6b160538b4
45d260e7fa343401b5bb0df982a014f53e2d253b
fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45
GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:22 GMT
content-type: font/woff2
content-length: 63920
traceparent: 00-65c41bd5130b644db0147bcc53ec7ccf-e4098605df1e95dd-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "a65527fcb58f66a7cfbc0e6b160538b4"
expires: Thu, 16 Jan 2025 10:45:34 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1961
cache: HIT
x-cached-since: 2025-06-04T01:06:41+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
POST 1xlite-376866.top/hd-api/external/verify
200 OK 715 B URL POST 1xlite-376866.top/hd-api/external/verify
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 278c9b5b61f1a3fa6d68a1d0427adab9
f12f5f5a9b1bc6d723de57958356a3c18b618200
63c094d85fa087447813cef30626a243464a966c66bf6e636f054d52fc01cbbc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /hd-api/external/verify HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: text/plain;charset=UTF-8
Content-Length: 108833
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374; SESSION=050e662002452791339b17b11e3ea7be
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:23 GMT
content-type: application/json
content-length: 591
content-encoding: gzip
vary: Accept-Encoding
x-dt: 285
x-request-guid: d0acf72d6d6d41826b5545db003c1ade
x-time-ng: 0.007
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.006, wf-uht;dur=0.052
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/Page.Block-7d7b08d1.js
200 OK 476 B URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/Page.Block-7d7b08d1.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (476), with no line terminators
Hash ef137b2bd396a5a981afc77591c7b612
c987135b577d4513484b7ac5ca3f6c8aab3c684b
b3ddd11cd8bb86a1b2c85522660223090d290c97fa7e905febf345bb3d6a11c3
GET /main-static/947c84bd/desktop/default/Page.Block-7d7b08d1.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/javascript; charset=utf-8
content-length: 476
traceparent: 00-2845d9725a4dbdf344fcd0defd943dd5-90ce86fca61f9abc-01
last-modified: Tue, 03 Jun 2025 12:12:23 GMT
etag: "ef137b2bd396a5a981afc77591c7b612"
x-amz-meta-mtime: 1748952741.046299027
expires: Wed, 04 Jun 2025 12:24:03 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47280
cache: HIT
x-cached-since: 2025-06-03T12:31:11+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/checker/redirect/stat/run/
200 OK 48 B URL GET 1xlite-376866.top/checker/redirect/stat/run/
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 9888f7a224cc53454552a8c8eb10b19d
62e178608894924df151faab12f8ae662b12b970
70d6fbcf20c1f1becc6bce6fac3078156e200d22e15eea3aed2d8bdf187b457c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /checker/redirect/stat/run/ HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
content-type: application/json
x-requested-with: XMLHttpRequest
x-app-n: v3-nuxt2
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-time-ng: 0.001
content-encoding: br
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.013
X-Firefox-Spdy: h2
GET v3.traincdn.com/sys-ui/2.3.202/Desktop/Default/client.css
200 OK 618 kB URL GET v3.traincdn.com/sys-ui/2.3.202/Desktop/Default/client.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 618 kB (618214 bytes)
Hash 2cb78afc66b2f65938190f7d0b3924d8
78501302abb19a58fed4269f293ab57dd16be46f
31e21c3fe3b343dd1ec7ed4893ea46d0b742723b7752377bae21c86deb6bb6df
GET /sys-ui/2.3.202/Desktop/Default/client.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
traceparent: 00-29ce993ae84436a1c1e0c95860e93acb-77fb6d78c29c7259-01
last-modified: Tue, 13 May 2025 13:22:44 GMT
etag: W/"2cb78afc66b2f65938190f7d0b3924d8"
x-amz-meta-mtime: 1747142562.33508118
content-encoding: gzip
expires: Thu, 29 May 2025 09:04:38 GMT
cache-control: max-age=86400
x-time-ng: 0.003
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 59329
cache: HIT
x-cached-since: 2025-06-03T09:10:22+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/app-80bd2c89.js
200 OK 506 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/app-80bd2c89.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Size 506 kB (506107 bytes)
Hash 732c9ba0e4027deb1a583f7d4c05eaa5
af94870c80e5c0d05704dec1c32197e570cab015
939ffcd0008ba7ae3b6947e9eea002ac8a421cb2d6d04d08361764f02810bdb8
GET /main-static/947c84bd/desktop/default/app-80bd2c89.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-8f319d047bece91d7e6762e9095ff5fb-a0ef2c2d15e1fb60-01
last-modified: Tue, 03 Jun 2025 12:12:23 GMT
etag: W/"732c9ba0e4027deb1a583f7d4c05eaa5"
x-amz-meta-mtime: 1748952741.050299039
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:57 GMT
cache-control: max-age=86400
x-time-ng: 0.003
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47624
cache: HIT
x-cached-since: 2025-06-03T12:25:27+00:00
X-Firefox-Spdy: h2
POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
200 OK 23 B URL POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 1b36109492b5ec45cc69033cbde99a1f
ffac6187e590f6ec98a5690f5e15c399de45708f
ce55941bb945ef345b7adec4f244458af309c86cb8de932c29c3f96ab4cafc2e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: application/json
X-Lang: en
X-Uuid: 09e86881-54a9-4423-97db-9c2c566eb491
Content-Length: 72
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:14 GMT
content-type: application/json
content-length: 23
x-dt: 285
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.070, wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/plugins.v-tooltip-4e620d39.js
200 OK 77 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/plugins.v-tooltip-4e620d39.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65476)
Hash a5fdbd399fae9d438faf33dc74a667bc
c28bc9c7551e7c531ee37e189a0b94de59791481
aa1a21bf0fa073b5635353fdadd95f784c511905e9ebb36288673b2fae789e2f
GET /main-static/947c84bd/desktop/default/vendors/plugins.v-tooltip-4e620d39.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-fad8fa8065dae3d985858f21230908d3-d3fb8db1195159ca-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"a5fdbd399fae9d438faf33dc74a667bc"
x-amz-meta-mtime: 1748952741.086299148
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:58 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47622
cache: HIT
x-cached-since: 2025-06-03T12:25:30+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_express_day/en/dictionary_1971e4038469f37ec9a819d99d5b8f4a.json
200 OK 1.1 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_express_day/en/dictionary_1971e4038469f37ec9a819d99d5b8f4a.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash a3810b04fc93c6b4f295ceb812f9f212
6cff2c69f8e43259380952d6c0df7ba563b7da8d
c1afcca19f61498f21aab6c0ca6b1992f5c8b4baf281dfa14b780ed780035c54
GET /genfiles/web-app-v2/dictionary2/v3_express_day/en/dictionary_1971e4038469f37ec9a819d99d5b8f4a.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-6cb5f7462b3cdff17dc58d2a17c36bc6-df534d77c01dc072-01
last-modified: Fri, 09 May 2025 16:06:27 GMT
etag: W/"a3810b04fc93c6b4f295ceb812f9f212"
cache-control: max-age=3600
content-encoding: gzip
expires: Fri, 09 May 2025 17:11:01 GMT
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 397
cache: HIT
x-cached-since: 2025-06-04T01:32:35+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/web-api/session
204 No Content 0 B URL GET 1xlite-376866.top/web-api/session
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /web-api/session HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
content-type: application/json
x-requested-with: XMLHttpRequest
x-app-n: v3-nuxt2
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx
date: Wed, 04 Jun 2025 01:39:21 GMT
cache-control: no-cache, private
server-timing: dt_total;dur=0.049, p;dur=19.706, wf-uht;dur=0.031
set-cookie: ua=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
SESSION=050e662002452791339b17b11e3ea7be; path=/; secure; httponly; samesite=lax
x-dt: 285
x-time-ng: 0.021, 0.023
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2
GET 1xlite-376866.top/captcha-api/assets/hunt-captcha.js
200 OK 86 kB URL GET 1xlite-376866.top/captcha-api/assets/hunt-captcha.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Hash c2bf9372ca8248c91a0c3fd452a8e851
ff0a98fb9a52d8761c949442d96d6dbd576d3f13
1ad2c7e4c8a92e1af3811a4fd6bf3b17e832740456f6249e17579c9bbc9148e8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /captcha-api/assets/hunt-captcha.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374; SESSION=050e662002452791339b17b11e3ea7be
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:21 GMT
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=300
content-encoding: br
vary: Accept-Encoding
x-dt: 285
x-request-id: de61d4a08b9369f477be0c7224c1953f
