proportionartifact.cn/milka-aq/tb.php?bd=xi1666364469543
104.21.64.236200 OK 551 B URL HTTP/1.1 proportionartifact.cn/milka-aq/tb.php?bd=xi1666364469543
IP 104.21.64.236:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (529), with CRLF line terminators
Hash 66f393eb4a227e3d7e4c12f1c912b53e
60f49eece993d0806bf734b33700be33fab68529
6cb2caacb47920aa24dafaa6169f7436a44a67b8a2b08ba74ed2e3e46a5e0de0
Analyzer Verdict Alert fortinet Phishing
GET /milka-aq/tb.php?bd=xi1666364469543 HTTP/1.1
Host: proportionartifact.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 22 Nov 2022 10:48:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ZSvJotqwMCciV8dGYv7EKWB%2B%2BTXfLUrRpWO1GQCFo9mqyKmFAbWPDUxnevFu4o01ExI3zegJewZ7Is0ay1pnAMnm6YnhWKX6qWs0o1GIOxzBEPZO0hwGBLDhyEFaltPe6s551zOn0s%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76e1182d9e3cb515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1456357aecbd23f21ad98da57e0127eb
7074815b39fa8da9013883971d665e4c1b0797ea
f3eba265ee64870b2f822f1511b36c747d763c382557789cdad8be1d3b52d1f5
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F3EBA265EE64870B2F822F1511B36C747D763C382557789CDAD8BE1D3B52D1F5"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6399
Expires: Tue, 22 Nov 2022 12:35:23 GMT
Date: Tue, 22 Nov 2022 10:48:44 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 4843de3bf95411e6aa89834def44bb86
1f1882351ac63fba73a22014382f69df5e02ec96
1e6ed1df02f8fa6c89ddca66f7c9981f8a06127d7ec90b503703137e823bb4b7
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2668
Cache-Control: max-age=88021
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:44 GMT
Etag: "637b5375-1d7"
Expires: Wed, 23 Nov 2022 11:15:45 GMT
Last-Modified: Mon, 21 Nov 2022 10:31:17 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash d130218d0e2841f39c99610fe1a2ab90
29fbe1e177ee55c7a61ae0a206afff271cf5f945
6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 22 Nov 2022 10:09:18 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2366
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 8a6c553d89cb6fd1de4787fee2a0e0dc
b974e022ea8675c0a09f58864cc99df05b5b1241
a62ecedcb0953814f982237818a3d902fdca501f82b675629d28b5d476e0fbfa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A62ECEDCB0953814F982237818A3D902FDCA501F82B675629D28B5D476E0FBFA"
Last-Modified: Mon, 21 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4255
Expires: Tue, 22 Nov 2022 11:59:39 GMT
Date: Tue, 22 Nov 2022 10:48:44 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: cPwmrE4jA+oL2pBhomE5gIf4hSuDyyFWd0R4S6T42mDs9n2Cal3BFZcl4YE3kjDaiqG72YUK40Y=
x-amz-request-id: V8X90JYZ6EQJVA0S
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 22 Nov 2022 10:39:31 GMT
age: 553
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 22 Nov 2022 10:48:44 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
proportionartifact.cn/favicon.ico
104.21.64.236200 OK 455 B URL HTTP/1.1 proportionartifact.cn/favicon.ico
IP 104.21.64.236:0
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 3c5d244b8b6b192c76a2c4331450c235
7e53f5ad871fcd67705eaf77f1ca9ff247143e1e
e0f26b6349453a86cd1f0f87cfd80559ef7edb6d88ff0af9ced7d7e413c548e3
GET /favicon.ico HTTP/1.1
Host: proportionartifact.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://proportionartifact.cn/milka-aq/tb.php?bd=xi1666364469543
HTTP/1.1 200 OK
Date: Tue, 22 Nov 2022 10:48:44 GMT
Content-Type: image/x-icon
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 27 Dec 2016 03:54:11 GMT
ETag: W/"5861e5e3-1b0"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xtQcmMMNNpzhlLLRMzwwjWm%2B7S9VRvfDir%2B7DrFt9iLHb6J6FS28NjrsYSYtruU2dOrQ2OuYV%2FgpVfM0jXHylMwP4hvOXG7XTLFsinBeEC6Rl4772WB6LSCYExM8GzxzQaILyGd8zdM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76e1182fd96db515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
proportionartifact.cn/j/og2.js?_t=1669114124697
104.21.64.236200 OK 942 B URL HTTP/1.1 proportionartifact.cn/j/og2.js?_t=1669114124697
IP 104.21.64.236:0
File type ASCII text, with CRLF line terminators
Hash bad1af26351d2e87c035596233940ab0
9ac0e34dcbfd29ca3070c506c200777a8016b161
bc734ed6fc97cbcbaa0ed5236ce8aa46754596a9a79eef96684242d231d0644e
Analyzer Verdict Alert fortinet Phishing
GET /j/og2.js?_t=1669114124697 HTTP/1.1
Host: proportionartifact.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://proportionartifact.cn/milka-aq/tb.php?bd=xi1666364469543
HTTP/1.1 200 OK
Date: Tue, 22 Nov 2022 10:48:44 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 20 Oct 2022 16:09:56 GMT
Vary: Accept-Encoding
ETag: W/"635172d4-850"
Expires: Tue, 22 Nov 2022 22:48:44 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RCpVyrdqf1vCR4UfzYxX%2BJqqZ%2BHYmp3Rjm4fEEPEOY1tw9ELFLn0FtYiNznhHSAUZyRV9Gy2POvYF0G1%2BISUDqqYn1Paop9VxqHAjJOGeokXabFFcttbn6CMwuscXvULXQNA%2FLzfotQ%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76e118308aadb515-OSL
alt-svc: h2=":443"; ma=60
proportionartifact.cn/j/og2.php?_t=1669114124807
104.21.64.236200 OK 97 B URL HTTP/1.1 proportionartifact.cn/j/og2.php?_t=1669114124807
IP 104.21.64.236:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 97ca900949fac8f5219c35f616cec85f
ec83d2038b5e4111fd802f795ae75f4fa8b73528
1e793901f83eaad12d39ad1a3b709d52f4c701d3dd7d97a6bbfc5869d584476d
Analyzer Verdict Alert fortinet Phishing
POST /j/og2.php?_t=1669114124807 HTTP/1.1
Host: proportionartifact.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 47
Origin: http://proportionartifact.cn
Connection: keep-alive
Referer: http://proportionartifact.cn/milka-aq/tb.php?bd=xi1666364469543
HTTP/1.1 200 OK
Date: Tue, 22 Nov 2022 10:48:45 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=StQLrFbOnUYOsXZonYDzGFq5ssD7uw%2BmB7o6rY04x%2FH8FUMWEqgRF9P6FSTddK%2B7h5zj1bSQqjyOtfoG5dpgr9bu2lc0KQauHxYZLgqF1q0cgIm0ZZKBZJi1i2k9oL%2F45%2FKZy%2FC4TWQ%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76e118312b46b515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
e1.o.lencr.org/
23.36.77.32200 OK 346 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 98e24002c6959c72d93c5ee9a12d41f2
700493b2e2937d362cdf7353b297e0039bbc19d3
f3bd425c639eb0409b92054b01c7c3ad6756cf35cfa40bade4650d6b2e4b2823
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "F3BD425C639EB0409B92054B01C7C3AD6756CF35CFA40BADE4650D6B2E4B2823"
Last-Modified: Mon, 21 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5530
Expires: Tue, 22 Nov 2022 12:20:55 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Cache-Control, ETag, Pragma, Expires, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 22 Nov 2022 10:08:47 GMT
cache-control: public,max-age=3600
age: 2398
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.36.77.32200 OK 346 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 98e24002c6959c72d93c5ee9a12d41f2
700493b2e2937d362cdf7353b297e0039bbc19d3
f3bd425c639eb0409b92054b01c7c3ad6756cf35cfa40bade4650d6b2e4b2823
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "F3BD425C639EB0409B92054B01C7C3AD6756CF35CFA40BADE4650D6B2E4B2823"
Last-Modified: Mon, 21 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5530
Expires: Tue, 22 Nov 2022 12:20:55 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/select2.min.css
151.101.85.229200 OK 2.2 kB URL HTTP/2 cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/select2.min.css
IP 151.101.85.229:0
File type ASCII text, with very long lines (16263)
Hash bd3ea59ca12635e32402ec20cb196249
b1bfdaba4a00c2932245ff9eabea38016f9c9069
b99f8f79de257275fdbf6a8e0eb4652b0d69429552234b1f444c08ae85000341
GET /npm/select2@4.1.0-rc.0/dist/css/select2.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 4.1.0-rc.0
x-jsd-version-type: version
etag: W/"3f88-kT+fe5U1rseQyjzp1uNaz682mZM"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 22 Nov 2022 10:48:45 GMT
age: 20534631
x-served-by: cache-fra19146-FRA, cache-bma1652-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2162
