Overview

URLmegaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
IP 91.209.70.182 (Russia)
ASN#43317 FNK LLC
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-09-21 20:08:32 UTC
StatusLoading report..
IDS alerts0
Blocklist alert1
urlquery alerts No alerts detected
Tags None

Domain Summary (32)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
ningukmodu.one (5) 0 2022-09-18 06:55:39 UTC 2022-09-21 04:37:19 UTC 104.21.2.144 Unknown ranking
platform.bidgear.com (2) 30367 2018-11-15 19:45:56 UTC 2022-09-21 08:57:06 UTC 172.67.74.36
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-21 04:18:32 UTC 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-21 04:20:37 UTC 34.117.237.239
ocsp.digicert.com (3) 86 2012-05-21 07:02:23 UTC 2022-09-21 15:45:34 UTC 93.184.220.29
altowriestwispy.com (2) 951913 2021-02-24 10:44:10 UTC 2022-09-21 16:08:39 UTC 23.109.82.168
push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-21 04:20:37 UTC 34.217.237.91
ad.a-ads.com (1) 26970 2013-04-19 21:54:57 UTC 2022-09-21 17:35:14 UTC 78.46.174.169
a.exdynsrv.com (1) 40663 2019-05-21 05:34:42 UTC 2022-09-21 09:32:39 UTC 205.185.216.10
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-09-21 14:38:57 UTC 34.120.237.76
s3t3d2y8.afcdn.net (1) 0 2022-08-08 22:22:56 UTC 2022-09-21 08:31:04 UTC 185.76.9.14 Unknown ranking
xml.serve-servee.com (1) 0 2022-06-18 07:06:23 UTC 2022-09-21 14:03:07 UTC 172.64.111.7 Unknown ranking
keydawnawe.com (2) 586690 2020-10-08 14:33:32 UTC 2022-09-21 16:08:39 UTC 23.109.170.51
static.a-ads.com (1) 34827 2013-06-01 16:47:05 UTC 2022-09-21 12:34:55 UTC 78.46.174.169
static.serve-servee.com (1) 0 2022-06-18 03:19:30 UTC 2022-09-21 16:08:43 UTC 172.64.111.7 Unknown ranking
www.facebook.com (1) 99 2017-01-30 05:00:00 UTC 2022-09-21 04:11:59 UTC 157.240.200.35
wasanasset.buzz (3) 0 2022-09-08 08:02:50 UTC 2022-09-21 13:24:57 UTC 44.195.137.121 Unknown ranking
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-09-21 16:01:18 UTC 143.204.55.35
r3.o.lencr.org (8) 344 2020-12-02 08:52:13 UTC 2022-09-21 04:18:22 UTC 23.36.76.226
imp9.bidgear.com (1) 34078 2021-03-15 11:09:09 UTC 2022-09-21 16:08:40 UTC 172.67.74.36
www.google-analytics.com (2) 40 2012-10-03 01:04:21 UTC 2022-09-21 16:16:45 UTC 142.250.74.174
dmmzkfd82wayn.cloudfront.net (7) 0 2021-10-16 14:37:01 UTC 2022-09-21 19:15:55 UTC 143.204.42.115 Unknown ranking
ocsp.sectigo.com (1) 487 2018-12-17 11:31:55 UTC 2022-09-21 12:11:24 UTC 104.18.32.68
syndication.exdynsrv.com (2) 34243 2016-04-20 18:35:15 UTC 2022-09-21 14:41:10 UTC 95.211.229.247
societingna.info (1) 978921 2020-01-01 12:45:00 UTC 2022-09-21 16:08:40 UTC 44.195.137.121
pogothere.xyz (5) 0 2022-09-04 19:11:25 UTC 2022-09-21 13:24:57 UTC 172.64.107.19 Unknown ranking
ocsp.pki.goog (7) 175 2017-06-14 07:23:31 UTC 2022-09-21 04:20:12 UTC 142.250.74.3
e1.o.lencr.org (10) 6159 2021-08-20 07:36:30 UTC 2022-09-21 05:25:35 UTC 23.36.76.226
autifuleedeh.xyz (4) 0 2022-09-19 08:07:20 UTC 2022-09-21 13:24:57 UTC 172.64.173.14 Unknown ranking
accounts.google.com (4) 81 2016-09-05 09:39:47 UTC 2022-09-21 13:51:16 UTC 216.58.207.237
megaup.net (56) 179052 2017-09-01 18:45:15 UTC 2022-09-21 16:08:34 UTC 91.209.70.182
www.googletagmanager.com (1) 75 2012-12-25 14:52:06 UTC 2022-09-21 04:18:29 UTC 142.250.74.72

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-21 2 societingna.info/QmRKS3c5Rjk8KDcWJmlNYAw%2BPwcxXmVkGicDKz4HbAovP1gxE2QhBGBI (...) Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 91.209.70.182
Date UQ / IDS / BL URL IP
2023-02-05 00:55:36 +0000 0 - 6 - 4 megaup.net/12An7/POKLEGARC-NSwTcH-NSP-Update1 (...) 91.209.70.182
2023-02-04 23:36:39 +0000 0 - 6 - 5 megaup.net/1RN4k/Frozen_Flame_v0.73.0.0.32742 (...) 91.209.70.182
2023-02-04 23:13:19 +0000 0 - 6 - 5 megaup.net/16kgb/MADiSON-DARKSiDERS.rar 91.209.70.182
2023-02-04 20:57:48 +0000 0 - 6 - 5 megaup.net/1S0dc/The_long_Drive.zip 91.209.70.182
2023-02-04 20:57:46 +0000 0 - 6 - 4 megaup.net/2xXG0/Stardew_Valley.zip 91.209.70.182


Last 5 reports on ASN: FNK LLC
Date UQ / IDS / BL URL IP
2023-02-05 00:55:36 +0000 0 - 6 - 4 megaup.net/12An7/POKLEGARC-NSwTcH-NSP-Update1 (...) 91.209.70.182
2023-02-04 23:36:39 +0000 0 - 6 - 5 megaup.net/1RN4k/Frozen_Flame_v0.73.0.0.32742 (...) 91.209.70.182
2023-02-04 23:13:19 +0000 0 - 6 - 5 megaup.net/16kgb/MADiSON-DARKSiDERS.rar 91.209.70.182
2023-02-04 20:57:48 +0000 0 - 6 - 5 megaup.net/1S0dc/The_long_Drive.zip 91.209.70.182
2023-02-04 20:57:46 +0000 0 - 6 - 4 megaup.net/2xXG0/Stardew_Valley.zip 91.209.70.182


Last 5 reports on domain: megaup.net
Date UQ / IDS / BL URL IP
2023-02-05 00:55:36 +0000 0 - 6 - 4 megaup.net/12An7/POKLEGARC-NSwTcH-NSP-Update1 (...) 91.209.70.182
2023-02-04 23:36:39 +0000 0 - 6 - 5 megaup.net/1RN4k/Frozen_Flame_v0.73.0.0.32742 (...) 91.209.70.182
2023-02-04 23:13:19 +0000 0 - 6 - 5 megaup.net/16kgb/MADiSON-DARKSiDERS.rar 91.209.70.182
2023-02-04 20:57:48 +0000 0 - 6 - 5 megaup.net/1S0dc/The_long_Drive.zip 91.209.70.182
2023-02-04 20:57:46 +0000 0 - 6 - 4 megaup.net/2xXG0/Stardew_Valley.zip 91.209.70.182


No other reports with similar screenshot

JavaScript

Executed Scripts (53)

Executed Evals (1)
#1 JavaScript::Eval (size: 47) - SHA256: 0f13250dac3eba96683a13d9c0c14c812448cc2f499a6ad6637a17adf094884d
window.fanfilnfjkdsabfhjdsbfkljsvmjhdfb = true;

Executed Writes (1)
#1 JavaScript::Write (size: 2290) - SHA256: 8badb350999e1a2b5a7a16269ac0d631bc7122c819d8dfbc7655ef1b6b576254
< div style = "display:none" > < /div><div id="bg_content"><div style="display:none"><img data-cfasync="false" src="/ / imp9.bidgear.com / rec ? t = 1 & z = 6192 & uuid = 44864e753 dac4b0cb65a53570765cc1f & p = 28 & g = NO & token = 4 a44335432 & tbg = 1663790903 " rel="
noindex nofollow " referrerpolicy="
unsafe - url "/></div><div data-ifr=2 style=" - webkit - transition: width 0.5 s!important; /*background-color:#fcfcfc!important;*/
background - color: # e3e3e3!important;
opacity: 0.6;
color: #00aecd;font-family:Arial!important;height:15px!important;line-height:15px!important;overflow:hidden!important;position:absolute!important;left:1px!important;top:1px!important;transition:width 0.5s!important;white-space:nowrap!important;width:16px!important;z-index:99999!important; border-bottom-right-radius: 4px" onmouseover= "this.style.width='100px';this.style.borderBottomRightRadius='3px';this.style.opacity=1;"
onmouseout = "this.style.width='16px';this.style.borderBottomRightRadius='4px';this.style.opacity=0.6;" > < div style = "float: left!important;position: absolute!important;left: 6px!important;bottom: 0px!important;" > < a href = //bidgear.com/?ref=banner target=_blank style="color:inherit!important;font-size:11px!important;padding:0 5px!important;text-decoration:none!important;margin:0!important;text-indent: 0!important; display: inline!important;"><span style="/*background-color:#fcfcfc!important;*/display:block!important;height:14px!important;position:absolute!important;right:1px!important;bottom:0!important;width: 13px!important;text-indent: 0!important; padding: 0!important; border-bottom-right-radius: 4px"><img src=//platform.bidgear.com/media/img/b15.png alt=Ad by Bidgear style="width:100%!important; height: 13px!important;"></span></a></div><div style="float: left!important;clear: right!important; padding-left: 16px!important;"><a href=//bidgear.com/?ref=banner target=_blank style="color:inherit!important;font-size:11px!important;padding:0 5px!important;text-decoration:none!important;margin:0!important;text-indent: 0!important;">Ad by Bidgear</a></div></div><script async type="application/javascript" src="https://a.exdynsrv.com/ad-provider.js"></script> <ins class="adsbyexoclick" data-zoneid="4464186" data-keywords="keywords"></ins> <script>(AdProvider = window.AdProvider || []).push({"serve": {}});</script></div>