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.006, wf-uht;dur=0.025
X-Firefox-Spdy: h2
GET refpagertsf.top/L?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration
303 See Other 269 kB URL User Request GET refpagertsf.top/L?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration
IP
ASN #202492 Silverhill Group Holding Ltd
Certificate IssuerLet's Encrypt
Subjectrefpagertsf.top
FingerprintC3:E3:9E:EA:4B:F3:18:1A:41:39:2A:93:94:40:0B:5C:16:38:E9:5B
ValidityMon, 14 Apr 2025 05:23:15 GMT - Sun, 13 Jul 2025 05:23:14 GMT
Size 269 kB (268926 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /L?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration HTTP/1.1
Host: refpagertsf.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 303 See Other
server: nginx
date: Wed, 04 Jun 2025 01:39:10 GMT
location: https://1xlite-376866.top:443/en/registration?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration
set-cookie: A_22811_v=0; expires=Thu, 05 Jun 2025 01:39:10 GMT; path=/; secure
A_22811_c=1; expires=Thu, 05 Jun 2025 01:39:10 GMT; path=/; secure
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/c0e02032d1.css
200 OK 11 kB URL GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/c0e02032d1.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (11072)
Hash 3d3e04f603cc58802ff96240abbdc3aa
e7e6a5d59c97236922354b40d288736f034a1ce3
611f7a963cd4aa278f1ba51f2401247df8c658929b76bfdce45bec08be83d7bd
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/c0e02032d1.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
traceparent: 00-b11dc6999d7d031a96cdb31d48ae4dfe-1d96ff77a2845a8f-01
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"3d3e04f603cc58802ff96240abbdc3aa"
x-amz-meta-mtime: 1748957395.671592023
content-encoding: gzip
expires: Wed, 04 Jun 2025 15:52:52 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 35179
cache: HIT
x-cached-since: 2025-06-03T15:52:52+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/plugins.vue-notification-5a6887aa.js
200 OK 13 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/plugins.vue-notification-5a6887aa.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (12563), with no line terminators
Hash 3a3c9476afd1bb77e959d5a9ba8fef46
fb3ec1b031b794f59ab22551474ae323c0ed1c45
99d6d17a0b928da90325d2e4e0b24476d14ac6aa1ea5e742851ac742ddc6e98b
GET /main-static/947c84bd/desktop/default/vendors/plugins.vue-notification-5a6887aa.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-1a557a2a4285734f736ca472fc26d5ce-d9d812ad1f8f371e-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"3a3c9476afd1bb77e959d5a9ba8fef46"
x-amz-meta-mtime: 1748952741.086299148
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:58 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47622
cache: HIT
x-cached-since: 2025-06-03T12:25:30+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/plugins.vue-js-modal-bb69fbba.js
200 OK 27 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/plugins.vue-js-modal-bb69fbba.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (26667), with no line terminators
Hash 95c7e2ba03a2cb96ea5c6fd758291944
59e50efaae4e75111f0515342f551040a643ff0e
a9afd30210e183815589556664dc2409819fbb51a111683f873b866704bd9bbd
GET /main-static/947c84bd/desktop/default/vendors/plugins.vue-js-modal-bb69fbba.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-5b443c3c68f754e19e86bbeef9e84b80-b3f498d8e726c3ff-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"95c7e2ba03a2cb96ea5c6fd758291944"
x-amz-meta-mtime: 1748952741.086299148
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:58 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47622
cache: HIT
x-cached-since: 2025-06-03T12:25:30+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/7f1d6bae6f.js
200 OK 2.4 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/7f1d6bae6f.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (2401)
Hash aeef5d0d5b0b15e2e1b54290e62a2932
306303db1c775a5747b2d4484824f95755c0f98a
dde563c7756b01db74f2fb9da8160faae9e9c6f8a50c97b56216827785fdacb4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/7f1d6bae6f.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"aeef5d0d5b0b15e2e1b54290e62a2932"
x-amz-meta-mtime: 1748957395.665591441
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:14 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.011
X-Firefox-Spdy: h2
POST www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&scrsrc=www.googletagmanager.com&frm=0&rnd=1210880381.1749001164&dt=1xBet&auid=1702276876.1749001164&navt=n&npa=1>m=45He5630h2v9180563600za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964&tft=1749001163647&tfd=13634&apve=1&apvf=sb
200 OK 0 B URL POST www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&scrsrc=www.googletagmanager.com&frm=0&rnd=1210880381.1749001164&dt=1xBet&auid=1702276876.1749001164&navt=n&npa=1>m=45He5630h2v9180563600za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964&tft=1749001163647&tfd=13634&apve=1&apvf=sb
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subjectwww.google.com
Fingerprint84:BD:0D:9A:51:CC:86:3E:E9:2F:6E:7C:2D:58:AC:4C:FB:B5:3D:8C
ValidityMon, 12 May 2025 08:44:44 GMT - Mon, 04 Aug 2025 08:44:43 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /ccm/collect?en=page_view&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&scrsrc=www.googletagmanager.com&frm=0&rnd=1210880381.1749001164&dt=1xBet&auid=1702276876.1749001164&navt=n&npa=1>m=45He5630h2v9180563600za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104611962~104611964&tft=1749001163647&tfd=13634&apve=1&apvf=sb HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
pragma: no-cache
date: Wed, 04 Jun 2025 01:39:24 GMT
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://1xlite-376866.top
access-control-expose-headers: date,vary,vary,vary,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/css/684d7545.css
200 OK 14 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/css/684d7545.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (14391), with no line terminators
Hash a552d5db890b7f16e370b33cc587e807
a9dc47737b3e1d8ef6fcbb48c7c0b026c6fda545
0d7e00204297499711ae1da574d4635b31d8238ab4a663b382c44d850d24f3ec
GET /main-static/947c84bd/desktop/default/css/684d7545.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
traceparent: 00-4e23a2aa18c721d8fb24cbfd50d12995-5da057e22793d5b3-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"a552d5db890b7f16e370b33cc587e807"
x-amz-meta-mtime: 1748952741.0702991
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:56 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47627
cache: HIT
x-cached-since: 2025-06-03T12:25:24+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_registration/en/dictionary_06978ba32c6c71db9594e888c1f3700c.json
200 OK 21 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_registration/en/dictionary_06978ba32c6c71db9594e888c1f3700c.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (20499), with no line terminators
Hash 700df338094f9c55621f79ac5ab099d9
c073afc789d75f0acad0076fee2c68983a1314ed
f7e4447956a8482ddd5977c7fe91cd4a2d02f4472705511f74460f0c873814c9
GET /genfiles/web-app-v2/dictionary2/v3_registration/en/dictionary_06978ba32c6c71db9594e888c1f3700c.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-2bd6d926729444338d22dad6b9a87a89-aadf8877576c1a4e-01
last-modified: Thu, 29 May 2025 16:06:54 GMT
etag: W/"ac9c95aa2fb0b6ad4419e9bc58f41ab5"
cache-control: max-age=3600
content-encoding: gzip
expires: Thu, 29 May 2025 17:40:10 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1992
cache: HIT
x-cached-since: 2025-06-04T01:06:00+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js
200 OK 19 kB URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (19034)
Hash 1580a3cfe81fd30910a49dfe64cc8e7b
314144dc49595482ba46c0b85b38d5f73ef73a7b
8989a021d20f0fc08c43966a287cbd99e43142a5a0ff42eb232756a101de6035
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:46 GMT
etag: W/"1580a3cfe81fd30910a49dfe64cc8e7b"
x-amz-meta-mtime: 1748958578.600592974
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.011
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-7JGWL9SV66&cid=743503844.1749001164>m=45je5621v897130004za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&z=1662720841
200 OK 42 B URL GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-7JGWL9SV66&cid=743503844.1749001164>m=45je5621v897130004za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&z=1662720841
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google.no
FingerprintF5:F3:C1:C0:97:D6:3B:FC:0B:FD:36:B3:3B:83:88:FF:EA:FE:D1:1E