X-Firefox-Spdy: h2
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.1.1/css/all.min.css
151.101.85.229200 OK 21 kB URL HTTP/2 cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.1.1/css/all.min.css
IP 151.101.85.229:0
File type ASCII text, with very long lines (65317)
Hash b5ae87c0e4dd241b533e67053b0b719d
6b7b568694a95d81a94dea9ef7a85d1317d448dc
5bae5997fbca925ac6e52be8163ca897e751fcc9331552e0f77a22dd35b64521
GET /npm/@fortawesome/fontawesome-free@6.1.1/css/all.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 6.1.1
x-jsd-version-type: version
etag: W/"189ae-CRAs/GDvtDCiXul87ppqNd9t/Fk"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 22 Nov 2022 10:48:45 GMT
age: 6105654
x-served-by: cache-fra19168-FRA, cache-bma1652-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 20556
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 8a181d95550cfdf3b1fc4deb71631e40
37866f7293c41fbfb817e321754cae5c5bf59f93
6aa3d2763181cc48d2ad0ce7d227f3cb3324045c3f7858ccdbae675768dcec55
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1450
Cache-Control: max-age=168140
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:45 GMT
Etag: "637c912f-1d7"
Expires: Thu, 24 Nov 2022 09:31:05 GMT
Last-Modified: Tue, 22 Nov 2022 09:06:55 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 585eab785e44953b9e6d7c389024ff3e
57582825e9a285177f38cd2fa868ad3a8eab85d1
f1c62af1e27c8510576adcb62b28be35f290d2ee71e873f7000c194980522e80
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
23.36.77.32200 OK 344 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 53415067dfacc117465635b58e940580
1444e70d56f13a2ec3ab4c54c3d0e3057a3a5e43
ca9d114d6843df06e6832be4c86d5dec95f1c685163a73d00279282eb06fecac
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "CA9D114D6843DF06E6832BE4C86D5DEC95F1C685163A73D00279282EB06FECAC"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9764
Expires: Tue, 22 Nov 2022 13:31:29 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
e1.o.lencr.org/
23.36.77.32200 OK 999 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
File type gzip compressed data, from Unix\012- data
Hash 8862763f221d74ef5f9e60d488f1ad44
f4770faea3066367c64dfea65cd072aece034ec8
bd5caf82206429a730e4307e7ffd37dc4a20b087df01f8fd81b7ca0686560ab2
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "CA9D114D6843DF06E6832BE4C86D5DEC95F1C685163A73D00279282EB06FECAC"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9764
Expires: Tue, 22 Nov 2022 13:31:29 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 585eab785e44953b9e6d7c389024ff3e
57582825e9a285177f38cd2fa868ad3a8eab85d1
f1c62af1e27c8510576adcb62b28be35f290d2ee71e873f7000c194980522e80
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
23.36.77.32200 OK 344 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 53415067dfacc117465635b58e940580
1444e70d56f13a2ec3ab4c54c3d0e3057a3a5e43
ca9d114d6843df06e6832be4c86d5dec95f1c685163a73d00279282eb06fecac
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "CA9D114D6843DF06E6832BE4C86D5DEC95F1C685163A73D00279282EB06FECAC"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9764
Expires: Tue, 22 Nov 2022 13:31:29 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
cdnbun.com/upload/milka-right.png
104.21.14.142200 OK 958 B URL HTTP/2 cdnbun.com/upload/milka-right.png
IP 104.21.14.142:0
File type PNG image data, 13 x 100, 8-bit/color RGBA, non-interlaced\012- data
Hash feb4813787c85c5df359a2ee834332ba
39d19c1be41a3d04cf98285c4ea5e584135384dd
7ccbd203c5a5d5b69e4d518acf67e401d7e1a6c6d040e03a50dd0e0441336b0e
GET /upload/milka-right.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/png
content-length: 958
x-guploader-uploadid: ADPycdtXuJ_DimSbjeTc51RsIaq83U9Z_swmcs3IThiySdJJngGhRjYn8r5t3wFWRcpcfT277w0eNnWoCE6fgMqHdFvf5r8vQqyl
expires: Tue, 22 Nov 2022 11:06:49 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 07:49:09 GMT
etag: "feb4813787c85c5df359a2ee834332ba"
x-goog-generation: 1665474549592106
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 958
x-goog-hash: crc32c=UK1hyQ==, md5=/rSBN4fIXF3zWaLug0Myug==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hBrRnai7ydcS%2Bn7QKgpJvjsbQ2CF%2Fyo4I5MHCFeVvcGhI82Wo8vMOHtJy1hrv5seklbqn5%2BpOfxPNHdEqKWlOGgfeXATeAhXp8i7feb5EXn3cHITsHY4Jmb2yIea"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118348a5d0afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/milka-show.jpg
104.21.14.142200 OK 55 kB URL HTTP/2 cdnbun.com/upload/milka-show.jpg
IP 104.21.14.142:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 520x287, components 3\012- data
Hash fbba0cca552d8a7de56fbcd94db660a1
cea96c3db5c7c9013b3c391b7bcafec23420b0ad
bac39a81891de718a28d7d4e5fcbdf6c437ef957d17ed2b6e630be29ce4b100b
GET /upload/milka-show.jpg HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 55214
x-guploader-uploadid: ADPycdvA0NBn3L8k89WX56rlWBNx_qZ-uArH2OoPmZlKqVHlclZKX7oeF_OKTpQoo0lCW8MCLCUavJncyZKLA1vXPHJU9A
expires: Tue, 22 Nov 2022 10:35:06 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 07:59:29 GMT
etag: "fbba0cca552d8a7de56fbcd94db660a1"
x-goog-generation: 1665475169889551
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 55214
x-goog-hash: crc32c=UfcAog==, md5=+7oMylUtin3lb7zZTbZgoQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PsRziNVD2RB9BZqO4risO8IcKuaeJ21GZdTpC2R7zDTYgdCMs6eNVvTRUSPQG8sNaNXOMCMGsvCaSnEep4e5hZZiA7irlopyPkJxAHAqBAMI39N3oeZJ6bogsZHL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118348a610afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-LW7434MYMN
142.250.74.168200 OK 76 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-LW7434MYMN
IP 142.250.74.168:0
File type ASCII text, with very long lines (19102)
Hash dd72980c7c7b67a806b3f5e034769dc2
7d19a40d7824585fc9fcf4a906f67358bb7cc8ff
25f694f7acca570b0736fc52da5a00f76e3372a25cae3e678be0e5cb9ae74d6c
GET /gtag/js?id=G-LW7434MYMN HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 22 Nov 2022 10:48:45 GMT
expires: Tue, 22 Nov 2022 10:48:45 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75948
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdnbun.com/upload/milka-m.png
104.21.14.142200 OK 11 kB URL HTTP/2 cdnbun.com/upload/milka-m.png
IP 104.21.14.142:0
File type PNG image data, 163 x 80, 8-bit/color RGBA, non-interlaced\012- data
Hash 47ba5c0d9b9eee083c0453a0ae6ab724
0320295a5d889d62334a030ee066a2b7293f1ee3
3f26b5ed60aa0e9b57df6643ace2344e7275fdce065cb42816d7e5617d863660
GET /upload/milka-m.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/png
content-length: 11422
x-guploader-uploadid: ADPycdu2ur2yPw97q2rOMgTDtgFlbEhY-uX6DadyQbna3wVGIjZTMSxD7X1FprzLUhPGBJkfl8QhzWHJwy8EXIYm3IOOkrcVwczI
expires: Tue, 22 Nov 2022 10:24:55 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 07:49:08 GMT
etag: "47ba5c0d9b9eee083c0453a0ae6ab724"
x-goog-generation: 1665474548123396
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 11422
x-goog-hash: crc32c=CLMGhA==, md5=R7pcDZue7gg8BFOgrmq3JA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XD1tel75u7PFQ4PKrJAwGsR5yPFsHvqUyOCEXl8sgFJqaQQjaZBJxvmHVI%2Bo%2Ffxn7FzRsDmefp4ZdTgj23qurbdPQyLtA5Pj2IN14uUxbXKBZyojJ1DEOcXjgSYI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118348a5f0afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/milka-left.png
104.21.14.142200 OK 958 B URL HTTP/2 cdnbun.com/upload/milka-left.png
IP 104.21.14.142:0
File type PNG image data, 13 x 100, 8-bit/color RGBA, non-interlaced\012- data
Hash 7d949f4efc015e0ea1b6c97ba81b8480
4eb53fb7765a4f11d722d81451059fb2928df94a
679297cb75b3d8e5356880748ca0f57cb1cbcc04132b9f425f8c5bd67f2982d3
GET /upload/milka-left.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/png
content-length: 958
x-guploader-uploadid: ADPycduMir1O8RGEM6ebv78rcLGeMkcltNMCV34a7evs01jnxvSMdCZClUndHC72GN1d6yPEhYoFlkAc3PoTtbVGKvC1vtUD7B_a
expires: Tue, 22 Nov 2022 10:10:24 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 07:49:07 GMT