HTTP Transactions (144)


Request Response
                                        
                                            GET /37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         91.209.70.182
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:21 GMT
Content-Length: 162
Connection: keep-alive
Location: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer, strict-origin-when-cross-origin
X-Download-Options: noopen


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   162
Md5:    4f8e702cc244ec5d4de32740c0ecbd97
Sha1:   3adb1f02d5b6054de0046e367c1d687b6cdf7aff
Sha256: 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Retry-After, Content-Type, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Wed, 21 Sep 2022 19:13:42 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 a7d2a4ec2f50830f128dc406960aef9a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: cdgy8oT13QAiZxZAiARCGdho-5ejyrcFH5rRb0Jl9e6tWaqdXXRqnA==
Age: 3279


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    1b3053fa528e28810f8a2cc9284cc921
Sha1:   cca9eb471d941881a6b9a1793aecb6c281908f6a
Sha256: a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "35BAAAE7B3CE3110EBB2B075881CFAB55ECF3EAB57D834283FD18AC691B41FA2"
Last-Modified: Tue, 20 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4911
Expires: Wed, 21 Sep 2022 21:30:12 GMT
Date: Wed, 21 Sep 2022 20:08:21 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "46E1A9E6C98245AFB7FA84BC6D9BA6844105024E2D3F56E28748E6C321475D02"
Last-Modified: Wed, 21 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10879
Expires: Wed, 21 Sep 2022 23:09:40 GMT
Date: Wed, 21 Sep 2022 20:08:21 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: df1NR1bjN6Md/B5p9SZVZ/ZvtAWGfbJP7rDuCvkxq58xeOolqFhI/5gxPZtzz/Z0JPPY6PI4arY=
x-amz-request-id: W9GEPA5RF59S8K2R
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 21 Sep 2022 19:43:31 GMT
age: 1490
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
etag: "6113f8408c59aebe188d6af273b90743"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:21 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Wed, 21 Sep 2022 20:03:22 GMT
Cache-Control: max-age=3600
Expires: Wed, 21 Sep 2022 20:55:20 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: zqJmu_KpMLUDdUVHmvD3jKIBB6U_VSQLID4LQl3tOtmdLIad4lms3w==
Age: 300


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2941
Cache-Control: 'max-age=158059'
Date: Wed, 21 Sep 2022 20:08:22 GMT
Last-Modified: Wed, 21 Sep 2022 19:19:22 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: sVe2MUcSzI6SMKmONIcgwQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         34.217.237.91
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: NZVx9jX93CjX5cr1CKQEq3957Z0=

                                        
                                            GET /?kzmmd=761186 HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 188761
date: Wed, 21 Sep 2022 19:15:55 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Hit from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 7ruk9GrwE8iqEeQDeM4Vzr_cS1rpLK74WO-X4vJXIIwqFW816L2EJA==
age: 3147
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (15945)
Size:   188761
Md5:    be9b025670fe5581d92dc3bdfb19d3c2
Sha1:   ba923155a2a41a08e5bf83d63082f13f88cf93d7
Sha256: c7f32a47b9f11f2de1eae2d41f5b51f07de31181e8398f7e17cb9dae3fb9f2f8
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "8E93AC6FA47C4A91B7DCDAEDA88F92FB8F506187EB8172426C21326ED1159145"
Last-Modified: Mon, 19 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=735
Expires: Wed, 21 Sep 2022 20:20:37 GMT
Date: Wed, 21 Sep 2022 20:08:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D763F8EB0157D3269D726FDFD5C5CE5910650A0CF82C04067C4B0413B181173E"
Last-Modified: Wed, 21 Sep 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1808
Expires: Wed, 21 Sep 2022 20:38:30 GMT
Date: Wed, 21 Sep 2022 20:08:22 GMT
Connection: keep-alive

                                        
                                            GET /gtag/js?id=UA-108868042-1 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.72
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 21 Sep 2022 20:08:22 GMT
expires: Wed, 21 Sep 2022 20:08:22 GMT
cache-control: private, max-age=900
last-modified: Wed, 21 Sep 2022 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 42235
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1720)
Size:   42235
Md5:    168dd2ef19dafba4b865830a0fadf142
Sha1:   0e6e5b29f87c150c40818c23b130e1fb4f6afccf
Sha256: b2a828626f2d7e466b37397e325a61eede4d6b371dda18c73b0f6afa7d2513ca
                                        
                                            GET /tysaSHG1FMaM/18410 HTTP/1.1 
Host: altowriestwispy.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.109.82.168
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; expires=Thu, 22-Sep-2022 20:08:22 GMT; Max-Age=86400; path=/; secure; SameSite=None GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW; expires=Thu, 22-Sep-2022 20:08:23 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   25
Md5:    d488addc5df5fc9b9ff4135bb4e3a823
Sha1:   6ce56f48e851df4d562b43d3bc1269a504ae83fc
Sha256: d1e90b8aef655ca37932287e04cbda72092eb029fe90de2bac019c10d3431f60
                                        
                                            GET /themes/flow/images/main_logo_inverted.png HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: image/png
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
content-length: 7137
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-1be1"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 203 x 40, 8-bit/color RGBA, non-interlaced\012- data
Size:   7137
Md5:    5d15526be10b904a6b48d1af04a10cc3
Sha1:   c09b6874359ac6d71db95593618a9acb55baa984
Sha256: 894d25472e0f890edf235e8f66fbeda7ea75043632924ecb82691d76bd7db018
                                        
                                            GET /themes/flow/images/loading_small.gif HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
content-length: 184355
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-2d023"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 64 x 64\012- data
Size:   184355
Md5:    b0dd5b3af9c4c0644d7bddee83716209
Sha1:   30002468d0266b893b3559b8d0d260c6cbf0ad7c
Sha256: 2418224bb4d12c122ef3c54d2ee9edb5f6f28d539e91a166b0215553f8c7609d
                                        
                                            GET /gwZ1U5hjA8ii/32575 HTTP/1.1 
Host: keydawnawe.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.109.170.51
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; expires=Thu, 22-Sep-2022 20:08:23 GMT; Max-Age=86400; path=/; secure; SameSite=None GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW; expires=Thu, 22-Sep-2022 20:08:23 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   26
Md5:    4e5d65669f8dcd928dad06adf883f025
Sha1:   d771713d758c3348dd7e5b38bb40c7935399ae46
Sha256: 0bebbf029fa045e4f462855e6c44edf8aaa36ded05b07a8ce456b67416d20c95
                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "D0382E4966ECD69C8D1C9559A098BFA9C2D8C4C612F9BDBD4B99D77F45491D10"
Last-Modified: Tue, 20 Sep 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12605
Expires: Wed, 21 Sep 2022 23:38:28 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "D0382E4966ECD69C8D1C9559A098BFA9C2D8C4C612F9BDBD4B99D77F45491D10"
Last-Modified: Tue, 20 Sep 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12605
Expires: Wed, 21 Sep 2022 23:38:28 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 23:25:49 GMT
Expires: Mon, 26 Sep 2022 23:25:48 GMT
Etag: "6a2038dd3d9007bde0b5ea01fa21531b7813c9b5"
Cache-Control: max-age=443245,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 74e56eafaa7fb4fd-OSL

                                        
                                            GET /tysaSHG1FMaM/18410 HTTP/1.1 
Host: altowriestwispy.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.109.82.168
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   25
Md5:    d488addc5df5fc9b9ff4135bb4e3a823
Sha1:   6ce56f48e851df4d562b43d3bc1269a504ae83fc
Sha256: d1e90b8aef655ca37932287e04cbda72092eb029fe90de2bac019c10d3431f60
                                        
                                            GET /themes/flow/frontend_assets/fonts/raleway.woff HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: font/woff
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 31836
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7c5c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 31836, version 1.1\012- data
Size:   31836
Md5:    4514fa5a5b3d1e0b14aa32a7d068124a
Sha1:   e634977bfabc20ed15fe7ed03d3876cf68834b93
Sha256: 5b0f118d658eacc5740b10b0dc2ebbd99ee8e8262c72ff29bfcda48c02b19861
                                        