ValidityMon, 12 May 2025 08:45:40 GMT - Mon, 04 Aug 2025 08:45:39 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-7JGWL9SV66&cid=743503844.1749001164>m=45je5621v897130004za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&z=1662720841 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 04 Jun 2025 01:39:24 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET 1xlite-376866.top/en/block
203 Non Authoritative 269 kB URL User Request GET 1xlite-376866.top/en/block
IP
ASN #202492 Silverhill Group Holding Ltd
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type HTML document, ASCII text, with very long lines (53844)
Size 269 kB (268926 bytes)
Hash a83ace28f5f0cc38eeb285746439e8ac
6193cd22e4f7326d4f4a8abe17b753fd4cf9711c
45a94dce47ff8f4c6f2e56457145cf4bc432e510be825dd3c58f8c946ce52d4b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /en/block HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 203 Non Authoritative
server: nginx
date: Wed, 04 Jun 2025 01:39:10 GMT
content-type: text/html; charset=utf-8
content-length: 268926
accept-ranges: none
server-timing: dt_total;dur=0.003, total;dur=71;desc="Nuxt Server Time"
set-cookie: gw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned
lng=en; Path=/
cookies_agree_type=3; Path=/
tzo=2; Path=/
is12h=0; Path=/
x-dt: 285
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js
200 OK 159 kB URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type ASCII text, with very long lines (65509)
Size 159 kB (158815 bytes)
Hash 1da464d70e78b04b9b808e82e4ad9487
0c79e65516d1525ecb43d13cfb4ccb0631095a28
b4c72b8036ca6767ab61490178f901538646f2aa1001cb042caa134174a41595
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:46 GMT
etag: W/"1da464d70e78b04b9b808e82e4ad9487"
x-amz-meta-mtime: 1748958578.599592938
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.015
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png
200 OK 653 B URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Hash e6f0766cbd95db33da44e7a9140648f2
5f196b1bfe8c3f92bd2ebcd67124e72e81ae6aaf
c0399d478788d5d483f104a2e8cb7c32f41cb40e9df0c22e831b2bfa2db63ec0
GET /genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: image/png
content-length: 653
traceparent: 00-35fa81c2546bb2214bf0f0eab9bdbb73-928e6da7048d90ec-01
last-modified: Wed, 26 Jun 2024 08:18:02 GMT
etag: "e6f0766cbd95db33da44e7a9140648f2"
expires: Thu, 16 Jan 2025 10:46:36 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:52+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json
200 OK 2 B URL POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash d751713988987e9331980363e24189ce
97d170e1550eee4afc0af065b78cda302a97674c
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: application/json
X-Lang: en
X-Uuid: 09e86881-54a9-4423-97db-9c2c566eb491
Content-Length: 19
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
content-length: 2
x-dt: 285
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.096, wf-uht;dur=0.011
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/5f12c0474a.js
200 OK 4.1 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/5f12c0474a.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (4047)
Hash 3a0238833de5836c5f71bfaddacf6f91
5ccf8b73bc35f925394099eb618e36c28e9d0c96
b0f7ce2ce233734ddb2fe574e4039f812e651a56f7f7eac361d6f04f92776f2f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/5f12c0474a.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"3a0238833de5836c5f71bfaddacf6f91"
x-amz-meta-mtime: 1748957395.664591344
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.009
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/css/d8126a35.css
200 OK 60 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/css/d8126a35.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (59621), with no line terminators
Hash 445b613da1bb58a172d32cbfb66316b7
78dde96ed8e16f5d20253ced07de3cadb4ce5f6f
0244ef09748c4a15ddeebf95cfb08ca5db5a7cf3fcfd6f0dbbd91b34a1ffb289
GET /main-static/947c84bd/desktop/default/css/d8126a35.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
traceparent: 00-9759d305fc7e28a713e51d12ba7932fa-fccadfae6ff1de73-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"445b613da1bb58a172d32cbfb66316b7"
x-amz-meta-mtime: 1748952741.074299112
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:57 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47626
cache: HIT
x-cached-since: 2025-06-03T12:25:25+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/runtime-d2116ea9.js
200 OK 19 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/runtime-d2116ea9.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (19374), with no line terminators
Hash 49158ff5d6bbe317144e956ba2df70f3
5c54774f3cbdf6b700cc5ee4a48a24f547ae664f
29dadb6cb273fd59fcf4d5bf854ff17ddbe252c0fa179ea6c3d7d73e4d42703a
GET /main-static/947c84bd/desktop/default/runtime-d2116ea9.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-1fd82d5680d7bd11c8810010897f925b-61e811544235bd06-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"49158ff5d6bbe317144e956ba2df70f3"
x-amz-meta-mtime: 1748952741.082299136
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:57 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47625
cache: HIT
x-cached-since: 2025-06-03T12:25:26+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/43320226e0.js
200 OK 27 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/43320226e0.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (27023)
Hash 94550587990c4e510f7a62601f68f227
ae3328a0fb2f627fbf8ef401e972fd547abb2cec
b9beac1e38d6b752c90112594751e7a2587ed521a62576635edb2b33d6074ca4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/43320226e0.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"94550587990c4e510f7a62601f68f227"
x-amz-meta-mtime: 1748957395.661591053
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.008
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js
200 OK 865 B URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (840)
Hash 0af3fe0c072a5bb3b6c731767187982f
55db5afb57265dc92fd121fe9ae565ffb2f53b2c
655bbe85da91e863401c6f96e24b41f5c2fe51a4245cecc2deb2b8c9600fef30
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
content-length: 865
last-modified: Tue, 03 Jun 2025 13:54:45 GMT
etag: "0af3fe0c072a5bb3b6c731767187982f"
x-amz-meta-mtime: 1748958578.598592902
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
accept-ranges: bytes
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/5a42a2416f.js
200 OK 1.2 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/5a42a2416f.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (1165)
Hash 7fea12865e9461b54b154073fabe2445
6d00cee95d843ce881376b8156669a13209386e4
d3df4a62bdbc16af865011d44db32f27c8d1de9e8d4a90319789083959e792f8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/5a42a2416f.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"7fea12865e9461b54b154073fabe2445"
x-amz-meta-mtime: 1748957395.665591441
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2
200 OK 64 kB URL GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 63748, version 1.0
Hash 6887b6f24414dbc612dbf42ccdc76b70
8068d3abfbc6cbf35b55919da45b1f4d2d136238
fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c
GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: font/woff2
content-length: 63748
traceparent: 00-9d3a9e4fb76341d61c9a5578b837a4dc-d76e9bf9920ba4aa-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "6887b6f24414dbc612dbf42ccdc76b70"
expires: Thu, 16 Jan 2025 10:32:14 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 342
cache: HIT
x-cached-since: 2025-06-04T01:33:29+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/2b97aa7ece.js
200 OK 864 B URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/2b97aa7ece.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (863)
Hash 731c91a48eab2d0cf70dbace67e93976
35fe67c7f270405735c3002fdfa147494e93d786
3f76e3dfd863a6201a43412c9865773a516e71e0b9c1270161bb87a295e08946
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/2b97aa7ece.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:14 GMT
content-type: text/javascript; charset=utf-8
content-length: 864
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: "731c91a48eab2d0cf70dbace67e93976"
x-amz-meta-mtime: 1748957395.671592023
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
accept-ranges: bytes
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.014
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/56f58c6d078ff0e8f698576f33bb478d.json
200 OK 3.6 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/56f58c6d078ff0e8f698576f33bb478d.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 4b08975411699bcd7464f49777e866bf
2a9b0a0f3eadf5f3e1ef688bacd9560dd59c73d2
b6208d18413f8988db2e0040ff72516c0cb5e06d3d9692b5b098808ab46fc378
GET /genfiles/cms/1-285/desktop/media_asset/56f58c6d078ff0e8f698576f33bb478d.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