etag: "7d949f4efc015e0ea1b6c97ba81b8480"
x-goog-generation: 1665474547822508
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 958
x-goog-hash: crc32c=puUUPQ==, md5=fZSfTvwBXg6htsl7qBuEgA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OU7IftigT1hrzIOqUJX7m4wsHizXdLtjNOdaWVV%2FGDx65JCcNrJZAvT43f9YIOCguGb2GgCBrE1vPpl2mYVijWrct2RRa1VCUL8uFjH27kekJkqkXINuE3759u4x"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118349a880afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.36.77.32200 OK 344 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 1ed57e2b9d67890fec52cbe408ba602d
25182acb3bacebac8ad30728b2b36c7b2309a4e9
26055b2e5a7dd0bcc3ec80df5d1aadc015713ff9f41b99977e1e21a7292ee57d
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "26055B2E5A7DD0BCC3EC80DF5D1AADC015713FF9F41B99977E1E21A7292EE57D"
Last-Modified: Mon, 21 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13105
Expires: Tue, 22 Nov 2022 14:27:10 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
www.googletagmanager.com/gtag/js?id=G-0C230YDF7G
142.250.74.168200 OK 76 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-0C230YDF7G
IP 142.250.74.168:0
File type ASCII text, with very long lines (19102)
Hash 25c4b8c84b0c0a00e654747ccec7dd71
024b8f44af2a8bf63b09f1d16082b677eff66b27
f59b3367513959e47d629270b5f7742364a6cbc7ee849c72887d06e3df9846ec
GET /gtag/js?id=G-0C230YDF7G HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 22 Nov 2022 10:48:45 GMT
expires: Tue, 22 Nov 2022 10:48:45 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75966
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdnbun.com/upload/milka-box2.png
104.21.14.142200 OK 4.3 kB URL HTTP/2 cdnbun.com/upload/milka-box2.png
IP 104.21.14.142:0
File type PNG image data, 350 x 250, 8-bit/color RGBA, non-interlaced\012- data
Hash 899820355a7a7ba1ef3c8632406046ba
a9121d5310aa70be7eb568f0ce81ef229238c3dd
f858a32018a86455c529c5fb40572d61d18cc1c4e74dfb52be64acdce11e916e
GET /upload/milka-box2.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/png
content-length: 4338
x-guploader-uploadid: ADPycduuJBw6d-_Q3qUiX2K0qbBJY2EhRMZS7BL9ogjagcPdedAIQ0FJpfsKHidixH5uzNr6gfPOz1X011ClW7WqztNKlkcBm3Q2
expires: Tue, 22 Nov 2022 10:10:24 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 07:49:06 GMT
etag: "899820355a7a7ba1ef3c8632406046ba"
x-goog-generation: 1665474546616876
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4338
x-goog-hash: crc32c=G/Gy5g==, md5=iZggNVp6e6HvPIYyQGBGug==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FAW3dEZOhmBC1jdk3fTzrv0VF7veVKhWkn4M8XLtoZTiCmqHrAGHMU%2F%2FYZS49WW5jjGoUS23B%2FszdLXaIqQlDf%2BykpsHDiV1WjB7xj7Y6BYO5hk7R8V7h19sg%2BHm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118349a890afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 471 B IP 142.250.74.3:0
Hash 08fb143dfd9a3b59cfdc0248ad9f5482
bee979149e99e01b543881991a121a637e9ceb70
94ec72f114ab4f9b26c352e15f0920d2ab8bde8d72ac3fb95fe4a0627246a148
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
23.36.77.32200 OK 344 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 1ed57e2b9d67890fec52cbe408ba602d
25182acb3bacebac8ad30728b2b36c7b2309a4e9
26055b2e5a7dd0bcc3ec80df5d1aadc015713ff9f41b99977e1e21a7292ee57d
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "26055B2E5A7DD0BCC3EC80DF5D1AADC015713FF9F41B99977E1E21A7292EE57D"
Last-Modified: Mon, 21 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13105
Expires: Tue, 22 Nov 2022 14:27:10 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
cdnbun.com/upload/milka-box1.png
104.21.14.142200 OK 14 kB URL HTTP/2 cdnbun.com/upload/milka-box1.png
IP 104.21.14.142:0
File type PNG image data, 350 x 250, 8-bit/color RGBA, non-interlaced\012- data
Hash 04b00689badcb6d64c3f0b63e202ac86
3fd21a50f6ae5865340dd035e160eb032643d776
dc9e514a2ee83e317ebb027fd149cf07a141f12e78c3c5a5cb22a76720c90447
GET /upload/milka-box1.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/png
content-length: 14021
x-guploader-uploadid: ADPycdutY1DMBeym0kojhyp1Sd9IAM_1xCHS7Uc82IsU_-opiL-Q9wUl3738JT3wWjGiqlliFSnCYcn3ZsyTepZT7ar4Jy8Fcj0o
expires: Tue, 22 Nov 2022 10:35:06 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 07:49:06 GMT
etag: "04b00689badcb6d64c3f0b63e202ac86"
x-goog-generation: 1665474546710306
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 14021
x-goog-hash: crc32c=w/Uzxg==, md5=BLAGibrcttZMPwtj4gKshg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ODrWM58hvr1CoZfMl40sS5lQxcih%2FGoKM3WlqtHcdrgEnBd5ELxul5oRInmy3eWNvxqVGuS2Dw0nqT1oyXQkYBbQHTTuQRZfYqCJQxUnwOoWPDIpz5lIW%2FdngoF2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e11834caab0afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 471 B IP 142.250.74.3:0
Hash 08fb143dfd9a3b59cfdc0248ad9f5482
bee979149e99e01b543881991a121a637e9ceb70
94ec72f114ab4f9b26c352e15f0920d2ab8bde8d72ac3fb95fe4a0627246a148
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdnbun.com/upload/milka-box33.png
104.21.14.142200 OK 4.6 kB URL HTTP/2 cdnbun.com/upload/milka-box33.png
IP 104.21.14.142:0
File type PNG image data, 350 x 250, 8-bit/color RGBA, non-interlaced\012- data
Hash b1bd9953b4c292b15524cb39c33474b1
d6b97a96f8dc05e942444d0e40d37308f887fbef
9beeb6e9c40f27b0df96db08ebce6c62ccba10c65a247bf2beb1620778c10715
GET /upload/milka-box33.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/png
content-length: 4637
x-guploader-uploadid: ADPycdukY2cJ6pzJskkMVFLIoV4WISiiDG47PyrYGT2oXqfB7QkwFA1JB5Ep9eV606UNWPQoezzZAKzCxYBBUNFZo7EE1bRzaJlS
expires: Tue, 22 Nov 2022 10:08:03 GMT
cache-control: public, max-age=14400
last-modified: Tue, 11 Oct 2022 08:04:15 GMT
etag: "b1bd9953b4c292b15524cb39c33474b1"
x-goog-generation: 1665475455852506
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4637
x-goog-hash: crc32c=zIAM7w==, md5=sb2ZU7TCkrFVJMs5wzR0sQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2470
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HHJtsz4ZrLbNQXn2dCFDvHLo2k67TugunPp8QBwWxUq0LwRVP9VSEdQQrwO2lDv8jEVGG79RCmMeRfoK4711eXiBaqZAcZEwU54uETTt7sucBtQBYNVk6SctGqFd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e11834eacf0afa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
104.18.21.226200 OK 1.5 kB URL HTTP/1.1 ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
IP 104.18.21.226:0
Hash 80cd655b3a85a44b228c802ff1e5b824
cbafe7bf289cc02192ef0c496c428a84b6a7399f
ae7db2e9052aea03eb7f6d41fc8d6b9a8592c67755a9e794f68c2fff3c5255d2
POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 22 Nov 2022 10:48:45 GMT
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "8172F0350B678198AD39C2C74B6194F814547B9D"
Expires: Tue, 22 Nov 2022 22:00:00 GMT
Last-Modified: Tue, 22 Nov 2022 10:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 457
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76e11834e9c10b06-OSL
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash b26582db0cbccfe965db0a2325a47f38
d01138e66a2b95728f2136a572e1c195c108caeb
408c9c6a058c6bb444e96b26b96347a6217f9627faef8cf775b7dfb4db2b45e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "408C9C6A058C6BB444E96B26B96347A6217F9627FAEF8CF775B7DFB4DB2B45E7"
Last-Modified: Mon, 21 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8987
Expires: Tue, 22 Nov 2022 13:18:32 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 3e4b1e2088f4a6d1052981adc8626e40
571d0bea248dc908bbc70f6ffc967dd005797463
93ca688ca5923b0de99c8eb9fbb1f58e2654f2e1b00701491122bd56741fc44d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "93CA688CA5923B0DE99C8EB9FBB1F58E2654F2E1B00701491122BD56741FC44D"
Last-Modified: Sun, 20 Nov 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1205
Expires: Tue, 22 Nov 2022 11:08:50 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
1.bp.blogspot.com/-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png