                                            GET /themes/flow/frontend_assets/fonts/raleway_extrabold.woff HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: font/woff
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 31344
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7a70"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 31344, version 1.1\012- data
Size:   31344
Md5:    21f79e4c0fbe54a555170aa70bb4c8b7
Sha1:   9d4aaf2016cd21f16bc45089a48de84dba951fa7
Sha256: 2b638674bc57ad355ef2ecbd68e78ecb36bc323aaaf4ddeb9cd4f61bc5f26c42
                                        
                                            GET /themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-8d4b"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text
Size:   4506
Md5:    6e400be66e8616c46c77877cedcdbd30
Sha1:   37adc2f971f553bd5b505bb31dc7a7ce71a6f359
Sha256: 16b08da9230412e457f6f0c8c58ed6996a96e44173698b019bf098f5eacbc7b8
                                        
                                            GET /themes/flow/frontend_assets/fonts/raleway_semibold.woff HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: font/woff
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 31980
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7cec"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 31980, version 1.1\012- data
Size:   31980
Md5:    99ac81a158028ac2023fb3350d2497e7
Sha1:   f08c12c91ab29282a616c3ba8e533f49b5b433ca
Sha256: 92a8c8eca8cfcfc53855bc48ba50b866704a00323c4e3089b564c939a668925d
                                        
                                            GET /themes/flow/frontend_assets/socialsider-v1.0/_fonts/socicon-webfont.woff HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: font/woff
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 20972
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-51ec"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 20972, version 1.0\012- data
Size:   20972
Md5:    cad75e2dacc6794c4e6b14727d4a989d
Sha1:   694d04c8f643df4100c23efc1463ac9f4e732f60
Sha256: ebccc09339b7730324221aff3d11d215de9997b47bf708ca18a3be2d8e8b9887
                                        
                                            POST /s/gts1p5/4emw79TnHXI HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /gwZ1U5hjA8ii/32575 HTTP/1.1 
Host: keydawnawe.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.109.170.51
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   26
Md5:    4e5d65669f8dcd928dad06adf883f025
Sha1:   d771713d758c3348dd7e5b38bb40c7935399ae46
Sha256: 0bebbf029fa045e4f462855e6c44edf8aaa36ded05b07a8ce456b67416d20c95
                                        
                                            GET /RW1NczRqUi4ACSEoJSFVLz8AFmMXOQ9DUD00fD5yFzUPFGEiOGsHXSFQekUAdFl8VUQsCXBCEjYZLAdBNlB8VV0rCyJOEjNQfF0HcUN/Sxp0SzhOBWMZPRJTeFxrA0AxAXBCAnNeekoEfF1/Sg10 HTTP/1.1 
Host: ningukmodu.one
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         104.21.2.144
HTTP/2 204 No Content
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z9BVnwgfI9GmF6ZBpipsIxABwlixZZcJXkeT0woZuF%2BhcCzXjtENA8gJpfmWmr6dIhr8hFZUxbywh5yg%2BYmHmOLdt%2BNSMLvKe5hswhiGN2M21r%2BW%2FrQk5caCKAib3ydRrg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb90e7eb515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            GET /UWlxWWF+VhIqXAssQCADOicmPCQDMRI1N2c7QC1TCTFAEjZiKFctCDVURm9QYFFHfxE4DUxoRyIdEC0UIlRAfwg/Dx5kRydUQHdSZUdDYU9gTwRkUHcdATgGbFhXKRUlBUxoV2daRmBRaFlDYFRg HTTP/1.1 
Host: ningukmodu.one
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.21.2.144
HTTP/2 204 No Content
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h96gfwMseQnF07xPHcorNBA%2B3GRvI6RicHd%2FrgTJwLEfInfz7kK%2FxJqIwf5bEXUkK48qwajPdnFaLSZcDtyOByk4rcQHcbX5Nrz80l8npA2JsB9aTZxTsvJ7Kv8axgxqqg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb90e7db515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            POST /s/gts1p5/4emw79TnHXI HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /themes/flow/frontend_assets/css/isotope/isotope-style.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-af3"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   826
Md5:    2b38de73325885599326ef1238c884fb
Sha1:   d9d7e95640e41ebede05436f5f51c6401ee66394
Sha256: b20ad1aa6a9b29bfa1138967dcfb5e868f3db811b4c1d171c38ccd33d53b55b5
                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "D0382E4966ECD69C8D1C9559A098BFA9C2D8C4C612F9BDBD4B99D77F45491D10"
Last-Modified: Tue, 20 Sep 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12605
Expires: Wed, 21 Sep 2022 23:38:28 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            GET /V3piMzd4RQFACjQtFgZ6PDQmawckPwYDbQ0uBVdABSwsfHYPN0RHXjNHWwcOb0xWFUc+Hl8CD3EJFlJDIglfAhE+FARcCnEMXwIZZ1RTHQRxD18CESMKA1QKZlwSR0M7R1MFAWRNWwMOZ0hbCwY HTTP/1.1 
Host: ningukmodu.one
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.21.2.144
HTTP/2 204 No Content
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6vIZLVKdZTrQa7kWIkyUXRDzP%2BoJUJ07qbBlkMAqm3CyK0iSv9178uxM70Qzkx0Wf8IK%2Bxki6qAdvfuTx%2BuRK3OueRQSa273kfVDPzOmn64HK1r3CL2zbv4CPAKAci7yWg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb93eb8b515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            GET /cW1DU2NeUiAgXicqMCktJCMkBBQkKCAEBxIsEjdTKAE0GCc5NGUnChVQe2RVQlx7dRMYCX5hWlceNzIXBB5+YkUYAyU8XlcbfmJNQUN2ak1ASzZuUlcZMzIETFxlIxcFAX5iVUdedGpTSF1xalRD HTTP/1.1 
Host: ningukmodu.one
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.21.2.144
HTTP/2 204 No Content
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RHqPivfaUvMd%2Bacoko32QhTG8XHRQqH1pbJ3sDT1nqKoFxAoY0vREwwIKJEgk7C3sYuR9bj33RuO9A1Gf6XFuvHZ%2BjqELa81R4yDrYB5T4uIOCxed7Plsrm29XhqoMnuMg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb93eb9b515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            GET /akJNRVJFfS42bwkUIQYzLhgIJwo4Jg8uEAUnITIaOy98PworemsxOw5/dXdnU3N8YyIDJnB2YEwxOSQmHzFwdHQDLCsqb0w0cHV8Umx0a2NMN3B0dB4yLCJvW2Q9MSYGf3xzZFl1dHVrWnB0c2A HTTP/1.1 
Host: ningukmodu.one
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.21.2.144
HTTP/2 204 No Content
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2BnY%2FQ%2BCuoiLb7p9hiW6XXTPv47JQZYl3Mhsc5eubXFqUuOyY4oUCPFpDNlPMOGYCm9in%2F2I1A1Wpocmxmagt0a2DiTrD%2BJAmLc8E%2F8UuW3kwk2jf9WT82heHji58M1AOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb93eb4b515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            GET /themes/flow/frontend_assets/rs-plugin/css/settings.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-ce4b"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with CRLF line terminators
Size:   8815
Md5:    8c20f25be68810ff61cb9728c7ce6855
Sha1:   a8a0d9cbcb0bfc4d0a3511039bc79bd99a2f8e4a
Sha256: d10dd21a89d1c3c6d10dd23a1abb8db94054cc6817987b91abed395134713f2c
                                        
                                            GET /eFJETVkZMCcgZhlvJmssCj55aGs+d3YLPRU/PiY/HGp2OjgBPGouNRcnICsrFzwwYzcdJmF/H0kLKB8KIjkjDxYCJQUpISFrCiEtAAQpfCgtGjwICREXDgcxMiIPOjIdBwM6HDA7DRkAED0FBjAbFSAPEAEQKSEwKREVCRYSBCYvPhtkCRstTQAAGGs6GhIaOhExDCkIQGUPDGETFi4bai4TcRU8FRgAKDUyag8hPU0Adi4IKWE0HhY8IQ0dCwgqHQsADwUpBBctGjwFAwAQACg1MT8OCBdPG3Z8MisaLAE6LxATAS4bYQscNQwHBgc+LjwoHgM/fwoaPC02KRQ+OToBCRxIERAPESI6Fis/EyovKRs2YxE6fxIhKyMpRSsrG2tABDwnKE4aIi8cKg HTTP/1.1 
Host: autifuleedeh.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         172.64.173.14
HTTP/2 200 OK
content-type: text/html
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 1162
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tS3nU1P%2FivmLTEcQM1N%2Bqq5ep9jC42gbkkDKcYe8lleejxNhmE7%2BODAAgiYzZiB%2FFuz%2BeJts5K8T70AO5YG7uy7dMNlCMyqq5OBJWEPBDjc%2BrAA9teK1Teao0n%2FLTjBruxZx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb98c3e757a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3003), with no line terminators
Size:   1162
Md5:    81f1ba6dc767d9652d66d8108e466406
Sha1:   f6fd3bff4eb54f4f6231c040f3c8b3b8f88a2929
Sha256: df448608f2f3469bb3d977e0f182383a98504bdeb4f38361f4d4f34ac49b0085
                                        