traceparent: 00-2c3b3db252091721e89157135d55234e-dcc629f88363c558-01
last-modified: Thu, 27 Feb 2025 09:06:12 GMT
etag: W/"4b08975411699bcd7464f49777e866bf"
content-encoding: gzip
expires: Thu, 27 Feb 2025 10:17:14 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/78215d6bcc.js
200 OK 2.0 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/78215d6bcc.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (1967)
Hash b593428c893df62602de33b295628c35
8cedd8f2c28059581ef0624713a8e04dc9d52953
f1f1f2010dde1a27691901a16dc535d10c24c2b633393c4e1d3c173af117e152
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/78215d6bcc.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"b593428c893df62602de33b295628c35"
x-amz-meta-mtime: 1748957395.665591441
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.012
X-Firefox-Spdy: h2
GET 1xlite-376866.top/main-static/947c84bd/check-ob.js
200 OK 219 B URL GET 1xlite-376866.top/main-static/947c84bd/check-ob.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text
Hash c065700c9c8c493403359e1f2baa10d9
4630fe729e70bdf63fa7ba6c84ec277fd1f51030
1e61f0c82ae82ffcf503fcd4b4c8ae27b32c11e19b882d5d13f3c44364c893f4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /main-static/947c84bd/check-ob.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/javascript; charset=utf-8
content-length: 219
last-modified: Tue, 03 Jun 2025 12:13:29 GMT
etag: "c065700c9c8c493403359e1f2baa10d9"
x-amz-meta-mtime: 1748952808.338502286
expires: Thu, 05 Jun 2025 01:39:11 GMT
cache-control: max-age=86400
x-time-ng: 0.000
accept-ranges: bytes
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.009
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js
200 OK 21 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (20628)
Hash e98587d7f0e87ddb1c14109e11bcaf6c
73614df1bfaace32f60e177269be8aa2e66cc5f2
eb2e63442142d4911f42925b84270df0223ec8fe25a9c33007c5a43914822c22
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"e98587d7f0e87ddb1c14109e11bcaf6c"
x-amz-meta-mtime: 1748957395.670591926
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.007
X-Firefox-Spdy: h2
POST region1.analytics.google.com/g/collect?v=2&tid=G-7JGWL9SV66>m=45je5621v897130004za200&_p=1749001163067&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&cid=743503844.1749001164&ecid=84376460&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1749001163&sct=1&seg=0&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&dt=1xBet&_tu=Kg&en=scroll&ep.optimize_id=GTM-5R4MT54&epn.percent_scrolled=90&tfd=18695
204 No Content 0 B URL POST region1.analytics.google.com/g/collect?v=2&tid=G-7JGWL9SV66>m=45je5621v897130004za200&_p=1749001163067&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&cid=743503844.1749001164&ecid=84376460&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1749001163&sct=1&seg=0&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&dt=1xBet&_tu=Kg&en=scroll&ep.optimize_id=GTM-5R4MT54&epn.percent_scrolled=90&tfd=18695
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint10:76:57:2F:C3:21:F2:5F:71:E4:85:A5:DB:F7:65:3F:51:03:55:07
ValidityMon, 12 May 2025 08:42:57 GMT - Mon, 04 Aug 2025 08:42:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-7JGWL9SV66>m=45je5621v897130004za200&_p=1749001163067&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&cid=743503844.1749001164&ecid=84376460&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1749001163&sct=1&seg=0&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&dt=1xBet&_tu=Kg&en=scroll&ep.optimize_id=GTM-5R4MT54&epn.percent_scrolled=90&tfd=18695 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/3 204 No Content
access-control-allow-origin: https://1xlite-376866.top
date: Wed, 04 Jun 2025 01:39:28 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:158:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:158:0
report-to: {"group":"ascnsrsggc:158:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:158:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/6293f1a8ca.css
200 OK 650 B URL GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/6293f1a8ca.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (649)
Hash 5d70ac7829c3ae41ce5c0971c798fbcf
9996ce3a09f56d3e37d67fbe7e1efb301ea2f261
0e76b1cd191bd618caea37cb7fb6673d12c7cdff7ea47e939758eda5764a140b
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/6293f1a8ca.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
content-length: 650
traceparent: 00-20c001adf3a6c1430cef0647310fda87-0f57107c379b1d4e-01
last-modified: Wed, 28 May 2025 14:11:09 GMT
etag: "5d70ac7829c3ae41ce5c0971c798fbcf"
x-amz-meta-mtime: 1748441000.561795126
expires: Fri, 30 May 2025 08:42:21 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 60646
cache: HIT
x-cached-since: 2025-06-03T08:48:25+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json
200 OK 2 B URL POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash d751713988987e9331980363e24189ce
97d170e1550eee4afc0af065b78cda302a97674c
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: application/json
X-Lang: en
X-Uuid: 09e86881-54a9-4423-97db-9c2c566eb491
Content-Length: 19
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:14 GMT
content-type: application/json
content-length: 2
x-dt: 285
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.005, wf-uht;dur=0.015
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_block_pages/en/dictionary_bc0570f08a28537dc724f4764ecf77e4.json
200 OK 2.3 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_block_pages/en/dictionary_bc0570f08a28537dc724f4764ecf77e4.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 7c12ae6fc08684f50822b3eb56779e29
036c726b8b7b2d24f987391101f3e8d1a2a183cf
a2eac45353675c82733192916712b8876c6b038b7bdbddc24df464e38b67cbfd
GET /genfiles/web-app-v2/dictionary2/v3_block_pages/en/dictionary_bc0570f08a28537dc724f4764ecf77e4.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json; charset=utf-8
traceparent: 00-0d432836582e6028df0da12e92c81502-7e86405c35f464a8-01
last-modified: Tue, 22 Apr 2025 08:06:29 GMT
etag: W/"7c12ae6fc08684f50822b3eb56779e29"
cache-control: max-age=3600
content-encoding: gzip
expires: Tue, 22 Apr 2025 09:26:34 GMT
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 2084
cache: HIT
x-cached-since: 2025-06-04T01:04:29+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/e3dd2d416ede1d7659584842878349f6.json
200 OK 1.1 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/e3dd2d416ede1d7659584842878349f6.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 338264fc869e8f0b86b0d6c9d92102b0
83b4d35816df0e1486b766251e74d23f28b77824
015355a44429f40dd63b566dd1e9b1b76af3dfa28dcd25a43e82820ba0847b8d
GET /genfiles/cms/1-285/desktop/media_asset/e3dd2d416ede1d7659584842878349f6.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
traceparent: 00-06aee1b28b2cb45dbf5f5184f8ecd70d-f57188c5eec43c79-01
last-modified: Thu, 16 May 2024 19:05:13 GMT
etag: W/"338264fc869e8f0b86b0d6c9d92102b0"
content-encoding: gzip
expires: Thu, 16 Jan 2025 11:19:55 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
X-Firefox-Spdy: h2
GET radar.cedexis.com/1/23802/radar.js
302 Moved Temporarily 390 B URL GET radar.cedexis.com/1/23802/radar.js
IP
ASN #63911 NetActuate, Inc
Requested by https://1xlite-376866.top/en/block
Certificate IssuerDigiCert Inc
Subjectradar.cedexis.com
FingerprintA2:3E:30:19:D5:41:3A:11:81:58:E3:B1:6F:F4:D2:78:0B:44:6F:D0
ValidityFri, 07 Mar 2025 00:00:00 GMT - Fri, 06 Mar 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /1/23802/radar.js HTTP/1.1
Host: radar.cedexis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Wed, 04 Jun 2025 01:39:23 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: /1707728419/stub.js
Expires: Wed, 04 Jun 2025 01:49:23 GMT
Cache-Control: max-age=600
Vary: User-Agent,DNT
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_coupon/en/dictionary_324b382cf3eb2e42c30ac00d94604b8b.json
200 OK 26 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_coupon/en/dictionary_324b382cf3eb2e42c30ac00d94604b8b.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 8e9955c3e02bd18c59759c6f6c13ea7f
95cae350c14ff63afa5ede429e541e7de7a9d5be
b93e196833fdadcc27f45c6301e1bf15f689691a4bcf5fd1cbfbbb5cc79840d4
GET /genfiles/web-app-v2/dictionary2/v3_coupon/en/dictionary_324b382cf3eb2e42c30ac00d94604b8b.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-a0c2cb5c290fd119c7b1629bbf1b2210-568fe8099a2dd1e1-01
last-modified: Tue, 03 Jun 2025 16:07:03 GMT
etag: W/"8e9955c3e02bd18c59759c6f6c13ea7f"
cache-control: max-age=3600
content-encoding: gzip
expires: Tue, 03 Jun 2025 17:40:10 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3367
cache: HIT
x-cached-since: 2025-06-04T00:43:05+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_chunk_7HDOEZTP.js