142.250.74.161200 OK 14 kB URL HTTP/2 1.bp.blogspot.com/-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png
IP 142.250.74.161:0
File type PNG image data, 350 x 251, 8-bit colormap, non-interlaced\012- data
Hash ff055162c5d233506eece3fb69a47e74
49812e303ae6674819b6a7a6e0721d555ef64df4
7e46c8bcf219a0d6f0f3d5c5b027ed613678a0c54d637172d6495f428ff80150
GET /-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="Norway_inbox.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 13695
x-xss-protection: 0
date: Tue, 22 Nov 2022 06:49:50 GMT
expires: Sun, 06 Nov 2022 03:02:48 GMT
cache-control: public, max-age=86400, no-transform
age: 14335
etag: "v630"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
263cdn.com/upload/yhde4.jpg
104.21.235.74200 OK 8.5 kB URL HTTP/2 263cdn.com/upload/yhde4.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 97c0fcc47524398cecf7d89e8854a01c
bef604fbc4381f689b97ae2216acf1ea260f09e1
bb56e2ea161221ac5e4c671d3d124cf5b1e50f64a412960baf51523679f37444
GET /upload/yhde4.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 8521
x-guploader-uploadid: ADPycdt_ozSjN2fKESi70osKTi-xq17s39b1KvmqNz3lSLY3gqfENQAIAVIaSnMyExLv7NICF_ANlViyvScq_yeG_JGsUA
expires: Tue, 22 Nov 2022 11:13:04 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:50 GMT
etag: "97c0fcc47524398cecf7d89e8854a01c"
x-goog-generation: 1657560170770744
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8521
x-goog-hash: crc32c=NqkxVw==, md5=l8D8xHUkOYzs99ieiFSgHA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2107
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LkUnzORCYOpnoXBjbrNqjeqebrgZTR8UYh%2BsB7tXabxmxLMr3KMkuou3D4Htc0FQVa8RYm%2FrCDfQGhWRcb3JlmNWQ9UexAupPk5o%2F2ScGCXNdXSJWECCjBjWvKZs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118351c5a887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde1.jpg
104.21.235.74200 OK 13 kB URL HTTP/2 263cdn.com/upload/yhde1.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 8bb7f41971b23f34648e6b4797df26f3
3a2732b4bd2c9e45291f66a9872ef2d780fe831b
df4dd6d2b21fd5d5bedc1259cedab7ace2eeec381c18ca487f47fb26af6792b6
GET /upload/yhde1.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 12610
x-guploader-uploadid: ADPycdtfh5DxpmIF1ZBFMdDeNUHaAcmJwZZnl8TpGufA0Lx38-eukhWrRNLsr5__EH3aiNqL13_ZnYiBtvD0zjiaeD2Cvg
expires: Tue, 22 Nov 2022 11:13:04 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:49 GMT
etag: "8bb7f41971b23f34648e6b4797df26f3"
x-goog-generation: 1657560169688143
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 12610
x-goog-hash: crc32c=/laZCQ==, md5=i7f0GXGyPzRkjmtHl98m8w==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1822
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kYAAUeFX51EZ5ewK9SuIflHX5%2B332URn5gMnOCJMGqcbLD5iQFf97%2FYaTWL3Lbi2tJic5fc%2BI8VsBNHl%2BYBGo8TdaeyXjbTqpWdPf7fedwrpWFHne%2Fha%2Fn8COXAv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118351c5c887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde8.jpg
104.21.235.74200 OK 7.9 kB URL HTTP/2 263cdn.com/upload/yhde8.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash b8b61d66db60a707e147d51f80cd7caf
9caeead5c434baf1feb311daf7ce1aa19fa21863
a17ccb0824fbac80cc0d82f280573c2e214876756d8e597e8fa10c9b83e4e342
GET /upload/yhde8.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 7939
x-guploader-uploadid: ADPycdveBphS_-pnKVzVFrummhVL4y-rwqrwPVvaeO5NigvucM2zoaYmtGTNgXYnAF61jn0RJAVLp2v2T0qNnSyKgeMNAg
expires: Tue, 22 Nov 2022 10:17:10 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:51 GMT
etag: "b8b61d66db60a707e147d51f80cd7caf"
x-goog-generation: 1657560171890012
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7939
x-goog-hash: crc32c=VOlkAw==, md5=uLYdZttgpwfhR9UfgM18rw==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2107
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wzGNgB2FVankCs%2BCTXG%2B4uZyYcM7c%2F9wu2FayjwV2oaCx9hymYVZhGRCkbMTWb3heRKPWUYceFy%2B4Z%2BcBnnRiVnzW39DB2aTlrHoHHqOPTrkdP0HafXrQVBrKA1W"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118351c5e887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde7.jpg
104.21.235.74200 OK 7.2 kB URL HTTP/2 263cdn.com/upload/yhde7.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash e6973ef8b9321ae09803ede73ca9047d
7b93053d922fa89065796614f7183c7baefcb558
7593afdd1a987ff5a18338787f1e75f403739752cf357c4d4f3b32205d9606ac
GET /upload/yhde7.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 7197
x-guploader-uploadid: ADPycdus7Kc4sKChII0BY1iUPjmFEANxkpPzE04pv5Nq__GnTS69Fx58wcfHW23_NNibZmKQ6ivYL_VyW1I8Y7dH-YO1uQ
expires: Tue, 22 Nov 2022 09:25:50 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:51 GMT
etag: "e6973ef8b9321ae09803ede73ca9047d"
x-goog-generation: 1657560171874943
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7197
x-goog-hash: crc32c=LD3HAg==, md5=5pc++LkyGuCYA+3nPKkEfQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3481
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=THJiV8R6JknCa8VdB9RcVipd0PPTibqmefWn7HqG096KrY4UnmqITs%2F7CGGeAgAeuybdB8F6YfQ4eHiQ5rpLdiIGUrySPmossQA4sBIs5DLJsrNxMa3Ud96dAAPF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118351c61887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.36.77.32200 OK 344 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 53415067dfacc117465635b58e940580
1444e70d56f13a2ec3ab4c54c3d0e3057a3a5e43
ca9d114d6843df06e6832be4c86d5dec95f1c685163a73d00279282eb06fecac
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "CA9D114D6843DF06E6832BE4C86D5DEC95F1C685163A73D00279282EB06FECAC"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9764
Expires: Tue, 22 Nov 2022 13:31:29 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
263cdn.com/upload/yhde3.jpg
104.21.235.74200 OK 8.4 kB URL HTTP/2 263cdn.com/upload/yhde3.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash d8f2b1db826a85b3d6a77f65c2eb8aa9
f2a5f76ea88f4f374ea2ed63a2d56262746f11b7
ec87a4f107fab84a11b07c51a0c16da260136be7e9312267e9ac53ee1faac9cb
GET /upload/yhde3.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 8391
x-guploader-uploadid: ADPycduWGHoLIReJ2xiY1GVnOQ8Sn9-KO7a6VsLLFXT22xI0vdlIYJE6iIGVGBgqPrwjPpjaqkI118qosrIiLUda8XtWAQ
expires: Tue, 22 Nov 2022 10:35:52 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:50 GMT
etag: "d8f2b1db826a85b3d6a77f65c2eb8aa9"
x-goog-generation: 1657560170668162
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8391
x-goog-hash: crc32c=ow+ZSQ==, md5=2PKx24JqhbPWp39lwuuKqQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2583
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ylwVWulgXwgFFJnhWOtk0yrBcoNeANLta%2BuEKwDWFQFVenhUOF8KA4DrGGj1%2Bep%2BQ2hT0yMl42X3%2FKEfD%2FT4w5kUIe9y6xTnpJFIS6e4ThJ60Vs96IpSd01BS2ph"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118351c63887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
1.bp.blogspot.com/-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png
142.250.74.161200 OK 181 kB URL HTTP/2 1.bp.blogspot.com/-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png
IP 142.250.74.161:0
File type PNG image data, 497 x 308, 8-bit/color RGBA, non-interlaced\012- data
Size 181 kB (180954 bytes)
Hash fd835c1f326d3e7da0d9839550f66723
5004618bc15011d7d0f569f60f900d076b164b3d
b2286c3ed452ee4eeb15d2044a90cfc456d4789b2fdbe42bb9e023c9da18e4a8
GET /-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="Norway_outbox.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 180954
x-xss-protection: 0
date: Tue, 22 Nov 2022 06:49:50 GMT
expires: Sun, 06 Nov 2022 03:02:48 GMT
cache-control: public, max-age=86400, no-transform
age: 14335
etag: "v632"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
263cdn.com/upload/yhde2.jpg
104.21.235.74200 OK 7.5 kB URL HTTP/2 263cdn.com/upload/yhde2.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 1e4cd34e22133192edbfdce16e8ba3a0
0b975b36fee9e81118378e4d7f70860edfe80bd3
8f71eadc0e6e9d3c4e20bdab6122f130199f099c47933a8f9c31856b5c5a0842