                                            GET /VkhVTFE3KjYhbjd1N2okJCRoaWMQbWcKNTslLyc3MnBnOzAvJnsvPTk9MSojOSYhYj8zPHB+FxgdLxphA3sUOwY+J2QYKDIrEAtkHhIEHhc3eA99CSErbQQ4GwEZHjInCzINIhsKZXoUIQklChZiDgAmaQQYAwYbMhoAdQc9JDwaOxwaEyFkEywACRQGCiE5AzEBYwsVJh0UJiYPBRcBExsjZWljFB8yeGceDGwZBAENZxY5Ig0xJxs8AAQ0OAcQDAsfOBIWFWA9LAUdBCQNEBY7FQ8mCBpkHhAoNg96MScbPBoiBmMHMBwBADh5FCk5FA8MNDJkHj1haW4eAgorBCUbDgghHhMVYRB6F3wAZw8GCgATIiIFNTErLC06DHEXGhg7HAIFdzw7OiIhaxERFghjEDYhOA HTTP/1.1 
Host: autifuleedeh.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         172.64.173.14
HTTP/2 200 OK
content-type: text/html
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 1167
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3GV7yLFzENWsDxs8ftegy%2Fp%2B29oUQ8S0J6nV82ZN4Z%2FIfAvmiXv%2BbIYS3KGcNVRuqWYJsQL8Rz2Q9bnSTBt8Tyhet3tVpcnnW2vn9MjT1Y4I7OBF27IxSCnqFiJQ4IPjeo5Q"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb98c3c757a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3010), with no line terminators
Size:   1167
Md5:    6cb8a24e1985df8fd10c53f5b0dffa93
Sha1:   f9decaa745130b5ce050f590920f2904aa4ed787
Sha256: 2d9bd157e5e669cb44a6fc3c810bae8c155ad145b4e0bf2b7825797e8b1e42df
                                        
                                            GET /RVdhdTckNQIYCCRqA1NCNztcUAUDclMzUyg6Gx5RIW9TAlY8OU8WWyoiBRNFKjkVW1kgI0RHcQQ0NA0DEwAoJn49DhstZhA7KTJfEwVSHX0cAS8tfSIkVzF2Ay8qNGEkBjIadg07Eh1wEThUIl0UIiQtehIUGB1xHwIwEXsXDhgtBiYnJx9tIwYmGm0IBiM4UgNjCTBfcTkzJm4QECIkZQsVMBB9ByMbM08HLychWBwQIjRiCxIFMXQuZlYgWxdyUzdkDWcAJH90MzscdRAxChICBi9ZQHYNFTAkYxcWOA8GDTInRFoMETNQBQcEIhZiEx9ZQFUDBQcTcWgRFiByACUpIW4PHwwZfABmIzdRED8NIAcDbjkiUxYRGCB8CBYwEHkDZg8/ci1hNxhhABUpM31jPRIaWTVqMSUPdTEZPg4VAiMZDwA1CA HTTP/1.1 
Host: autifuleedeh.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         172.64.173.14
HTTP/2 200 OK
content-type: text/html
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 1181
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3q3S04s83wfsDCrc6iliNp7vs7ti6LkXC2UsO82ol%2FX%2BhPfwRxS7BXh3hUQbQijLiEdWY6%2FWInY%2BHrWNpuQSeuOvHGxKvczt%2F1ODA7qcgU7JdQxIiCR%2Fi07fTEosnOYuNseZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb98c42757a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3026), with no line terminators
Size:   1181
Md5:    8ce6884f1f6d1553eb980af62b0bed46
Sha1:   5d46503881a38028f6ebaf45092a1ec1c828996f
Sha256: 06e28382ae84150f65aceb7dd9b75a12c6134bf269d7fd14c0d9547cc13c506a
                                        
                                            POST /s/gts1p5/4emw79TnHXI HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /imageads/014.gif HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 618667
last-modified: Thu, 01 Apr 2021 04:06:00 GMT
vary: Accept-Encoding
etag: "606546a8-970ab"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 300 x 250\012- data
Size:   618667
Md5:    3421db383a9cb797412de968bffe5611
Sha1:   aa8a9f04ca0af08e98971ef6914798b53f38c9ea
Sha256: bd3f6f9ced0e4aa4622f92ed19d385eafe045995d1db989b28cc4aa3be31dace
                                        
                                            GET /aEhMRHoJKi8pRQl1LmIPGiRxYUgubX4CHgUlNi8cDHB+MxsRJmInFgc9KCIIByY4ahQNPGl2PB4pITwMDA0rDjsfDR8gAlwOD3QWHx8KKC06ECAJOAA/Lg4SGBoEPC8eHTs3SzgmJywxPSMNCR1dGhR1MwMLOw0zOx94FDsPMAYhLx8GDzwgWRAnKxgqCy8GLzonLQg7UAMOLBUcDCcrGy4QGQw7EB0oDjsxBh8vIycQfA4cPRA8JSgqLAohL1EuABI8Xh8rBT0vInwXKT55CQk8IikBATBQHH18Dj0QPCUyACQeIQMcHhsSClwZfCgeOgt0FD4fZR0mGD4vPRwvOn0bKAINGgQoKjAkdBczOi8GBygbPxh1ThgcFHE/MA0nBh4+O2ouCQcmPHkKCS91IyAieQcB HTTP/1.1 
Host: autifuleedeh.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         172.64.173.14
HTTP/2 200 OK
content-type: text/html
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 1167
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hskn%2BFPJfVVrbsOsCQx8klzbPmj4w1susXr%2FmnBmcRYu1AJ1FHYXGfYN%2BPPwm5V6y9HBqh0%2B5uyL4r1uATPbvIFjjktZnyiTr66Lv51K0WSnslJu%2B66gu41WVrr2DMkqvyYJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eba0d01757a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3011), with no line terminators
Size:   1167
Md5:    e271b818b58aa2cfc755d302f0dcad56
Sha1:   60f4cb035c030af22a2de4e8c3e783318b14e451
Sha256: 0afd5f30119879203d2711aa5039b403345b944353910403fe20782c5c1aefa7
                                        
                                            GET /media/img/b15.png HTTP/1.1 
Host: platform.bidgear.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.67.74.36
HTTP/2 200 OK
content-type: image/png
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 649
last-modified: Mon, 25 Jul 2022 09:43:33 GMT
etag: "62de65c5-289"
expires: Fri, 23 Sep 2022 09:44:54 GMT
cache-control: max-age=2592000
access-control-allow-origin: *
cf-cache-status: HIT
age: 2456591
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DRdHx78wKN3yPgT%2BXT%2FOOPlF1xV8RQ58nW0eRsD3O856bYuvmhOFEFQ0tP7MLfNsy%2FLjq87z%2FqW3pvLyLdVA5mopgK6jCm%2Biq4sXD8%2B6flB5TrWA0REt3%2Fd3iOvoKJz1H6qLLKmr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74e56ebace2f0b59-OSL
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced\012- data
Size:   649
Md5:    d832fb80c97ff291b952757bb98240d2
Sha1:   63732e61a0784ed68fde494f83e4686a5c4bf7fa
Sha256: 7b35c11af8accdb40a14303dd3ae2762a97d2527933c56b6c9be6da2d0d11943
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "028E59CC7EEEBE6BF56D49AB31C7806B225AA468DF3C6B065BFE932018C8BDF0"
Last-Modified: Mon, 19 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1657
Expires: Wed, 21 Sep 2022 20:36:00 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            GET /ad-provider.js HTTP/1.1 
Host: a.exdynsrv.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         205.185.216.10
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 23727
Accept-Ranges: bytes
Cache-Control: max-age=10800
Server: nginx
etag: W/"d944899a6eb421496e94cbddc42"
X-HW: 1663790903.dop225.sk1.t,1663790903.cds066.sk1.shn,1663790903.dop225.sk1.t,1663790903.cds246.sk1.c
Access-Control-Allow-Origin: *, *


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23727
Md5:    81ef2e5397caa335947731e7e737f5c3
Sha1:   6a05a4b2d22c13ad2692170510bc8685b16002bf
Sha256: cec22380c4f1438b29077d202d0396a6ad32b41761ed51d968f1bfbdf2423378
                                        
                                            GET /fcUVnYnYSKgkESQUsA19ORnNUU05XLxQNGAF4BlcsNTw0GEJCdzADT1cxHQZLQWMLAxgWeEEHGBJ4VkQXFSdaVlAFNQgJSwIzDgofEDMIChVXMAZfGx4/Dg4aEGBVJENfdUJQRlk9VlNTQgdCUEYdLAkXDlR3VxpORxpRVlNCB0JQRgMzQlE3SHNJUl9Ud1-cFExIuCEdEN3dXU0ZBdFdTU0N1AQsEFCMIGlNDA15UWEFjEl9H HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://autifuleedeh.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 458
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: rlvpdJyQ8QXj0hOiBaudPK399u4lPz9RA1schS4erxqX8yYzg1xybQ==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (597), with no line terminators
Size:   458
Md5:    471c88410bc7be077e96977551e59812
Sha1:   ccb0e834086f5df6791f7388076d43c9f63e1791
Sha256: c734f1b17bf9ef5869d4bdde1ceb26a2d606a12686dcb74c28efd3b5c39fe433
                                        
                                            GET / HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 73
date: Wed, 21 Sep 2022 19:15:56 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Hit from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: ZHa7lmZdOZgRXomWiOosQlMG5mln5bCpN91Do6RLs7QHUBW8pu_-mg==
age: 3147
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   73
Md5:    de37377b72195a4f064edf7ec8a76676
Sha1:   ed544d5b6a37acad78498099407c648a93316ddb
Sha256: b3209cc0b1d1b71e85af4e843afe00a3079f3286d52b3fb47e72c6c5c48b8399
                                        