200 OK 1.2 kB URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_chunk_7HDOEZTP.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (1193)
Hash 7e76c08e7f16815131a5f13a10c1efba
5f800877b78a0713157fe119bc1a2d9a260f72e1
c6f29a0c7c3ed884ccffd7a529fd2fc599e2da1f31af658146f0e36a3f4c00dc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_chunk_7HDOEZTP.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:45 GMT
etag: W/"7e76c08e7f16815131a5f13a10c1efba"
x-amz-meta-mtime: 1748958578.597592867
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.009
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png
200 OK 5.2 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type PNG image data, 514 x 514, 8-bit colormap, non-interlaced
Hash b9a636eef54b2844b571fe7de49184a7
bf653690790ced40eb3189da075a275d951d1607
001bfcdd52b658d46543a1aec889d35b73b3909b47097cc011b95e96fc9e3743
GET /genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: image/png
content-length: 5202
traceparent: 00-5bf7d695fad9711a4e5bc9caf57c3454-81a5607567963c35-01
last-modified: Wed, 26 Jun 2024 08:22:59 GMT
etag: "b9a636eef54b2844b571fe7de49184a7"
expires: Thu, 16 Jan 2025 11:18:57 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
cache: REVALIDATED
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_popper_js_E2H7ZPXQ.js
200 OK 21 kB URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_popper_js_E2H7ZPXQ.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (21232)
Hash 3cf0cae38afae9add22f7884e5061231
2a41037501375a439385a76a047876619683418f
322482e3beae5a985d069beea981614510fda90a5df7295b776a324d461fc43d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_popper_js_E2H7ZPXQ.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:45 GMT
etag: W/"3cf0cae38afae9add22f7884e5061231"
x-amz-meta-mtime: 1748958578.604593117
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.012
X-Firefox-Spdy: h2
GET 1xlite-376866.top/bff-api/config/group/get?groups=d.technical&lang=en
200 OK 730 B URL GET 1xlite-376866.top/bff-api/config/group/get?groups=d.technical&lang=en
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 87ec2701f4efb3b20790e1a967af79be
8c7a33e8de1fadc580287953380b136d261c27f5
add58098a30e646183c0c004afd7cdb345b576ed641263c6b19ab40c18d75395
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /bff-api/config/group/get?groups=d.technical&lang=en HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
content-type: application/json
x-requested-with: XMLHttpRequest
is-srv: false
x-svc-source: __TECHNICAL_PAGES_APP__
x-app-n: __TECHNICAL_PAGES_APP__
x-geoip2-country-code: ru
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1920; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
content-length: 730
cache-control: no-cache, private
server-timing: dt_total;dur=0.105, bff;dur=6.44, wf-uht;dur=0.015
x-dt: 285
x-pod: R-f8crr
x-time-ng: 0.007
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_39432cd041170aba155fae0f6911d2be.json
200 OK 138 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_39432cd041170aba155fae0f6911d2be.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Size 138 kB (137499 bytes)
Hash a3e08348517bb635e6ea5fe297cb7379
3bdef8205cd435cc9df5340344bd0c3d5951da53
48266f88d3bda931b1bb3c1607d77661227096d8ca99f755e59eb0b6aa8b0899
GET /genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_39432cd041170aba155fae0f6911d2be.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-164da0dbfdedd7166b631bbfcfcfc8bc-e2abacd72a2c3c0c-01
last-modified: Tue, 03 Jun 2025 14:07:10 GMT
etag: W/"a3e08348517bb635e6ea5fe297cb7379"
cache-control: max-age=3600
content-encoding: gzip
expires: Tue, 03 Jun 2025 15:40:12 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3209
cache: HIT
x-cached-since: 2025-06-04T00:45:43+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/46fe3f96f4140750e81ded48911f3e30.json
200 OK 747 B URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/46fe3f96f4140750e81ded48911f3e30.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash f4e90636ec9cff061c4301b3cefdd0d6
c506efe9c3672c58434ea10021dab0ad81b1ad98
30666f138ccc12735e2f8a6405ddce4a3d8756b9445e3b2732fa2970f14dbcea
GET /genfiles/cms/1-285/desktop/media_asset/46fe3f96f4140750e81ded48911f3e30.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
content-length: 747
traceparent: 00-5883f4683a3c173195fc5d6065d31f00-9183143ad70a23d5-01
last-modified: Thu, 27 Feb 2025 13:26:35 GMT
etag: "f4e90636ec9cff061c4301b3cefdd0d6"
expires: Thu, 27 Feb 2025 15:00:05 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 332
cache: HIT
x-cached-since: 2025-06-04T01:33:40+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/$_$.js
200 OK 69 B URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/$_$.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type ASCII text, with no line terminators
Hash 2cdaa92927f02e0b628f1ef4d7dd8caf
9104a2e16ed080b80a42588b8aeb52ebec47ab7a
ef8101ffea52addcdcfcc3a83f96ff2d4613fb3ae6d1c16bbe4852387b73a9db
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/$_$.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/entry-2be23b5382.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
content-length: 69
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: "2cdaa92927f02e0b628f1ef4d7dd8caf"
x-amz-meta-mtime: 1748957395.660590956
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
accept-ranges: bytes
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.007
X-Firefox-Spdy: h2
GET v3.traincdn.com/sys-ui/3.3.236/Desktop/Default/merged.css
200 OK 891 kB URL GET v3.traincdn.com/sys-ui/3.3.236/Desktop/Default/merged.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 891 kB (890658 bytes)
Hash 5f4ddc27cb70c1fb9e1d40a26092316c
6c7d6901d91abad11f0a6e9f409c9568e07a1cdb
03fe76f51be20f7758b3a18effd1f4b5673f6bf57656a15a77f294fe1ad81561
GET /sys-ui/3.3.236/Desktop/Default/merged.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/css; charset=utf-8
traceparent: 00-7f8a524810afe350bdfc47296d440d38-e36f5abdb5983f95-01
last-modified: Tue, 03 Jun 2025 12:05:27 GMT
etag: W/"5f4ddc27cb70c1fb9e1d40a26092316c"
x-amz-meta-mtime: 1748952288.424535122
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:10:11 GMT
cache-control: max-age=86400
x-time-ng: 0.003
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 48508
cache: HIT
x-cached-since: 2025-06-03T12:10:43+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_auth/en/dictionary_bf18bbe18492cb139a03dd4aa77ab605.json
200 OK 9.5 kB URL GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_auth/en/dictionary_bf18bbe18492cb139a03dd4aa77ab605.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 28e341b9d1e7057f039843b7b74e6fd9
037a0bc8cadc71077966a0488da7a796bed224b0
af95ed317c9d400ddba1996caccaf7b0fcec2b9af1c04d12bd19752a9a773412
GET /genfiles/web-app-v2/dictionary2/v3_auth/en/dictionary_bf18bbe18492cb139a03dd4aa77ab605.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json; charset=utf-8
traceparent: 00-b20e22413e1ab11f9d82047c1224956e-6666226f1c430471-01
last-modified: Thu, 22 May 2025 14:06:33 GMT
etag: W/"28e341b9d1e7057f039843b7b74e6fd9"
cache-control: max-age=3600
content-encoding: gzip
expires: Thu, 22 May 2025 15:38:17 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1027
cache: HIT
x-cached-since: 2025-06-04T01:22:05+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/60608cbba85ee2e8946c25b55281a0bc.json
200 OK 328 B URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/60608cbba85ee2e8946c25b55281a0bc.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 4347fc050ebe622e30a7bf78a213b5a0
c05b3b571980b01ff9f07e6adc1c29c58be70bd1
ed1b1193a248bf273141c31b7f74dd1224416b3757e5a71f2e7d579c50d65d57
GET /genfiles/cms/1-285/desktop/media_asset/60608cbba85ee2e8946c25b55281a0bc.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
content-length: 328
traceparent: 00-2d68b8154e7c0fb643bba2960efdfb7d-f5c5bdcaa45157e3-01
last-modified: Thu, 27 Feb 2025 10:51:50 GMT
etag: "4347fc050ebe622e30a7bf78a213b5a0"
expires: Thu, 27 Feb 2025 12:17:56 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/593f1a6d4223015f3145bf447897f4f2.json
200 OK 241 B URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/593f1a6d4223015f3145bf447897f4f2.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 39257fbb62736206d5245e08925d7b60
4c11e3cb6a16b884772b88acdba30a2ad98e86b8
3a3cf0f5c60899ffb49d9825516aec475fd7b78cea8ae0b5b58dfb4e658f041e
GET /genfiles/cms/1-285/desktop/media_asset/593f1a6d4223015f3145bf447897f4f2.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
content-length: 241
traceparent: 00-eea524f871bfe4d9d4a0b0ff8096516c-361d49d099204fb6-01
last-modified: Thu, 27 Feb 2025 13:24:25 GMT
etag: "39257fbb62736206d5245e08925d7b60"