GET /upload/yhde2.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 7500
x-guploader-uploadid: ADPycdvXJA2JymEnbnIrNCBRWfSdUIbx5ZpgaHNYrAmqSAEu2EJuOpzSzuaFRF72xSuPb5BMLeC9nUJG0Y2OXwgMKyVRog
expires: Tue, 22 Nov 2022 10:37:33 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:49 GMT
etag: "1e4cd34e22133192edbfdce16e8ba3a0"
x-goog-generation: 1657560169681386
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7500
x-goog-hash: crc32c=UJX5hQ==, md5=HkzTTiITMZLtv9zhboujoA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1378
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J5g8Yn7p%2BifsgHFxWpD%2B1%2F2KOXV8NQVFXRPROOUnY5V25%2Frd0jlKWyCVcaoeo5omiGgAhZNXRuLmS8AfZrqIvFoJLEazQJrmR3AjRczwRd3ZfH8UnCWvYxyGNoAE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118354ccb887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 585eab785e44953b9e6d7c389024ff3e
57582825e9a285177f38cd2fa868ad3a8eab85d1
f1c62af1e27c8510576adcb62b28be35f290d2ee71e873f7000c194980522e80
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 22 Nov 2022 10:48:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
263cdn.com/upload/yhde9.jpg
104.21.235.74200 OK 9.2 kB URL HTTP/2 263cdn.com/upload/yhde9.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 011b2ea22f52406af58b64d1665f8452
180974bd7ba0be0bea57119080b3071f9e3b19d9
0681be4c83ebd047dbea1e6df073cf020d407d75fabe8ffcc40bb57ef9a19358
GET /upload/yhde9.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 9205
x-guploader-uploadid: ADPycdvs0YK_rB9cQAHfmCT10X7f703AoIsM5_nQgNFawqca9TnO20W2aLKHwElUxq13Ol0neBD-Joho_9RA7ksxgpb7ww
expires: Tue, 22 Nov 2022 10:31:50 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:52 GMT
etag: "011b2ea22f52406af58b64d1665f8452"
x-goog-generation: 1657560172678807
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 9205
x-goog-hash: crc32c=9Zk+WA==, md5=ARsuoi9SQGr1i2TRZl+EUg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1361
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i0RnNFyQLws6F2a4Diby389R74IVjA9xeHHmW54zBR6yPHy51MDbvV0iPI1hWgPIFsirm91MAI6w4XIEoTSY%2BPyRUa957%2FRFgsBThqXYSLySvG74XkhdD8Ucm5qy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118354cce887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde6.jpg
104.21.235.74200 OK 9.0 kB URL HTTP/2 263cdn.com/upload/yhde6.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash ee5371e6976fe9bb8b6d46278279f89d
c246da7df163264acac382d4a83ba162b08637a8
ad1533c7cdb68e5cb8b5123a6775d6d5e67836e7187b46e27d5009a70a251ad4
GET /upload/yhde6.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 8953
x-guploader-uploadid: ADPycdv6aTAfGE_NNJ9LFMmqbTa7I8ZlS9xuzrxDxFnnDrRAPB3FeIvsSoqVxdk6Y3JIm-lo7Hn4uloAWkqaHAckwDe3LQ
expires: Tue, 22 Nov 2022 10:25:41 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:51 GMT
etag: "ee5371e6976fe9bb8b6d46278279f89d"
x-goog-generation: 1657560171630757
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8953
x-goog-hash: crc32c=YDJ99Q==, md5=7lNx5pdv6buLbUYngnn4nQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1320
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o3XDLIzV1h6%2BzvyeIfMz1GqxgL2cxTFf6129DI6u6X2P%2Be0EmENCsol7W5HyhgPFnFMQ2D11MpTvPQp%2FSQqUUxf3zZxSY2eZ0mPw6jG8NT0fn64l8%2B2ZhailNf81"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118354ccd887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde.jpg
104.21.235.74200 OK 12 kB URL HTTP/2 263cdn.com/upload/yhde.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash c7401cbdc82cca5689669a88a41608fb
366e93242c88d9fdd3d58f5f3b46a1db75ed8d47
94508fbf165fff7477c232e0a1069f2aa87316b71b0499b1d687021c24142ae0
GET /upload/yhde.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 11716
x-guploader-uploadid: ADPycdtrCXUu3d-5kC44p7A_3XhywiwvgDNsU_Q1PPvqjzgPe0-OYLPaHoUmfmxxPatrrmj8ze8_uDbLlZO_RiFdhRXQ7g
expires: Tue, 22 Nov 2022 11:12:42 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:49 GMT
etag: "c7401cbdc82cca5689669a88a41608fb"
x-goog-generation: 1657560169763046
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 11716
x-goog-hash: crc32c=Vi3taA==, md5=x0AcvcgsylaJZpqIpBYI+w==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1361
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WeVLe7zIX7o7kdyEJUIVKzJrvZ3Hq1PgjV3k59wlsNk0fbZcFYWtA8liCnQ4Dbfe96YQ9SApul7g7fXHPrXhP%2FuLQ69qG%2FMXLoh7uBZ2EmWc31iwo7xWdA7zmDb4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118356d0c887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde5.jpg
104.21.235.74200 OK 8.0 kB URL HTTP/2 263cdn.com/upload/yhde5.jpg
IP 104.21.235.74:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash bf26d0b78d013f526a5f8eb153f9fd56
5cb71ae75ad4a45e482570a02cf919bbc65fa135
c0e0b2ed3e4352d31c1672785a0df72fa809063ac9383643ebb78f0e1486535f
GET /upload/yhde5.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: image/jpeg
content-length: 7984
x-guploader-uploadid: ADPycdvMJOsLLv7YZp9JJ7Nzbri01O_pcyfVMwt6oT7abD5cC4UHwhRI5mQvusf6y2fEqPnzdSm70xVbqv4VGVt-J7o300YKxwpb
expires: Tue, 22 Nov 2022 10:41:47 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:50 GMT
etag: "bf26d0b78d013f526a5f8eb153f9fd56"
x-goog-generation: 1657560170814014
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7984
x-goog-hash: crc32c=2hDYJw==, md5=vybQt40BP1JqX46xU/n9Vg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2133
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tOqSHCRA989whaEmqahdHSkZtzlz91zmjAkHm9%2F4YmJ5pI5em1WmIxrNRsX8SAE6m9wlxeuTuWPpgg0pwVOxXhv5u9QLGbPKKaLgc%2FlY2nRp8PYZHI1JAMPeWXhf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118356d0d887a-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.36.77.32200 OK 344 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 1ed57e2b9d67890fec52cbe408ba602d
25182acb3bacebac8ad30728b2b36c7b2309a4e9
26055b2e5a7dd0bcc3ec80df5d1aadc015713ff9f41b99977e1e21a7292ee57d
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "26055B2E5A7DD0BCC3EC80DF5D1AADC015713FF9F41B99977E1E21A7292EE57D"
Last-Modified: Mon, 21 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13105
Expires: Tue, 22 Nov 2022 14:27:10 GMT
Date: Tue, 22 Nov 2022 10:48:45 GMT
Connection: keep-alive
push.services.mozilla.com/
34.215.94.42101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 34.215.94.42:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: V6J5R0uuW+DeO2puRNK8VA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: XFCiya6vNBz7ePTwkklRSvfIPVE=
region1.google-analytics.com/g/collect?v=2&tid=G-0C230YDF7G>m=2oeb90&_p=1532713535&cid=2031977532.1669114126&ul=en-us&sr=1280x1024&_s=1&sid=1669114125&sct=1&seg=0&dl=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875&dr=http%3A%2F%2Fproportionartifact.cn%2F&dt=&en=page_view&_fv=1&_ss=1&_ee=1
216.239.32.36204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-0C230YDF7G>m=2oeb90&_p=1532713535&cid=2031977532.1669114126&ul=en-us&sr=1280x1024&_s=1&sid=1669114125&sct=1&seg=0&dl=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875&dr=http%3A%2F%2Fproportionartifact.cn%2F&dt=&en=page_view&_fv=1&_ss=1&_ee=1
IP 216.239.32.36:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-0C230YDF7G>m=2oeb90&_p=1532713535&cid=2031977532.1669114126&ul=en-us&sr=1280x1024&_s=1&sid=1669114125&sct=1&seg=0&dl=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875&dr=http%3A%2F%2Fproportionartifact.cn%2F&dt=&en=page_view&_fv=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibfmuqs.cn
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 204 No Content
access-control-allow-origin: https://ibfmuqs.cn
date: Tue, 22 Nov 2022 10:48:46 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
region1.google-analytics.com/g/collect?v=2&tid=G-LW7434MYMN>m=2oeb90&_p=1532713535&cid=2031977532.1669114126&ul=en-us&sr=1280x1024&_s=1&sid=1669114125&sct=1&seg=0&dl=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875&dr=http%3A%2F%2Fproportionartifact.cn%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