                                            GET /rec?t=1&z=6192&uuid=44864e753dac4b0cb65a53570765cc1f&p=28&g=NO&token=4a44335432&tbg=1663790903 HTTP/1.1 
Host: imp9.bidgear.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.67.74.36
HTTP/2 200 OK
content-type: image/jpeg
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 599
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZoBH218oZCwQ2apvjXuVS7uKCL1Btx%2BfisYD4E4yMFwcE7qjGl4juiyBnh1jGk8nT0i8mu96bZJBMSFKJrEhaAc4rKrHwrzAYKj8lGahP%2Bsli4rVAvUEgDAJzHTvetROqu8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56ebace320b59-OSL
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, baseline, precision 8, 1x1, components 3\012- data
Size:   599
Md5:    ca49a7e783b806a4e8576ea80346203d
Sha1:   6fe9d083221dae98f6c76f7121c37bc884b02d82
Sha256: 3e9a98dd5f0a28ff4a059f33d760264a6db02786666ac1692095ebb976f5da28
                                        
                                            GET /themes/flow/frontend_assets/images/icons/favicon/apple-touch-icon-114x114.png HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: image/png
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 951
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-3b7"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 114 x 114, 8-bit colormap, non-interlaced\012- data
Size:   951
Md5:    76852bc6b2c028db97322a74e85bd020
Sha1:   ed52fb4de0d51f93277bbaae42fa80ba5f92c31e
Sha256: 8a5ef2ef8440c17db1b1b539065ba4a887e07a2c508b79c2d1659512e9016884
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6509
Cache-Control: 'max-age=158059'
Date: Wed, 21 Sep 2022 20:08:23 GMT
Last-Modified: Wed, 21 Sep 2022 18:19:54 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /1YlRSZkgBOzwAdxY9NltxVm1qUHxEPiEJJhJpKwkeUGwEHiITYhoAKicGdBIyBmliQCQDOjVbbgc6MVt5RDU2BHVWcicHdQ87KA8kDjV3VA5XemJDelJ8Kld5R2cQQ3pSODsIPRpxYFYwWmINUHxHZxBDelImJEN7I21kSHhLcWBWLwc3OQltUBJgVnlSZG-NWeUdmYgAhEDE0CTBHZhRffkxkdBN1Uw HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://autifuleedeh.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 187
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: nsanXa1Q3xTDrEzHtbYq1QAQod5oCkc2ikg8Sj5lpekvnv42yTwt5Q==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   187
Md5:    c672e7618653f165323569227911045a
Sha1:   2b8a8bba2c339e22800948f31f83b83e1a03ec27
Sha256: 0af6e9b383c65e52b1346961d056dfc9ee6fced17486889de0492c262de257cb
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /NUzV0U3AwWho1TydcEG5HZQRFa0Z1Xwc8HiMILRcqCgAsMB06EwApFG4FUj8RPVJJdRU9VkliVjJRFm5EdUEEPBtuRgI6GDpUAjwYMBMBMk0+Wg46HD9UUWE2ZhtEdkJjHQxiQXYGNnZCY1kdPQUrEEZjCGsDK2VEdgY2dkJjRwJ2QxIMQn1AehBGYxc2Vh-88VWFzRmNBYwVFY0F2B0Q1GSFQEjwIdgcyakZ9BVImTWI HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://autifuleedeh.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 588
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: W8ffZlXBvPwilgMw-2pQiNqc_-bbK9-AuLXmb9flkaxaA1xGqbfw8A==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (825), with no line terminators
Size:   588
Md5:    daffad1501bd704e830bb74e1dc4f94e
Sha1:   56d59c3304ab138b4cc632576bbf944362d4e552
Sha256: 405afb8a85af33d9f5e2ce5f33dbce7746e4512f85e2e055cd22ae451b725b13
                                        
                                            GET /AcUx4VWISIxYzXQUlHGhVR3hJYVNXJgs6DAFxKAVaQSoAHlshGTo5WjQuEXMWCyhFZUQdLRYyX1cpFjZfQGoZMQBMeF4hEh4nRSYUGCQRNBQeJBtzFxBxFToYGCAUNEdDCk17UlR+SH0aQH1dZiBUfkg5Cx85AHBQQTRAYz1HeF1mIFR+SCcUVH85bFRffF-FwUEErHTYJHmlKE1BBfUhlU0F9XWdSFyUKMAQeNF1nJEh6VmVEBHFJ HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://autifuleedeh.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 594
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: AwuIrqmpwBgXT5jgn-W8cE10AaHIt4Aj447Si_B-Mzccgwcu62NuNw==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (828), with no line terminators
Size:   594
Md5:    3ca3be82965737208caa3c5fdc5e4035
Sha1:   f6ae64dde3a8468f7b0931ce07c13c14292e9f83
Sha256: 74492c2eeaac71b9781258ff2d82540b2bcfb6a05fd167511ff283a668adb1ef
                                        
                                            GET /vamxvdEgJAwESdx4FC0lwWFlWRXlMBhwbJhpRHxUvUws1PnkhKUkAMg5RX1IkCwIISW4PAgxJeUwNCxZ1XkobBCcBURoaLA8KBhotDkoaFXUHAxUdJAYNSkYOX0JfUXpaRBdFeU9fLVF6WgAGGj0SSV1EMFJaMEJ8T18tUXpaHhlReytVWVp4Q0ldRC8PDw-QbbVgqXUR5WlxeRHlPXl8SIRgJCRswT14pTX5EXEkBdVs HTTP/1.1 
Host: dmmzkfd82wayn.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://autifuleedeh.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         143.204.42.115
HTTP/2 200 OK
                                        
content-length: 356
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: BHSOT7qNpyhe8PEcAzWStOFvmEh9pUTrOomiCThwOigHxN0l_Aw1bg==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (450), with no line terminators
Size:   356
Md5:    5956de710dde7ef029bfcbae944a88f4
Sha1:   659fb73dd6b64cef3aad01a7a4e4eded3fe87c94
Sha256: 981fefa26cca56f82e94b3e9209c7e5c2081e3928f032cebf55c44f1fef2d48d
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 19826
date: Wed, 21 Sep 2022 18:41:12 GMT
expires: Wed, 21 Sep 2022 20:41:12 GMT
cache-control: public, max-age=7200
age: 5231
last-modified: Sun, 11 Sep 2022 13:50:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   19826
Md5:    cae538dcce82598fbe43c0bf443e62dd
Sha1:   cc68ac6be9c5e0087a0000e5735b83270ace30f5
Sha256: 954b9e9d9744e1319c51760780a35de2dec353afffac705c2cca6d836a5e056d
                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "1B61227954588BD684190C9897BA69590605E5D0F42E85DE265506255329D2C6"
Last-Modified: Mon, 19 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19836
Expires: Thu, 22 Sep 2022 01:38:59 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "1B61227954588BD684190C9897BA69590605E5D0F42E85DE265506255329D2C6"
Last-Modified: Mon, 19 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19836
Expires: Thu, 22 Sep 2022 01:38:59 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST /v1/api.php HTTP/1.1 
Host: syndication.exdynsrv.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 328
Origin: https://megaup.net
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         95.211.229.247
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Request-Method: POST
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex, follow
Content-Encoding: gzip


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (5178), with no line terminators
Size:   2308
Md5:    aa6158b9519fb0aa4775bb6a26cad006
Sha1:   6636e599a9173d3e8e9af002ea0852df6e8dcf18
Sha256: b29b46fbf80a8759d3cb6841deb597c5e6487515a14bc5b019f4a64afb7084ec
                                        
                                            GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1 
Host: accounts.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.237
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Sep 2022 20:08:23 GMT
location: https://accounts.google.com/v3/signin/identifier?dsh=S117716816%3A1663790903724643&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQDHYWrT1MV_cfh0FaT2gyjGJx1uC7zGYoPNYGzGni7X0FKLf_TC5H3AIWQgLs3gmQf-SGwSwMN7Bw
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: script-src 'nonce-jEEWLyhsfbGGpZxA2ycHbQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 397
server: GSE
set-cookie: __Host-GAPS=1:JhHns3fzskScfBQ1DglvnMsr49Rsag:o18OHsZrxP8kxrZH;Path=/;Expires=Fri, 20-Sep-2024 20:08:23 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (383)
Size:   397
Md5:    ff3bb65ce59fed6160d04be8b8fbf979
Sha1:   0b4dbdd3ba474ff3e4348ea8da885869c6c062bf
Sha256: a7d2ee30e7f9f35871f4bb35e75352e1258e814c055e7edbcbbe8391734e2bc5
                                        
                                            GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1 
Host: accounts.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.237
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Sep 2022 20:08:23 GMT
location: https://accounts.google.com/v3/signin/identifier?dsh=S-2096514223%3A1663790903735190&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQDHYWo7kSi4h5CYxZgnnWMcBemQV5s0YISd5EEjp5zHyLj70pDWfzTRXMHkGYffJCk8S1ApVv3HOA
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-DFo31cV-e5wNErdYJSfsHQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 394
server: GSE
set-cookie: __Host-GAPS=1:wWqG-KP-4-B1EUMcpA723XP5RUtwjg:tp36YYF3gg7bkzci;Path=/;Expires=Fri, 20-Sep-2024 20:08:23 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (381)
Size:   394
Md5:    874cef31901db27a260eec2313c1e983
Sha1:   76c432dcbe4d52b993bafb488ab98ca000594a55
Sha256: e26918a3bcf4f88dc3b66b2221d6239497772f7cf049787555b18595c7cf7dca
                                        