expires: Thu, 27 Feb 2025 14:48:35 GMT
cache-control: max-age=3600
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
200 OK 23 B URL POST 1xlite-376866.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash baf5f1a0e931e68fbeddbe5cc00b6711
d372185768bd49696ff2aa31e734c5e7609f77ff
c006c319a130b8a825bca6cab3cc15cb02b06b72db78c8af24a03611790fcd5b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
Content-Type: application/json
X-Lang: en
X-Uuid: 09e86881-54a9-4423-97db-9c2c566eb491
Content-Length: 109
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374; SESSION=050e662002452791339b17b11e3ea7be; _ga_7JGWL9SV66=GS2.1.s1749001163$o1$g0$t1749001163$j60$l0$h84376460; _ga=GA1.1.743503844.1749001164; _gcl_au=1.1.1702276876.1749001164
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:24 GMT
content-type: application/json
content-length: 23
x-dt: 285
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.066, wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/app-c2ed2f61.js
200 OK 1.4 MB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/vendors/app-c2ed2f61.js
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (63557)
Size 1.4 MB (1387734 bytes)
Hash fec6908b07b32171d123c9f33efcd212
138f5ebc390c2bbd93dcda9099897c1ff5e9518a
eea941b001acd4c3190a0dff5826d46728537c28232a6c6fcea6652431777a46
GET /main-static/947c84bd/desktop/default/vendors/app-c2ed2f61.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-23821e77f03e1f4dad5d6d3e0f1e0834-3632af3d65b114a1-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"fec6908b07b32171d123c9f33efcd212"
x-amz-meta-mtime: 1748952741.082299136
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:57 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47624
cache: HIT
x-cached-since: 2025-06-03T12:25:27+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/seo-module-api/api/public/v1/analytics-counters?project[id]=285&domain[host]=1xlite-376866.top
200 OK 105 B URL GET 1xlite-376866.top/seo-module-api/api/public/v1/analytics-counters?project[id]=285&domain[host]=1xlite-376866.top
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash 6abfe5f6641fddde82c2ca29cf5c6a7a
958379bc84073d266358a27b3cf86b15484f5f6d
ede01772dfd8da2cc82f245e454ce360b2ceb13b7d1c330bbc1d68fe41255c19
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /seo-module-api/api/public/v1/analytics-counters?project[id]=285&domain[host]=1xlite-376866.top HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/en/block
content-type: application/json
x-requested-with: XMLHttpRequest
x-app-n: v3-nuxt2
DNT: 1
Connection: keep-alive
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1920
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
content-length: 107
cache-control: max-age=1200, must-revalidate, public, s-maxage=1800, stale-if-error=86400, stale-while-revalidate=300
x-content-digest: en6d0e5d6e0146a49c358c0eaad1d2ef38
age: 333
x-request-id: 4076294b3715e9028f631eac8b7e39c0
x-request-guid: 4076294b3715e9028f631eac8b7e39c0
content-encoding: br
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: p;dur=1.3799667358398, wf-uht;dur=0.011
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/bfa3e9fd30e7d63c0906602f42c13468.json
200 OK 182 B URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/bfa3e9fd30e7d63c0906602f42c13468.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 0a64a07e9a34e8a5b5e97e80a10888c5
82545cbc39b7dcc031dd10dea841a0b3698243d6
7201497e7e8cdf9d35bf6998e43dcde5feea535f9828ce3ee98785781016126c
GET /genfiles/cms/1-285/desktop/media_asset/bfa3e9fd30e7d63c0906602f42c13468.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
content-length: 182
traceparent: 00-1365a90eb361c3103d45ca85f213bebd-d51b45d1e9e99d93-01
last-modified: Thu, 27 Feb 2025 08:55:26 GMT
etag: "0a64a07e9a34e8a5b5e97e80a10888c5"
expires: Thu, 27 Feb 2025 10:17:13 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 332
cache: HIT
x-cached-since: 2025-06-04T01:33:40+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js
200 OK 1.3 kB URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (1265)
Hash e3f1c4089db6b910890e85d97a2e2066
85828920da3c3fd7856acde184e835ac314295cd
6c28afe5a52e0f9b1138fe498b254c8671058a058b555651ccae8e91e7534614
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:45 GMT
etag: W/"e3f1c4089db6b910890e85d97a2e2066"
x-amz-meta-mtime: 1748958578.597592867
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.012
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/fc03516ae4c718991727836d377493ff.json
200 OK 13 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/fc03516ae4c718991727836d377493ff.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 2b474bcc2f009b70e64e2b5a95dd50a4
1fd5ee2d54da7dfbf61e67efd938a89c548fc866
f86d880575f3f65ddaaf9e8a0e3746bbbefcefe7e6c0c4441e9e20ceffdca237
GET /genfiles/cms/1-285/desktop/media_asset/fc03516ae4c718991727836d377493ff.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
traceparent: 00-dc1f7b7f8f3da6c8e6ff0e65a3b030d0-0834839b1bbf7f47-01
last-modified: Wed, 12 Mar 2025 09:35:22 GMT
etag: W/"2b474bcc2f009b70e64e2b5a95dd50a4"
content-encoding: gzip
expires: Wed, 12 Mar 2025 11:03:31 GMT
cache-control: max-age=3600
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtag/js?id=G-7JGWL9SV66
200 OK 472 kB URL GET www.googletagmanager.com/gtag/js?id=G-7JGWL9SV66
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint10:76:57:2F:C3:21:F2:5F:71:E4:85:A5:DB:F7:65:3F:51:03:55:07
ValidityMon, 12 May 2025 08:42:57 GMT - Mon, 04 Aug 2025 08:42:56 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (12571)
Size 472 kB (472400 bytes)
Hash 48bc9ba833b548f20cc4e7e3f991af50
a63ce6bcb89d226b827286f9706aba79eff6dcb8
1901e1d038e17d673131b952b3473ccc88d5fad5dc896260c98b636e894b4acd
GET /gtag/js?id=G-7JGWL9SV66 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 04 Jun 2025 01:39:23 GMT
expires: Wed, 04 Jun 2025 01:39:23 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
server: Google Tag Manager
content-length: 150407
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
POST region1.analytics.google.com/g/collect?v=2&tid=G-7JGWL9SV66>m=45je5621v897130004za200&_p=1749001163067&em=tv.1~em.ODS1igyfeIhzOTHENqwIfH1sb8t0oxg8FT6iY2YCmeo&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&cid=743503844.1749001164&ecid=84376460&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1749001163&sct=1&seg=0&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&dt=1xBet&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.optimize_id=GTM-5R4MT54&upn.ref_id=1&tfd=13652
204 No Content 0 B URL POST region1.analytics.google.com/g/collect?v=2&tid=G-7JGWL9SV66>m=45je5621v897130004za200&_p=1749001163067&em=tv.1~em.ODS1igyfeIhzOTHENqwIfH1sb8t0oxg8FT6iY2YCmeo&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&cid=743503844.1749001164&ecid=84376460&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1749001163&sct=1&seg=0&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&dt=1xBet&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.optimize_id=GTM-5R4MT54&upn.ref_id=1&tfd=13652
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint10:76:57:2F:C3:21:F2:5F:71:E4:85:A5:DB:F7:65:3F:51:03:55:07
ValidityMon, 12 May 2025 08:42:57 GMT - Mon, 04 Aug 2025 08:42:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-7JGWL9SV66>m=45je5621v897130004za200&_p=1749001163067&em=tv.1~em.ODS1igyfeIhzOTHENqwIfH1sb8t0oxg8FT6iY2YCmeo&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964&cid=743503844.1749001164&ecid=84376460&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1749001163&sct=1&seg=0&dl=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock&dt=1xBet&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.optimize_id=GTM-5R4MT54&upn.ref_id=1&tfd=13652 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://1xlite-376866.top
date: Wed, 04 Jun 2025 01:39:23 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:158:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:158:0
report-to: {"group":"ascnsrsggc:158:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:158:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET v3.traincdn.com/version.json
200 OK 11 B URL GET v3.traincdn.com/version.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 93849be135bf788d6c6ae7ea6f6e7058
2e0aecc8281661ebac272998853819a3f66757cb
697e0eb3e88520be2029d3a255773f6aa829448db0532bfa7bb342447a38745b
GET /version.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:11 GMT
content-type: application/json
content-length: 11
traceparent: 00-93a05d3c0d940fca0e6df3c842bb6df5-9aa5b6242a623008-01
last-modified: Tue, 03 Jun 2025 12:25:07 GMT
etag: "93849be135bf788d6c6ae7ea6f6e7058"
x-amz-meta-mtime: 1748953507.706991947
expires: Tue, 03 Jun 2025 12:27:55 GMT