216.239.32.36204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-LW7434MYMN>m=2oeb90&_p=1532713535&cid=2031977532.1669114126&ul=en-us&sr=1280x1024&_s=1&sid=1669114125&sct=1&seg=0&dl=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875&dr=http%3A%2F%2Fproportionartifact.cn%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
IP 216.239.32.36:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-LW7434MYMN>m=2oeb90&_p=1532713535&cid=2031977532.1669114126&ul=en-us&sr=1280x1024&_s=1&sid=1669114125&sct=1&seg=0&dl=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875&dr=http%3A%2F%2Fproportionartifact.cn%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibfmuqs.cn
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://ibfmuqs.cn
date: Tue, 22 Nov 2022 10:48:46 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 804755c7e438531c9ba2e781947e1640
7a93c31638ee89a561bac2174482a5d12aa62d63
aa6f123fed093048bd006bf5a0ea0a7b310d735436af0ca07a06574f2026ba9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AA6F123FED093048BD006BF5A0EA0A7B310D735436AF0CA07A06574F2026BA9B"
Last-Modified: Sun, 20 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5206
Expires: Tue, 22 Nov 2022 12:15:32 GMT
Date: Tue, 22 Nov 2022 10:48:46 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 804755c7e438531c9ba2e781947e1640
7a93c31638ee89a561bac2174482a5d12aa62d63
aa6f123fed093048bd006bf5a0ea0a7b310d735436af0ca07a06574f2026ba9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AA6F123FED093048BD006BF5A0EA0A7B310D735436AF0CA07A06574F2026BA9B"
Last-Modified: Sun, 20 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5206
Expires: Tue, 22 Nov 2022 12:15:32 GMT
Date: Tue, 22 Nov 2022 10:48:46 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 804755c7e438531c9ba2e781947e1640
7a93c31638ee89a561bac2174482a5d12aa62d63
aa6f123fed093048bd006bf5a0ea0a7b310d735436af0ca07a06574f2026ba9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AA6F123FED093048BD006BF5A0EA0A7B310D735436AF0CA07A06574F2026BA9B"
Last-Modified: Sun, 20 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5206
Expires: Tue, 22 Nov 2022 12:15:32 GMT
Date: Tue, 22 Nov 2022 10:48:46 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 804755c7e438531c9ba2e781947e1640
7a93c31638ee89a561bac2174482a5d12aa62d63
aa6f123fed093048bd006bf5a0ea0a7b310d735436af0ca07a06574f2026ba9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AA6F123FED093048BD006BF5A0EA0A7B310D735436AF0CA07A06574F2026BA9B"
Last-Modified: Sun, 20 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5206
Expires: Tue, 22 Nov 2022 12:15:32 GMT
Date: Tue, 22 Nov 2022 10:48:46 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 804755c7e438531c9ba2e781947e1640
7a93c31638ee89a561bac2174482a5d12aa62d63
aa6f123fed093048bd006bf5a0ea0a7b310d735436af0ca07a06574f2026ba9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AA6F123FED093048BD006BF5A0EA0A7B310D735436AF0CA07A06574F2026BA9B"
Last-Modified: Sun, 20 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5206
Expires: Tue, 22 Nov 2022 12:15:32 GMT
Date: Tue, 22 Nov 2022 10:48:46 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8365a642-a490-4221-8f9f-867864b12d62.webp
34.120.237.76200 OK 9.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8365a642-a490-4221-8f9f-867864b12d62.webp
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 528d729159d8b08ed1fe05472dc65ce4
b7d570a7a095e127fd408b8272b93a52c5038b46
d6404764bcc3f2e7c4462b6b31fbc0e315c9cbf51b7424194c2bc6f4a21a33de
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8365a642-a490-4221-8f9f-867864b12d62.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9862
x-amzn-requestid: 02281c2f-2a42-4891-97af-8d21a4cd0d2e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-IrJEdYIAMFijQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637bee47-7c96415239d22bfc219f53f6;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 21:31:51 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nyT50MW4_CxOyrrPcWgPokRPAoPOH1M21Py4zB5DGlVuFRbk7sr0oQ==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 21 Nov 2022 22:01:37 GMT
age: 46029
etag: "b7d570a7a095e127fd408b8272b93a52c5038b46"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4db9b106-0a0e-4fae-92b6-a8812d365210.jpeg
34.120.237.76200 OK 8.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4db9b106-0a0e-4fae-92b6-a8812d365210.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7ccd43a87165914b33d3d0abf4daac17
495bc194d9cf043cad38e9aab650a3e74a542c68
3e95928493b984c636a5fa77b22c29b3245ba4bba7d730a8545145b17a5986f4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4db9b106-0a0e-4fae-92b6-a8812d365210.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8075
x-amzn-requestid: 5d8d5076-abee-484e-98e6-e2f8641133e1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-IqUGXnIAMF4gw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637bee41-3c973b4d2d40cbaa2c5df221;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 21:31:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: T0RMlGqGin5SFk8QxAiY8UwJEGnkwtuJLKqnTMrx8h7qJbI5MeQ11g==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 21 Nov 2022 21:48:15 GMT
age: 46831
etag: "495bc194d9cf043cad38e9aab650a3e74a542c68"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe35a8d1-e974-48d4-a8b7-1add4aa5d251.webp
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe35a8d1-e974-48d4-a8b7-1add4aa5d251.webp
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2ed6b76d15fc8d6295acdb6fb47461d3
b8c928f93a8d82b48491448d811a95ad99dc6aef
de326836a9de677438b9ae724198e94348b0900c62817ff10de3677ce93fdae0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe35a8d1-e974-48d4-a8b7-1add4aa5d251.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8685
x-amzn-requestid: 66455cc7-83d7-4570-99f9-5fa838da947f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-IrAHwKoAMFUHQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637bee46-354d65e9609bc05647556a5a;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 21:31:50 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: -9tZPsMl7i5hr0N1rwJdQBLiOImuEO12RDL0pcPNjf6t-LkRbPaN2A==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Mon, 21 Nov 2022 22:02:46 GMT
etag: "b8c928f93a8d82b48491448d811a95ad99dc6aef"
content-type: image/jpeg
age: 45960
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9029340f-28c3-4004-9012-9a24977dfd45.jpeg
34.120.237.76200 OK 6.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9029340f-28c3-4004-9012-9a24977dfd45.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4f3fad7453f45dfa617243c8beac64e1
56414a905340e1b1478a0a40a52b25365a724524
7befcfbedac5652eb04bc675b67f7b642631d4e918f7aaee17b0b594e26854d0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9029340f-28c3-4004-9012-9a24977dfd45.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6031
x-amzn-requestid: f59b04c5-4955-4847-9a7f-d9d53b47ca52
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3cV0GC-oAMF5hA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637940f1-0425b3cf6a4650b60936feba;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 20:47:45 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: StZ9dxgY8W0WwUUqsxyeISFnbm_WGGcm_AMuo9dzfhF9Yp7wM0TMMg==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 ea699166e6ec77aa410ff505b0a8ce18.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 08:17:57 GMT
age: 9049
etag: "56414a905340e1b1478a0a40a52b25365a724524"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c73cec7-245a-480e-8dfe-cc11a12b2656.jpeg
34.120.237.76200 OK 4.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c73cec7-245a-480e-8dfe-cc11a12b2656.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dafd9e17dc0023e71ae513c6025e4b80
12e2654db1f384bb04f5c5042848b25dda86b710