                                            POST /j/collect?v=1&_v=j97&a=1226336280&t=pageview&_s=1&dl=https%3A%2F%2Fmegaup.net%2F37wpQ%2FDEMSLAY-KNY-THC-(USA)-NSwTcH-%5BBASE%5D-NSP-(eShop)-Ziperto.part1.rar&ul=en-us&de=UTF-8&dt=DEMSLAY-KNY-THC-(USA)-NSwTcH-%5BBASE%5D-NSP-(eShop)-Ziperto.part1.rar%20-%20MegaUp&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=YEBAAUABAAAAAC~&jid=1230967207&gjid=64487966&cid=1515094966.1663790904&tid=UA-108868042-1&_gid=2103139788.1663790904&_r=1&gtm=2ou9j0&z=698543950 HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Content-Type: text/plain
Content-Length: 0
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin: https://megaup.net
date: Wed, 21 Sep 2022 20:08:23 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  very short file (no magic)
Size:   1
Md5:    c4ca4238a0b923820dcc509a6f75849b
Sha1:   356a192b7913b04c54574d18c28d46e6395428ab
Sha256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3165
Expires: Wed, 21 Sep 2022 21:01:08 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "1B61227954588BD684190C9897BA69590605E5D0F42E85DE265506255329D2C6"
Last-Modified: Mon, 19 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19836
Expires: Thu, 22 Sep 2022 01:38:59 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3165
Expires: Wed, 21 Sep 2022 21:01:08 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "1B61227954588BD684190C9897BA69590605E5D0F42E85DE265506255329D2C6"
Last-Modified: Mon, 19 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19836
Expires: Thu, 22 Sep 2022 01:38:59 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f06ad5e-83fd-449e-b227-1b9d5389e57d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10244
x-amzn-requestid: 71f08b9e-e977-48de-ad60-5192a43db517
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YYwBkGqjIAMFz0Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63202d3d-0af3334d085ca4a764e31bb5;Sampled=0
x-amzn-remapped-date: Tue, 13 Sep 2022 07:11:57 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 7FaZfI_iYUANPdxGBld5NfneWwKJeX2nYA_gmvF9NjML5YOVhZIIoA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 21 Sep 2022 19:20:13 GMT
age: 2890
etag: "b1cd04a66852694284eeef16a1cde38896e33c03"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10244
Md5:    14e6ddceb639a5f4875aecb796f95c79
Sha1:   b1cd04a66852694284eeef16a1cde38896e33c03
Sha256: 4c0657a00d7fb4caefa64c28340cad94a306cc393cffe692fcc69c65a80f2391
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc349860f-d61d-42ea-8638-7ebcefe23e00.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12545
x-amzn-requestid: 6720348a-0245-486b-a978-2df18eb4bd43
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yl7YKHayIAMFo1Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6325729a-2601f775219651777cba839c;Sampled=0
x-amzn-remapped-date: Sat, 17 Sep 2022 07:09:14 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: NdQpOGtyA7AxpmkvFf3K3IrkgSku9QQzQ4BvpoRfTv16Kj1Gr6n7oA==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 21 Sep 2022 07:34:13 GMT
age: 45250
etag: "9b17ad091f936a8dd50126ce9ad5f9a7fd7d55f8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12545
Md5:    1976af26c5d4a671c8298bffafc90ce3
Sha1:   9b17ad091f936a8dd50126ce9ad5f9a7fd7d55f8
Sha256: 2349b9e1233d43cf8d0ff273f8bf6147dda00314fd631a81cb278ce0b8e32684
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4c2e0de8-088f-449b-a3cb-bbb83e3883a6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11832
x-amzn-requestid: 75065a71-5f2d-4987-915b-9bddc772c76a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YugI_EsLIAMFdmQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6328e09f-1248d25405209da3353d4a4a;Sampled=0
x-amzn-remapped-date: Mon, 19 Sep 2022 21:35:27 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: gLh2EBTPdXvFtZuYKH1NVZebvnz4Rhs-f_rZPtfJpIWNemEk0upeOQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Tue, 20 Sep 2022 22:07:08 GMT
age: 79275
etag: "8b91bc3069a3217bc719c27959d578b353b5d9dc"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11832
Md5:    2ed7323b395e757f7766ea0045efdaca
Sha1:   8b91bc3069a3217bc719c27959d578b353b5d9dc
Sha256: 8daf8cb1464daa5f72bc4f1049adb4aba00b2c2dec11cb3ade3454ec2ebbfb63
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1874c3ef-e614-4fd9-9d88-b87eac5ea0e6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9201
x-amzn-requestid: 6dbfae76-f9ab-4f31-9b62-bcf5d9ce4515
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YxzxlEYcoAMFaQQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632a333d-7d147481402cc46a751b72ed;Sampled=0
x-amzn-remapped-date: Tue, 20 Sep 2022 21:40:13 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: JEb0g486u6AjYFbf8rSbreKjh0m1GsAGbvykHl0oahmVN2ciqe5FOw==
via: 1.1 7dcaa43cd0535d889b549e6a30a57aa0.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Tue, 20 Sep 2022 22:14:57 GMT
etag: "1eef1ab0099d09d1cf965b6e7b55fe2aa4e18e54"
age: 78806
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9201
Md5:    a692964324dbb9c460a1b855808d02e6
Sha1:   1eef1ab0099d09d1cf965b6e7b55fe2aa4e18e54
Sha256: 3fa9e780d62fffb635064aeed542c8e04923ff943c6080476836fab6c24e2426
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19a7100-8d4f-4c0a-8865-191670cb2db4.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6667
x-amzn-requestid: 1798057c-208d-471e-8d5c-602631418afd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yxy1nHvsoAMF23A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632a31bd-121c21f710767cde77a06945;Sampled=0
x-amzn-remapped-date: Tue, 20 Sep 2022 21:33:49 GMT
x-amz-cf-pop: YVR50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: vdjC0dj8L5qN-SdmlBD_TD0T0hdFtWzmnC9_AdJVP5qTi9dWz6_K9g==
via: 1.1 e71753cf85369390852fdcb22bf59aa8.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 20 Sep 2022 21:40:13 GMT
age: 80890
etag: "65886e11d9f792452cceea23444722ff4028b081"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6667
Md5:    9c4ba493d60a12accc1dc9c3299fa01d
Sha1:   65886e11d9f792452cceea23444722ff4028b081
Sha256: b287b0bf2b3dc834a657dc98a9eef006577554306fa481bbc9de5a16943129f1
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe6be1360-d048-4319-9cac-dfebe92db87f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9271
x-amzn-requestid: b8139dfc-8f24-41e0-9948-56bad215416c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yx0Q-EkZoAMF_sw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632a3406-4365026f7f832cee0c12e4d7;Sampled=0
x-amzn-remapped-date: Tue, 20 Sep 2022 21:43:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QhTzqhSMCDgWwTSsmfM_3jBwV-g0fVABMLy-gwrjoxaoE4VomNqahg==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 20 Sep 2022 22:38:46 GMT
age: 77377
etag: "4183102af1963e1edb3aa572c43aeda7d855e9f5"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9271
Md5:    267173c6b4e4e6ae4a84dc08df92f82f
Sha1:   4183102af1963e1edb3aa572c43aeda7d855e9f5
Sha256: 20487bb2e59f2e6afcaaac3e3c4f1dfec9a8ef761403a44f7f92a6b57d143714
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6509
Cache-Control: 'max-age=158059'
Date: Wed, 21 Sep 2022 20:08:23 GMT
Last-Modified: Wed, 21 Sep 2022 18:19:54 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 21 Sep 2022 20:08:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 346
ETag: "1B61227954588BD684190C9897BA69590605E5D0F42E85DE265506255329D2C6"
Last-Modified: Mon, 19 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19836
Expires: Thu, 22 Sep 2022 01:38:59 GMT
Date: Wed, 21 Sep 2022 20:08:23 GMT
Connection: keep-alive

                                        
                                            GET /v3/signin/identifier?dsh=S117716816%3A1663790903724643&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQDHYWrT1MV_cfh0FaT2gyjGJx1uC7zGYoPNYGzGni7X0FKLf_TC5H3AIWQgLs3gmQf-SGwSwMN7Bw HTTP/1.1 
Host: accounts.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         216.58.207.237
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
                                        
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Sep 2022 20:08:23 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'nonce-u3xbJh4sOKi0gL5qZaR6uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi/external"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
set-cookie: NID=511=lC3OoJAP-pv9vHxXPUDfB3j5LYYia21p6s42GSsQmbZUU5ekzsssST2qlv9kgwgnsG5ULtLJaY50xzgXUFJtUMsgnYZ6otGaSwQFsqIBblmsKHNl34Y6ggKMuwn--Yjwt5M2a9wiztQFNDk89ZFhgvuGdyp0_u2VW-3OEcaFO-A; expires=Thu, 23-Mar-2023 20:08:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (1644), with no line terminators
Size:   807
Md5:    92a2e1719d7c1aea864123fb465b9623
Sha1:   36198f784ec4a3a9c48b892e43585684218fd97b
Sha256: 1e70985317f22d261bb5dca2c1166c7d9b332f24e3423a4d3721e9f53d16241e
                                        