cache-control: max-age=60
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 33
cache: HIT
x-cached-since: 2025-06-04T01:38:38+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/ac02f639a86763a884adc5615fe65e72.json
200 OK 14 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/ac02f639a86763a884adc5615fe65e72.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 811ce3b7877d19901e45430cb6523d62
16a905115a678fdef3923f91c6f76cbab613e84d
10fbb74dbac63abfe9c4f5a77abc03757ef3527a479d4ae70dc977b515eec8cb
GET /genfiles/cms/1-285/desktop/media_asset/ac02f639a86763a884adc5615fe65e72.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
traceparent: 00-5b4b7f158f69c59a119b5edf5b0b7660-6ac26275e5b464d1-01
last-modified: Thu, 27 Feb 2025 09:04:01 GMT
etag: W/"811ce3b7877d19901e45430cb6523d62"
content-encoding: gzip
expires: Thu, 27 Feb 2025 10:17:13 GMT
cache-control: max-age=3600
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 332
cache: HIT
x-cached-since: 2025-06-04T01:33:40+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/6293f1a8ca.css
200 OK 650 B URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/6293f1a8ca.css
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type ASCII text, with very long lines (649)
Hash 5d70ac7829c3ae41ce5c0971c798fbcf
9996ce3a09f56d3e37d67fbe7e1efb301ea2f261
0e76b1cd191bd618caea37cb7fb6673d12c7cdff7ea47e939758eda5764a140b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/6293f1a8ca.css HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/css; charset=utf-8
content-length: 650
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: "5d70ac7829c3ae41ce5c0971c798fbcf"
x-amz-meta-mtime: 1748957395.664591344
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
accept-ranges: bytes
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.010
X-Firefox-Spdy: h2
GET 1xlite-376866.top/hd-api/external/assets/hdf.js
200 OK 4.1 kB URL GET 1xlite-376866.top/hd-api/external/assets/hdf.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type C++ source, ASCII text, with very long lines (874)
Hash bc393aaba413190373c1820a0c44fa84
9dec6eed6ca993664fd3e0782582722637b40959
90498bb3217c512a96eccb0a2848914004a6dcd2776276cfa89b350f0f9effa7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hd-api/external/assets/hdf.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374; SESSION=050e662002452791339b17b11e3ea7be
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:21 GMT
content-type: text/javascript; charset=utf-8
content-length: 1632
accept-ranges: bytes
cache-control: public, max-age=300
content-encoding: gzip
etag: bc393aaba413190373c1820a0c44fa84
vary: Accept-Encoding
x-dt: 285
x-request-guid: 2c426a5d9a259112b2afd6a9fb78f5ad
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.013, wf-uht;dur=0.011
X-Firefox-Spdy: h2
GET v3.traincdn.com/main-static/947c84bd/desktop/default/css/7fe5f71b.css
200 OK 3.3 kB URL GET v3.traincdn.com/main-static/947c84bd/desktop/default/css/7fe5f71b.css
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
File type ASCII text, with very long lines (3313), with no line terminators
Hash c610b8710368de3bf2f1c5bb581b6a3a
f67bc86785d434adb2e81a356a7926b8818ac567
fad7111846310042401990719146401178f22e2618abf2b058e641b6495e8eba
GET /main-static/947c84bd/desktop/default/css/7fe5f71b.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: text/css; charset=utf-8
traceparent: 00-490e20e9bc0764be17287771518174ac-2b9a986dfd13335a-01
last-modified: Tue, 03 Jun 2025 12:12:24 GMT
etag: W/"c610b8710368de3bf2f1c5bb581b6a3a"
x-amz-meta-mtime: 1748952741.0702991
content-encoding: gzip
expires: Wed, 04 Jun 2025 12:23:58 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 47622
cache: HIT
x-cached-since: 2025-06-03T12:25:30+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/shared-assets/__shared_localforage_FJKG5M2E.js
200 OK 30 kB URL GET 1xlite-376866.top/sys-static/shared-assets/__shared_localforage_FJKG5M2E.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (30255)
Hash 02cf95f00794b77df34632e34a59c5be
b64889fb6cbe78a141688ea761a627997ef8a8af
bf78b7b3dd6ecbdea04c575edfb6022ed1b2e98c7a9cb9f02ab851ca638f1b83
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/shared-assets/__shared_localforage_FJKG5M2E.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/shared-assets/Desktop/__shared_base-app_903e6da5a6.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:54:46 GMT
etag: W/"02cf95f00794b77df34632e34a59c5be"
x-amz-meta-mtime: 1748958578.599592938
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.008
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/d9842b87b9dabdc4cdc248c062355299.json
200 OK 7.3 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/d9842b87b9dabdc4cdc248c062355299.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash 0614058b667e6dfa1cdecc6e0e53131c
4f20f88c436fb5cbd82cf1dcfeaa14e52195a369
be16474b0f19b7536ebdd3d0f8867b151eaa4638411ddb46845f887a5d51a653
GET /genfiles/cms/1-285/desktop/media_asset/d9842b87b9dabdc4cdc248c062355299.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
traceparent: 00-dea1553f0a0872c5da04310c1c1a6568-7742ca5c0aa9ceba-01
last-modified: Thu, 23 Jan 2025 13:19:10 GMT
etag: W/"0614058b667e6dfa1cdecc6e0e53131c"
content-encoding: gzip
expires: Thu, 23 Jan 2025 14:50:28 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 332
cache: HIT
x-cached-since: 2025-06-04T01:33:40+00:00
X-Firefox-Spdy: h2
POST www.google.com/gmp/conversion;src=14030178;type=xbet;cat=uniqu0;ord=1;num=6672763457846;npa=1;auiddc=1702276876.1749001164;pscdl=noapi;frm=0;_tu=KpA;gtm=45fe5630h2v9190735530z89180563600za200zb9180563600;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=4;tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964;epver=2;dc_random=1749001163889;~oref=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock?
200 OK 42 B URL POST www.google.com/gmp/conversion;src=14030178;type=xbet;cat=uniqu0;ord=1;num=6672763457846;npa=1;auiddc=1702276876.1749001164;pscdl=noapi;frm=0;_tu=KpA;gtm=45fe5630h2v9190735530z89180563600za200zb9180563600;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=4;tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964;epver=2;dc_random=1749001163889;~oref=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock?
IP
Requested by https://1xlite-376866.top/en/block
Certificate IssuerGoogle Trust Services
Subjectwww.google.com
Fingerprint84:BD:0D:9A:51:CC:86:3E:E9:2F:6E:7C:2D:58:AC:4C:FB:B5:3D:8C
ValidityMon, 12 May 2025 08:44:44 GMT - Mon, 04 Aug 2025 08:44:43 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
POST /gmp/conversion;src=14030178;type=xbet;cat=uniqu0;ord=1;num=6672763457846;npa=1;auiddc=1702276876.1749001164;pscdl=noapi;frm=0;_tu=KpA;gtm=45fe5630h2v9190735530z89180563600za200zb9180563600;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=4;tag_exp=101509157~103116026~103200004~103233427~103351866~103351868~104611962~104611964;epver=2;dc_random=1749001163889;~oref=https%3A%2F%2F1xlite-376866.top%2Fen%2Fblock? HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 04 Jun 2025 01:39:24 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://1xlite-376866.top
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
200 OK 3.9 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (3873)
Hash 07ea703063c4d5ee76b1b1b5845e6905
7794892b3fc0b6d4051dfaeddcb9c15a87af762d
2c6497b477fb18d8d4d9bfa94743d235f4c8b3f0f46af415137b530e5caa8b9f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/63937a8066.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"07ea703063c4d5ee76b1b1b5845e6905"
x-amz-meta-mtime: 1748957395.670591926
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.012
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/ca0b35c4fc049f15180d875f935913b8.json
200 OK 9.3 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/ca0b35c4fc049f15180d875f935913b8.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash ca7f8dc261bfa0bedbe26c6196957093
201939c20640df2ad6fbe79bc165b2e2d19bc65b
9d7da7f9fd8b6eb344298507d3e2afd038623c0e46dee2a018c0e3ecd667f203
GET /genfiles/cms/1-285/desktop/media_asset/ca0b35c4fc049f15180d875f935913b8.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
traceparent: 00-a1d69e9bb670bdf5dc69c8d58ba84e71-dc32ca7fb35f6411-01
last-modified: Wed, 20 Nov 2024 09:20:07 GMT
etag: W/"ca7f8dc261bfa0bedbe26c6196957093"
content-encoding: gzip
expires: Thu, 16 Jan 2025 10:57:42 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 332
cache: HIT
x-cached-since: 2025-06-04T01:33:40+00:00
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/1c0cd0740fccd19a9816be06e69f0a1b.json
200 OK 473 B URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/1c0cd0740fccd19a9816be06e69f0a1b.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash e67aa19ef00fd2285c7b4ecbb6018306