e9c885a102dc811648cec4ac292db63564e81a48d7a3611cb31fba73b37286dd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c73cec7-245a-480e-8dfe-cc11a12b2656.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4639
x-amzn-requestid: 8a93fa29-158b-4402-aac4-85ad29a74ae1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-I6oELooAMFWFw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637beeaa-5a85509b26d9aeef7ae59b4c;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 21:33:30 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Z_LKFsiB_s81UenxBOVg9_qX_7vBHUZix7XF8YguDCytRn5opLkLRA==
via: 1.1 995664ee945c06fc706b5cb8e0e650dc.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Mon, 21 Nov 2022 22:01:10 GMT
age: 46056
etag: "12e2654db1f384bb04f5c5042848b25dda86b710"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
34.120.237.76200 OK 4.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 841a4b110022a99ddea6f7bf66df0fa1
126771b86638108050cf57c0d12faa27f80f0edb
240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4309
x-amzn-requestid: 47c2739d-73c5-4d91-914c-fe635cb09772
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b1U8xGxgIAMF-qQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63786851-6fbe19dc5c4c20dd657604e3;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 05:23:29 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: j_8oVo464QMWMnmkxQJIDRhaIVmwhzCTHe4A57OdmaUr9HcyTtBUjg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 2750b94b402c92287d764b5fa115a042.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 04:39:13 GMT
age: 22173
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.globalsign.com/gsrsaovsslca2018
104.18.21.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP 104.18.21.226:0
Hash dadc83965763f59a4bf14341a3a5835f
70e89d528c4603d18341774a7c1a926c4578bbdf
df69485ee4e03abfda770a7c0f038fc3c5b8464cd0be842348c69375e91db04a
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 22 Nov 2022 10:48:47 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Sat, 26 Nov 2022 08:12:39 GMT
ETag: "70e89d528c4603d18341774a7c1a926c4578bbdf"
Last-Modified: Tue, 22 Nov 2022 08:12:40 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 389
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76e1183eac760b06-OSL
hm.baidu.com/hm.js?deda20e4a8b28c0764f80228135dc3d9
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?deda20e4a8b28c0764f80228135dc3d9
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (663)
Hash 4e21e57a98f7a7ebafd0bd3b43d5b6a2
475920cb24f23728d61753687508773011f0b0f2
ccbb80d4269ca8645f98ab560485268096327496a4ee2fd496bcd6c152fdc65e
GET /hm.js?deda20e4a8b28c0764f80228135dc3d9 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11376
Content-Type: application/javascript
Date: Tue, 22 Nov 2022 10:48:47 GMT
Etag: 6e940c217c0a555c3c3a079ce7bd92d5
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=4C832F9EDAE2005D; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?ba99808308e7272d58c43367a11d1204
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?ba99808308e7272d58c43367a11d1204
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (629)
Hash 5ec88a0f065142a8540a649050644246
257eb36d2552a611c8aee43186a12be4627ff329
aa067964758f367fb166cb2153e30f15d3780f56d7cb99980e2c342adc73e3ce
GET /hm.js?ba99808308e7272d58c43367a11d1204 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11342
Content-Type: application/javascript
Date: Tue, 22 Nov 2022 10:48:47 GMT
Etag: 7293086ba17c1333cf2fd58b9efb1828
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=59F02551E7C1DF80; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?b521817f22507716e364b3fe28644f8b
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?b521817f22507716e364b3fe28644f8b
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (657)
Hash 368b1435f62e580c38f39f4eb52fa477
e43717318cb5fc408b26b0f383ed34acec917e63
6ceece80f416cd8ceeb54afe3a2bef57ddc72a16752784bdeaeae7e371893d3b
GET /hm.js?b521817f22507716e364b3fe28644f8b HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11370
Content-Type: application/javascript
Date: Tue, 22 Nov 2022 10:48:47 GMT
Etag: e8cef1dc45166a4448a3805875837b25
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=1CAAF65CFFC9A777; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?8b68846a3ac1709b0ec7199084ee5ea8
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?8b68846a3ac1709b0ec7199084ee5ea8
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (620)
Hash c338b192765c33c505daa9be07d4e507
2662ac6d0529b9a8b5ef197ed042401155d92d0a
27689e2b08c9e8eccb2cd1fde4ccac4942112443e214af35a41cb7f266b9584a
GET /hm.js?8b68846a3ac1709b0ec7199084ee5ea8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11333
Content-Type: application/javascript
Date: Tue, 22 Nov 2022 10:48:47 GMT
Etag: 39a2632b8fbae524f53827097c87653e
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=C1BEF974BA0EC9BD; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=166170641&si=deda20e4a8b28c0764f80228135dc3d9&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=166170641&si=deda20e4a8b28c0764f80228135dc3d9&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=166170641&si=deda20e4a8b28c0764f80228135dc3d9&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 22 Nov 2022 10:48:48 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=121257033BA0F6E6; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=547751065&si=ba99808308e7272d58c43367a11d1204&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=547751065&si=ba99808308e7272d58c43367a11d1204&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=547751065&si=ba99808308e7272d58c43367a11d1204&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 22 Nov 2022 10:48:48 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=E05B93A9E4DF5ABC; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1201430590&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1201430590&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1201430590&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 22 Nov 2022 10:48:48 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=A0E88D6721A4AD80; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=478252803&si=8b68846a3ac1709b0ec7199084ee5ea8&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=478252803&si=8b68846a3ac1709b0ec7199084ee5ea8&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=478252803&si=8b68846a3ac1709b0ec7199084ee5ea8&su=http%3A%2F%2Fproportionartifact.cn%2F&v=1.2.97&lv=1&sn=3213&r=0&ww=1280&ct=!!&u=https%3A%2F%2Fibfmuqs.cn%2FjAB6h9dL%2Fmilka-aq%2F%3F_t%3D1669114124875%231669114126063 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 22 Nov 2022 10:48:48 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=EA9F9FA2418E4B81; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
IP 172.67.151.125:0
GET /npm/lazyload@2.0.0-rc.2/lazyload.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdsQwI6S5jC2ZwwNbaEnMvjelWJ3GXYdnwkp6yGGRsWcMv2CGKN45430-s2v57JOsXldQJq3rMwQOTmm_DkHtW4
x-goog-generation: 1647502963816044
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4798
x-goog-hash: crc32c=lted8w==, md5=3G3pgTxxS6mXM8pPtdOh+g==
x-goog-storage-class: STANDARD
expires: Tue, 22 Nov 2022 09:49:30 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:42:43 GMT
etag: W/"dc6de9813c714ba99733ca4fb5d3a1fa"
cf-cache-status: HIT
age: 3394
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=84CtGCSKuChqZskPGyDxPFVNbFFy7bg1Scu2pprsohyrj%2FhAcCoAKdOB2nBYDEJrsjj1c1PQtw%2B0jeYpwJJZ2Fli3Qx7S7v3QgI1dmrC%2BUqnBD0w213S9zi0IrOk1neWiAs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e11833684eb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
uprimp.com/bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=166911412514996&xtt=1914263
185.66.200.220200 OK 0 B URL HTTP/2 uprimp.com/bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=166911412514996&xtt=1914263
IP 185.66.200.220:0
ASN #201702 skHosting.eu s.r.o.