                                            GET /cimp.php?t=api&data=H4sIAAAAAAAAA02OUUqEMQyEr+IF/pKkSdrss88Kigfov9v1yUVwBYU5vG0XxX60HcpkOkIiG8UmfMd+oHqQjOAUlFQSm+Lh8QnKeOuv7fM9XfoVZqzk8AjSishaxaHqytVhzDAJieEolo28CNiQQQOxrDpVIiJmRyW8PN+vzQMhjHN+CanQoelrzXGNNjm67VLO5+anvXo3N6Jc8jT+r0g3EmWPGfv7MNh4XWMRlmof35cj8Ge4FYStqZGsSiMie6fR4SSeRau1VrpbcLMuvO/FfgCu3X64SAEAAA== HTTP/1.1 
Host: syndication.exdynsrv.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://megaup.net
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         95.211.229.247
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Wed, 21 Sep 2022 20:08:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Credentials: true
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A31%3A%22632b6f37e3e7c2.2678582237095774%22%3B%7D; expires=Fri, 20 Sep 2024 20:08:23 GMT; path=; domain=.exdynsrv.com; Secure; SameSite=none __upt=%7B%22v%22%3A1%2C%22id%22%3A%22632b6f37e3e7c2.2678582237095774%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22511.0199%22%7D; expires=Fri, 20 Sep 2024 20:08:23 GMT; path=/; domain=.exdynsrv.com; Secure; SameSite=none
X-Robots-Tag: noindex, follow
Content-Encoding: gzip

                                        
                                            GET /library/551406/df77b12b1430519b8a4ad553ee1c08c5abcc34f5.jpg HTTP/1.1 
Host: s3t3d2y8.afcdn.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         185.76.9.14
HTTP/2 200 OK
content-type: image/jpeg
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
content-length: 11616
last-modified: Wed, 08 Jun 2022 05:29:21 GMT
etag: "62a033b1-2d60"
expires: Fri, 30 Jun 2023 18:20:00 GMT
cache-control: max-age=31536000
access-control-allow-origin: *
x-cache-op: HIT
x-accel-expires: @1688300730
server: CDN77-Turbo
x-77-nzt: AblMCQ0U/8D//TVrAA
x-77-nzt-ray: +oGgPSkaWgE
x-cache: HIT
x-age: 7026173
x-77-pop: stockholmSE
x-77-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 300x300, components 3\012- data
Size:   11616
Md5:    47b239f5f7f93527c72c9b1b87999a0c
Sha1:   df77b12b1430519b8a4ad553ee1c08c5abcc34f5
Sha256: 5f674910cc840142adf59454d0c5f799549c7ada943c49f07ccca90086f05f60
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "FF236B4CE4BD2A71AEB2387F5BBE6E6BA31BB3D31DB72ADAC59822C0842412EA"
Last-Modified: Wed, 21 Sep 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3420
Expires: Wed, 21 Sep 2022 21:05:24 GMT
Date: Wed, 21 Sep 2022 20:08:24 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: wasanasset.buzz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Content-Type: text/plain;charset=UTF-8
Content-Length: 386
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         44.195.137.121
HTTP/2 200 OK
                                        
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2

                                        
                                            GET /themes/flow/frontend_assets/fonts/raleway_bold.woff HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2; _ga=GA1.2.1515094966.1663790904; _gid=GA1.2.2103139788.1663790904; _gat_gtag_UA_108868042_1=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: font/woff
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:24 GMT
content-length: 31568
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7b50"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 31568, version 1.1\012- data
Size:   31568
Md5:    e0c4ac0e73196bd0469c5c33304b7773
Sha1:   bb071565f82907d117b0732dca8013409162c67d
Sha256: ff3bf3a4a1bf2b922157b18d0e8cddd95f2fc2dfe09c30a3ce67bc11a84c67af
                                        
                                            POST / HTTP/1.1 
Host: wasanasset.buzz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Content-Type: text/plain;charset=UTF-8
Origin: https://megaup.net
Content-Length: 349
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         44.195.137.121
HTTP/2 200 OK
                                        
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2

                                        
                                            GET /a-ads-banners/406681/300x250?region=eu-central-1 HTTP/1.1 
Host: static.a-ads.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ad.a-ads.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers

search
                                         78.46.174.169
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:24 GMT
content-length: 621339
x-amz-id-2: /dCUmfPa9NF96Mf+curnMHPk5e4g//qetUDtT3j4itxy/A3KKZ954+kGWOJA/DISdohi8pL/X2Q=
x-amz-request-id: TNHMYKEFT2SAHNED
x-amz-replication-status: COMPLETED
last-modified: Thu, 04 Aug 2022 08:12:39 GMT
etag: "c8694e7d5d3b9a928d4d57026ac2b68b"
cache-control: max-age=315360000
x-amz-version-id: 4E6UO4Ah7Y9Th7PfdrLCDL4YiygucdkX
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 300 x 250\012- data
Size:   621339
Md5:    c8694e7d5d3b9a928d4d57026ac2b68b
Sha1:   169b9f311167e19bd5061b53fc7e4f528e3ba7a9
Sha256: 0c23834abdcff9f74a47b37290da55f2c84c31c82ce26d9493b39a388b51ed6a
                                        
                                            GET /Q2R3NVAYRk8GYnVXRBd8YUZbFzZ3AE4AYSYAWgZgc11aAWh0AloNNnVRWg1hIV0WAmcmVUJWNmFIVVRiJlFGB2Z2SRMEZ3RJQwFpdElODWZ7SU8GZnIFFgJhIlMWAHJvRgRCcm9GAFQjIgoWRiMmEFlXJTkeVRlyclRZAHJvAhZZIyZIEVQ8MAFbUzEvFxJo HTTP/1.1 
Host: wasanasset.buzz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         44.195.137.121
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
set-cookie: 4613507216d9b6a522c258a9db8200ca=1; Max-Age=604800
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET, POST
access-control-allow-headers: X-Requested-With,content-type
cache-control: public, max-age=86400
etag: W/"8445-tNdmqaFP5bISM2gCDQf2tDi9b5k"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (33861), with no line terminators
Size:   13202
Md5:    285cda5a254672c8f363f2a833f8a4d0
Sha1:   933059ac4b91d9bf2bd6b824bd89e39e68d50a00
Sha256: b532b56959e3b90f09df1ba5e76bb1fe3b935a88e1b6aa14752546e919f09094
                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 344
ETag: "DF3EB14F89AC54E2F1C00A4F0CE9450F07ED8E03D55C6ACE7164CB9A2C5B4ABA"
Last-Modified: Wed, 21 Sep 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Wed, 21 Sep 2022 20:55:46 GMT
Date: Wed, 21 Sep 2022 20:08:26 GMT
Connection: keep-alive

                                        
                                            GET /QmRKS3c5Rjk8KDcWJmlNYAw%2BPwcxXmVkGicDKz4HbAovP1gxE2QhBGBIaDgaJEZweltgECssKCsAaHFVeld4fURxRmZpBDcGFSITcEZwaRF2AHN%2BRicAZ3hHcl1nf091AmdzEXRRZ3NGIF0rfEAnVX8oEWAZ HTTP/1.1 
Host: societingna.info
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         44.195.137.121
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
set-cookie: cdde69789462c769870f4a20aa292008=1; Max-Age=604800
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET, POST
access-control-allow-headers: X-Requested-With,content-type
etag: W/"e0f9-DjfGRi0Dru7zxfxiCuhOVzne3po"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (57593), with no line terminators
Size:   22903
Md5:    2e5576295eeba6533190812317f18e42
Sha1:   36a0d30bb7143156cff4c4cf05ae4650bb944955
Sha256: f6884ec2de1783ebae3467aaf1d9b6d18675166344c93b7e4be15d1098151e75

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /thumbnail?i=tJ*qUAMK0kk_0&imgt=icon HTTP/1.1 
Host: xml.serve-servee.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.64.111.7
HTTP/2 302 Found
                                        
date: Wed, 21 Sep 2022 20:08:26 GMT
content-length: 0
location: https://static.serve-servee.com/n337/ad/250x250_hqCCg8Cm.png
cache-control: no-store
age: 0
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jo6ALwslAWwKTio9t7CW0UOAw5CaJ1%2BJb7%2FmOoSoLh6msV7gPFuCFgH9aNEtIFoIY5dKmzyyzsc7tfMhScWgBcFDrfeImEkMpkoIeVM2AgUiCo%2BUhCzRK%2B5obijHOpijkH%2BnFHUgjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56ecf2e9406aa-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 344
ETag: "DF3EB14F89AC54E2F1C00A4F0CE9450F07ED8E03D55C6ACE7164CB9A2C5B4ABA"
Last-Modified: Wed, 21 Sep 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Wed, 21 Sep 2022 20:55:46 GMT
Date: Wed, 21 Sep 2022 20:08:26 GMT
Connection: keep-alive