5b01d4786d6fbfbd5de7901eb4359a55466f434a
135c1042c31e3674d8a1b3b9e7179f4f36868048ca6058ea458ff291b8880b5e
GET /genfiles/cms/1-285/desktop/media_asset/1c0cd0740fccd19a9816be06e69f0a1b.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
content-length: 473
traceparent: 00-1e0b77ef5cfbf15ec752160a2aa90ea6-9e79fba8c189c13a-01
last-modified: Thu, 16 May 2024 20:41:30 GMT
etag: "e67aa19ef00fd2285c7b4ecbb6018306"
expires: Fri, 16 May 2025 19:56:49 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 1xlite-376866.top/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js
200 OK 760 B URL GET 1xlite-376866.top/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type JavaScript source, ASCII text, with very long lines (759)
Hash 0b911773e0df627d77f8306c86e228aa
0d584bb1a3294e4fe42df4582dcc8a2c8f77f7bb
01e4926540498a77d866259516007d41fae1213ab9607db826f011d926fd6006
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374; SESSION=050e662002452791339b17b11e3ea7be
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:21 GMT
content-type: text/javascript; charset=utf-8
content-length: 492
accept-ranges: bytes
cache-control: public, max-age=300
content-encoding: gzip
etag: 0b911773e0df627d77f8306c86e228aa
vary: Accept-Encoding
x-dt: 285
x-request-guid: 9db1233e16c1523ccf00e1d5166720f7
x-time-ng: 0.012
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.103, wf-uht;dur=0.021
X-Firefox-Spdy: h2
GET radar.cedexis.com/1707728419/stub.js
200 OK 390 B URL GET radar.cedexis.com/1707728419/stub.js
IP
ASN #63911 NetActuate, Inc
Requested by https://1xlite-376866.top/en/block
Certificate IssuerDigiCert Inc
Subjectradar.cedexis.com
FingerprintA2:3E:30:19:D5:41:3A:11:81:58:E3:B1:6F:F4:D2:78:0B:44:6F:D0
ValidityFri, 07 Mar 2025 00:00:00 GMT - Fri, 06 Mar 2026 23:59:59 GMT
File type JavaScript source, ASCII text
Hash 82dec77fd0353c7c71ce053b8601387e
fbbca95419e1d0c042e0a5fdf10f380aca66188c
39f2b7b0fa78d37d0c84d2d6618bd635d86fd683d9bcdd5729850cb2a62522f7
GET /1707728419/stub.js HTTP/1.1
Host: radar.cedexis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 04 Jun 2025 01:39:23 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 12 Feb 2024 09:50:42 GMT
Vary: Accept-Encoding
ETag: W/"65c9e9f2-186"
Expires: Wed, 18 Jun 2025 01:39:23 GMT
Cache-Control: max-age=1209600, public
Content-Encoding: gzip
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/a49ddc9ed7b115238ef2263b253f2225.json
200 OK 22 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/a49ddc9ed7b115238ef2263b253f2225.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash ff5d81879a491bb1cfe091c5817a89b4
2a1d20f61eb8c513b270b8d123e3a9f66c89f808
538bffce9fa55e37a08e6b7f5148f8e7884c02a82b13e8426553061ff2475f90
GET /genfiles/cms/1-285/desktop/media_asset/a49ddc9ed7b115238ef2263b253f2225.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:12 GMT
content-type: application/json
traceparent: 00-f8ceb09b9aaa4dcab9fa6ec258fd5727-585554d0bedc5a78-01
last-modified: Tue, 20 May 2025 11:01:53 GMT
etag: W/"ff5d81879a491bb1cfe091c5817a89b4"
content-encoding: gzip
expires: Tue, 20 May 2025 12:23:08 GMT
cache-control: max-age=3600
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 332
cache: HIT
x-cached-since: 2025-06-04T01:33:40+00:00
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/e40b28763d.js
200 OK 147 B URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/e40b28763d.js
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Hash c653d4292db9f892bf6f72223a3fb9ef
68e00b62bc5c58ada6c1a72ef919f7b3bc5f344c
b044f0472001a85ae50c1ea8c56c72d9b299e96b290da0bfaeb7fb0b986dbe6f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/e40b28763d.js HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/f27cd2497c.js
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:14 GMT
content-type: text/javascript; charset=utf-8
content-length: 147
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: "c653d4292db9f892bf6f72223a3fb9ef"
x-amz-meta-mtime: 1748957395.670591926
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
accept-ranges: bytes
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.009
X-Firefox-Spdy: h2
GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/c0e02032d1.css
200 OK 11 kB URL GET 1xlite-376866.top/sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/c0e02032d1.css
IP
ASN #202492 Silverhill Group Holding Ltd
Requested by https://1xlite-376866.top/en/block
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
File type ASCII text, with very long lines (11072)
Hash 3d3e04f603cc58802ff96240abbdc3aa
e7e6a5d59c97236922354b40d288736f034a1ce3
611f7a963cd4aa278f1ba51f2401247df8c658929b76bfdce45bec08be83d7bd
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sys-static/sys-technical-pages-app-static/Desktop/Default/44136fa355b3/c0e02032d1.css HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-376866.top/en/block
Cookie: platform_type=desktop; lng=en; cookies_agree_type=3; tzo=2; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; auid=LiC2f2g/o74dr4wiA13bAg==; window_width=1280; che_g=7b516d8b-0d9e-1376-c4a1-1993a1181374
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 03 Jun 2025 13:34:38 GMT
etag: W/"3d3e04f603cc58802ff96240abbdc3aa"
x-amz-meta-mtime: 1748957395.671592023
content-encoding: br
expires: Thu, 05 Jun 2025 01:39:13 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.012
X-Firefox-Spdy: h2
GET 1xlite-376866.top/en/registration?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration
302 Found 269 kB URL User Request GET 1xlite-376866.top/en/registration?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration
IP
ASN #202492 Silverhill Group Holding Ltd
Certificate IssuerLet's Encrypt
Subject1xlite-376866.top
FingerprintC4:71:70:F7:8B:86:57:F2:13:AB:B3:DC:F2:2C:C5:F1:B7:97:46:15
ValidityWed, 30 Apr 2025 07:38:13 GMT - Tue, 29 Jul 2025 07:38:12 GMT
Size 269 kB (268926 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /en/registration?tag=d_63599m_22811c_[]MS[]null[]newpb[]reg[]1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder&pb=5233157ad7f642f48a2439caedb13f13&click_id=cnv7e57c897e3946779bc815e9f8a33e5c2&r=registration HTTP/1.1
Host: 1xlite-376866.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Wed, 04 Jun 2025 01:39:10 GMT
location: https://1xlite-376866.top/en/block
server-timing: dt_total;dur=0.011, total;dur=89;desc="Nuxt Server Time", wf-uht;dur=0.103
set-cookie: platform_type=desktop; Path=/; Expires=Sat, 07 Jun 2025 01:39:10 GMT; Secure; SameSite=None; Partitioned
gw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned
lng=en; Path=/
cookies_agree_type=3; Path=/
tzo=2; Path=/
is12h=0; Path=/
referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; Path=/; Expires=Sun, 03 Aug 2025 01:39:10 GMT
reflinkid=d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder; Path=/; Expires=Wed, 04 Jun 2025 02:39:10 GMT
postback_watcher=%7B%22tag%22%3A%22d_63599m_22811c_%5B%5DMS%5B%5Dnull%5B%5Dnewpb%5B%5Dreg%5B%5D1384306207086970-126-cnv7e57c897e3946779bc815e9f8a33e5c2_d29072_l167265_clickunder%22%2C%22pb%22%3A%225233157ad7f642f48a2439caedb13f13%22%2C%22click_id%22%3A%22cnv7e57c897e3946779bc815e9f8a33e5c2%22%2C%22r%22%3A%22registration%22%7D; Path=/; Expires=Fri, 04 Jul 2025 01:39:10 GMT
auid=LiC2f2g/o74dr4wiA13bAg==; path=/; secure; httponly; samesite=lax
x-dt: 285
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2
GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/283b76f48d045151d369ffabf3fbf49f.json
200 OK 2.9 kB URL GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/283b76f48d045151d369ffabf3fbf49f.json
IP
ASN #199524 G-Core Labs S.A.
Requested by https://1xlite-376866.top/en/block
Certificate IssuerSectigo Limited
Subject*.traincdn.com
Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA
ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT
Hash c163e08f04217198adf89b6af95e8ff6
4f45163b22f2cb4d66d287eb4acc54345ee814f8
d5af82911b446075abf5a86e262c5d8210894f80f8e6140d771e6d3effe7c7a1
GET /genfiles/cms/1-285/desktop/media_asset/283b76f48d045151d369ffabf3fbf49f.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-376866.top/
Origin: https://1xlite-376866.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 04 Jun 2025 01:39:13 GMT
content-type: application/json
traceparent: 00-2c9ef6994d6adf671ff08c7ce2105849-9b5c0fea65f87367-01
last-modified: Thu, 08 May 2025 12:53:06 GMT
etag: W/"c163e08f04217198adf89b6af95e8ff6"
content-encoding: gzip
expires: Thu, 08 May 2025 14:19:48 GMT
cache-control: max-age=3600
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1880
cache: HIT
x-cached-since: 2025-06-04T01:07:53+00:00
X-Firefox-Spdy: h2
83.147.204.179
142.250.74.131
185.244.209.62
46.32.182.127
0.0.0.0