Analyzer Verdict Alert quad9 Sinkholed
GET /bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=166911412514996&xtt=1914263 HTTP/1.1
Host: uprimp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/html; charset=UTF-8
expires: Tue, 22 Nov 2022 10:48:45 GMT
last-modified: Tue, 22 Nov 2022 10:48:45 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex, nofollow, noarchive, nosnippet
X-Firefox-Spdy: h2
bonepa.com/4fe48aebd6/4f59451604/?placementName=Pop&is_first=true&randomA=0_1559&maxw=0
185.66.201.42200 OK 0 B URL HTTP/2 bonepa.com/4fe48aebd6/4f59451604/?placementName=Pop&is_first=true&randomA=0_1559&maxw=0
IP 185.66.201.42:0
ASN #201702 skHosting.eu s.r.o.
GET /4fe48aebd6/4f59451604/?placementName=Pop&is_first=true&randomA=0_1559&maxw=0 HTTP/1.1
Host: bonepa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 22 Nov 2022 10:48:48 GMT
content-type: text/html; charset=UTF-8
set-cookie: shown1=0; expires=Wed, 23-Nov-2022 10:48:48 GMT; Max-Age=86400; secure; SameSite=None
used_ad2706762=1; expires=Wed, 23-Nov-2022 04:59:59 GMT; Max-Age=65471; path=/; secure; SameSite=None
total_impressions=1; expires=Wed, 23-Nov-2022 04:59:59 GMT; Max-Age=65471; secure; SameSite=None
expires: Sun, 01 Jan 2014 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex,nofollow
access-control-allow-origin: *
content-encoding: br
X-Firefox-Spdy: h2
ibfmuqs.cn/jAB6h9dL/milka-aq/?_t=1669114124875
104.21.74.97200 OK 0 B URL HTTP/2 ibfmuqs.cn/jAB6h9dL/milka-aq/?_t=1669114124875
IP 104.21.74.97:0
Analyzer Verdict Alert quad9 Sinkholed
GET /jAB6h9dL/milka-aq/?_t=1669114124875 HTTP/1.1
Host: ibfmuqs.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://proportionartifact.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: pType=mo; expires=Tue, 22-Nov-2022 11:00:45 GMT; Max-Age=720; path=/; domain=ibfmuqs.cn
milka-aq-tthh1=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.ibfmuqs.cn
milka-aq-tthh2=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.ibfmuqs.cn
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PPV50mwaW%2FCAbFIULZ5H%2B%2FOAxn079KdvCgKavG5XkcivsiRKZ%2B5zsiitQrVGlUPu2mvo%2Fk08rPN4qTqHSWI4ksasAzQP97NpLUEheXvSGUwz1%2F1whOGzq5fptDlX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 76e11831dde00b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
IP 172.67.151.125:0
GET /npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycds_5oPtcr3KFpC_u7Lnvdlqz8VeCGxAgHcXFP3zMljDMh6Q0ifyAwrLV7e0dbEbUBwQbF9kY0g0GrHWdqicRh8
expires: Tue, 22 Nov 2022 09:49:20 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:40:39 GMT
etag: W/"80924b62e5b3ac73aa4849776b439770"
x-goog-generation: 1647502839791727
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 72765
x-goog-hash: crc32c=8ZRUYw==, md5=gJJLYuWzrHOqSEl3a0OXcA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3394
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rnI34MGhjPnLYK9CbCu61NmWDpddmWNoMlhXxTjfemPIIAVdaSWDlEEEJaRiAskmlPV%2F70mIp%2FNMRR8bQx2STQ3KkF8Ap4GCwBB9xkEWpUV4I%2B8QClvVSV6eQCuSg1S4exk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118334808b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
IP 172.67.151.125:0
GET /npm/bootstrap@4.6.0/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/css
x-guploader-uploadid: ADPycduCHwg6n53VPzNb_-57qJzhoPJbEBdMgpsWgTX19t4NIh3Tdte6MCXenDGQTAuiJrpSRG3G9WDZErClLNvZVXhXccOSWw
expires: Tue, 22 Nov 2022 10:14:20 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:38:12 GMT
etag: W/"feba0d0760607b9e21393156949afcd9"
x-goog-generation: 1647502692716912
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 161415
x-goog-hash: crc32c=Sb/HMQ==, md5=/roNB2Bge54hOTFWlJr82Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3394
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GLGW%2B%2BQCN4Q8MWbkksfPexxB5fJ9cssYaeXmzxLFVu20hmv8bvwT5OzTa%2FHTVG2tIDEdDqkJPBm%2FG3FtgBwpoZeop%2BQd9kO56mimzOA%2FvICdHD5x9oE9zy3tplQo3pOUMq4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e11833480db529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP 172.67.151.125:0
GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdt8iAiFUD-J6NleyhXb8_vV8-wAPh_5tba_l2ugugXdkSJbrWiN1EsoSHZyahG4iSEJB_zV100HdRQRWXjd72Q
expires: Tue, 22 Nov 2022 10:17:44 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:44:44 GMT
etag: W/"31c898c6d2ea13c30441657ff1900d81"
x-goog-generation: 1647503084523089
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 21236
x-goog-hash: crc32c=7cW0Gg==, md5=MciYxtLqE8MEQWV/8ZANgQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3394
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nmf6vOedn3pyQPG%2BVdcK5CCE9w3FyHFlVHY7OeefhMKN1A01QKgIbQRGILsMinRBPbVC4Iw8o6knxloV1Tl9gctCEBPjpNeFEprcBe4Me1CuGqT2YrcH0Czh5Pnlb3xooKE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e11833683db529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
185.66.200.220200 OK 0 B URL HTTP/2 uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
IP 185.66.200.220:0
ASN #201702 skHosting.eu s.r.o.
Analyzer Verdict Alert quad9 Sinkholed
GET /bnr.php?section=General&pub=593174&format=300x50&ga=g HTTP/1.1
Host: uprimp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: application/javascript
expires: Tue, 22 Nov 2022 10:48:45 GMT
last-modified: Tue, 22 Nov 2022 10:48:45 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex, nofollow, noarchive, nosnippet
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
IP 172.67.151.125:0
GET /npm/bootstrap@4.6.0/dist/js/bootstrap.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdv0chj5F1Awc6K7Usaiie2qXL87Fxg5kp7mYqQH9s8HWV5Nuv0HuTqJ2hz1F5xUG9MGapUfK4P-pfLXRasYr-w
expires: Tue, 22 Nov 2022 09:39:34 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:36:54 GMT
etag: W/"c99230d2575380d7f95ff626606d2426"
x-goog-generation: 1647502614200576
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 63473
x-goog-hash: crc32c=x2l+AA==, md5=yZIw0ldTgNf5X/YmYG0kJg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3394
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7DWoNlN61LQLZfGsIxpY3d1%2BG6uXk6xdtC1DM3FL3bfJ8ZkOJM1FPps7RDFq8xuP1opBxx0lfLitekbdU3n%2B%2F87X1Ggj54bnDaMvvlCDSwDq69q7OdhkBs1ZH4yGOYSqltI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118334810b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bonepa.com/js/responsive.js
185.66.201.42200 OK 0 B URL HTTP/2 bonepa.com/js/responsive.js
IP 185.66.201.42:0
ASN #201702 skHosting.eu s.r.o.
GET /js/responsive.js HTTP/1.1
Host: bonepa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 13:52:39 GMT
etag: W/"63627627-e32"
content-encoding: br
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
IP 172.67.151.125:0
GET /npm/jquery@3.6.0/dist/jquery.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibfmuqs.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 22 Nov 2022 10:48:45 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdujKqP4OmsICcw4by2ej4M3gF2bmp67KcND5Yd7ZkChGu92L3U7j930k4J7s5KmD98KzStiLKDZt_7_8jjTVv4
expires: Tue, 22 Nov 2022 10:07:40 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:30:17 GMT
etag: W/"3e4bb227fb55271bfe9c9d4a09147bd8"
x-goog-generation: 1647502217775195
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 89501
x-goog-hash: crc32c=JnXAUA==, md5=PkuyJ/tVJxv+nJ1KCRR72A==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3394
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QPLQb1xNLhFi9zdJOsH1RAbK%2F%2FliV9BWWk%2BImhcuAzeejHmHnmMP%2FuEkQMtJFdG0kp970GMlvtLd%2Fb%2Bvc4MYRbVtTrtoqZmW28E%2FNDQ6HOZno3BLBLnK3v0VtL8in6uFrJg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76e118335821b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2