                                        
                                            GET /n337/ad/250x250_hqCCg8Cm.png HTTP/1.1 
Host: static.serve-servee.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.64.111.7
HTTP/2 200 OK
content-type: image/png
                                        
date: Wed, 21 Sep 2022 20:08:26 GMT
content-length: 88957
last-modified: Thu, 08 Apr 2021 13:54:09 GMT
accept-ranges: bytes
etag: "606f0b01-15b7d"
cache-control: max-age=86400
x-hw: 1663790906.cds296.lo4.h2,1663790906.cds103.lo4.c
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QI3tNzXron3suJjDkylqGXE%2FwJvdqm03eD0C5UoEss0Tq4PW%2BYPdpT6DXB3Iqw56ZO1A7LTm4VrC9LhcngmdeMHn7JvFSYGZmZX5ycqEtWQshnkP%2FzvklspbR5KapqPhLFlUG8XlTAri7w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56ed0083b06aa-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 250 x 250, 8-bit/color RGB, non-interlaced\012- data
Size:   88957
Md5:    0994ec31361ea569c5549063145bfdd2
Sha1:   9b270e9f7a346a0f0f60a978e154f49740350270
Sha256: e4dbff1cf1f9750d68296737897eba9bd59ebdcb292015e87c3be61b5c242422
                                        
                                            GET /themes/flow/frontend_assets/fonts/raleway_medium.woff HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2; _ga=GA1.2.1515094966.1663790904; _gid=GA1.2.2103139788.1663790904; _gat_gtag_UA_108868042_1=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: font/woff
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:29 GMT
content-length: 31900
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7c9c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 31900, version 1.1\012- data
Size:   31900
Md5:    1b285c8e5b7445a8e434b2cdf036bab2
Sha1:   c97d4772fbb5c5637d466b5f991bc7ec28830b32
Sha256: 09b979826f2ac158a63ba234042c66414c21282d0bb46eadc62c64a873778825
                                        
                                            GET /37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
vary: Accept-Encoding
set-cookie: filehosting=lg0bthv1oef5abnt39692vjbd2; expires=Thu, 22-Sep-2022 20:08:22 GMT; Max-Age=86400; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.iframe-transport.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-2427"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /asd100.bin HTTP/1.1 
Host: pogothere.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.64.107.19
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 1582
last-modified: Wed, 21 Sep 2022 19:42:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PdExnqYCEdy4iHm6K6rdb%2FIqH%2B%2FGg4TrlMgN6QWBleOILjq711nK9f4kObqy%2FuCGknolFZw6NioEXhZykb9jLSSw9LnyPULTm%2FwiGreyQDxumWGoY1hZH5Nf%2BmYNT0eI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74e56ebc9b84755e-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.fileupload-validate.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-fea"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /sw.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:52 GMT
vary: Accept-Encoding
etag: W/"60758f38-12fe6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /async.php?domainid=5593&sizeid=12&zoneid=6192&k=1663790903114 HTTP/1.1 
Host: platform.bidgear.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         172.67.74.36
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
vary: Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BqtU3wk5T1eutrSR9erjHrtHAbIXbN3UkuOOipuOh%2F%2FZ9qb5o8Bf9AbAXeMByxGBpLoKybrJxa5Bb2Hhw1f4QJLffmj0%2BYW8%2B60y7RZL25LPzX1QMAoTXq7KMyj6bc%2BVwtN2fYsN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56eb9bccd0b59-OSL
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.fileupload-process.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-14b6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/canvas-to-blob.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-408"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/retina/retina.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-52e"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/images/icons/favicon/favicon.ico HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: image/x-icon
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-47e"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/bootstrap/bootstrap.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-71b6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.revolution.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-303b2"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/custom/custom.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1420"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/css/custom.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3577"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/styles/font-icons/entypo/css/entypo.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-45f5"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery-ui.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-6a684"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/styles/file-upload.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-21ec"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /asd100.bin HTTP/1.1 
Host: pogothere.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.64.107.19
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 1582
last-modified: Wed, 21 Sep 2022 19:42:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zUKiomIdXLOJd4r0MO99CNGvWU6YO2KOiENsaxlW%2FjDMyyXLwmJBfGHCtp75RQiFv91T%2FTIuZXava7DrpUQzoa%2Bf42rKpWxED63Qt9dKG80V9twAQUroqA2u%2F3cfIaTP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74e56ebc7b60755e-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/animation/jquery.appear.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-5c6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/fonts/font-awesome/css/font-awesome.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-59d6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp HTTP/1.1 
Host: www.facebook.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         157.240.200.35
HTTP/2 200 OK
content-type: text/html; charset="utf-8"
                                        
content-encoding: br
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
vary: Sec-Fetch-Site, Sec-Fetch-Mode, Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-fb-debug: lnMpxCpNcMmZnQflnnNXsGaa7RNOoFS40xUtj11Wv585o0uoOGWincbDIUwF5zpBlJWyDDiXF5bN+uH1HJ0cPw==
date: Wed, 21 Sep 2022 20:08:23 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /v3/signin/identifier?dsh=S-2096514223%3A1663790903735190&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQDHYWo7kSi4h5CYxZgnnWMcBemQV5s0YISd5EEjp5zHyLj70pDWfzTRXMHkGYffJCk8S1ApVv3HOA HTTP/1.1 
Host: accounts.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         216.58.207.237
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
                                        
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Sep 2022 20:08:23 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: script-src 'nonce-0kkFZ5r1Lt4OxIo3gWLmSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
cross-origin-opener-policy-report-only: same-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
set-cookie: NID=511=vP0-a5Ztd89Cw9ccc_05iK7RtZrU6npqofTF3iEHyYhqGcOAq8r5XZoHZg2c0-AdyOmlgx0wOvNoCnAICOn12ostFzJ4BzjXIOI_dUbKZSIGjRJTL5pESoe2uISdSKIKmcZn7cchA197nNAC5BF_-BEkO_YffQULIkJHVy4xM6w; expires=Thu, 23-Mar-2023 20:08:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.fileupload.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-dbd4"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.fileupload-resize.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1f7f"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/sticky/jquery.sticky.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1099"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/SmoothScroll/SmoothScroll.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1cdf"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /asd100.bin HTTP/1.1 
Host: pogothere.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.64.107.19
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 1582
last-modified: Wed, 21 Sep 2022 19:42:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YrPA%2FkiAY6dUnwFflPCmc1AssPISFB8AKHtqWw8SGZ1xtWljXHp8HwytHHYrBcxbQ5cq7%2F8WTH89sU5rZMX6bg4%2BeqxtcY3M%2FIbtMqLfWOAEnEmAETzwdFeBgZztOqdQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74e56ebc9b90755e-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.dataTables.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-10fe4"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/nav/jquery.scrollTo.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-981"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/nav/jquery.nav.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1547"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery.tmpl.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3cb"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/clipboardjs/clipboard.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-2296"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/css/fonts.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-690"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/jquery-1.11.0.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1787d"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/load-image.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-9f2"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /sw.js?eXZ4SEoiVEB7eE9FS2pmW1RUaixNEkF9exwSVXt6SU9VfHJOEFVwLE9DVXB7G08Zf30cR00rLFtaWil4HENJenxMWxx5fU5bTHxzTltBcHxBW0B7fEgXGX97GEEZfWhVVAs%2EaFVUDyk5GBgZOzkcAlYqPwMMWmRoSEZWfWhVEBkkORxaHikmChNULisVBR0V HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2; _ga=GA1.2.1515094966.1663790904; _gid=GA1.2.2103139788.1663790904; _gat_gtag_UA_108868042_1=1
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:23 GMT
last-modified: Tue, 13 Apr 2021 12:31:52 GMT
vary: Accept-Encoding
etag: W/"60758f38-12fe6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/isotope/jquery.isotope.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3ead"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/gauge.min.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-45b8"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/js/zeroClipboard/ZeroClipboard.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3bd2"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /1811811?size=300x250 HTTP/1.1 
Host: ad.a-ads.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         78.46.174.169
HTTP/2 200 OK
content-type: text/html;charset=utf-8
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:24 GMT
vary: Accept-Encoding, Accept-Encoding
status: 200 OK
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-powered-by: Phusion Passenger(R)
x-original-referer: https://megaup.net/
x-robots-tag: noindex, nofollow, nosnippet, noarchive
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/js/isotope/custom-isotope.js HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/37wpQ/DEMSLAY-KNY-THC-(USA)-NSwTcH-[BASE]-NSP-(eShop)-Ziperto.part1.rar
Connection: keep-alive
Cookie: filehosting=lg0bthv1oef5abnt39692vjbd2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         91.209.70.182
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Wed, 21 Sep 2022 20:08:22 GMT
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-71d"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET / HTTP/1.1 
Host: pogothere.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.107.19
HTTP/2 200 OK
content-type: text/plain
                                        
date: Wed, 21 Sep 2022 20:08:23 GMT
set-cookie: csu=1479504048380993@1@1663790903; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=deF2FJa2Sq4OUsAeE7%2Frz1PJz7nY9iy06%2FmOh451hJq1pV7cU1Jk%2BoxoagjK93GDW%2FD9fqLWgSTeW4LLEBRFil4FDWZHLOOhcYIZcQOkkdchUJtfsMqHQa9ez%2BuhtFxe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74e56ebcdbea755e-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /themes/flow/frontend_assets/css/responsive.css HTTP/1.1 
Host: megaup.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1