GET /images/navicon1.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 18288
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "4770-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xnF7IIxX%2FA%2BpG9YK3xt54GWcBYpSVFqe6j6F%2FIvjnzJnVqnLwW8qZ%2BgYa%2F0gmn2ZZg3UYLtizBUFGn5VO2ML2t8LkGgxv%2B1%2FpFsO9f5UZxcZW0%2FyYByb0Kvx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74ca556ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7086&min_rtt=1697&rtt_var=5252&sent=63&recv=23&lost=0&retrans=0&sent_bytes=57526&recv_bytes=5930&delivery_rate=7564000&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=341&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/navicon6.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 1175
last-modified: Fri, 11 Jun 2021 12:43:51 GMT
etag: "497-5c47cdc166fc0"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NkLWKbdXINIP3Xw5Euq8DM55ldwzay4nkpYy%2F63r4j9XpLnvUfp4WSHkOpsgkmNBggKcLBBpQf7gIUghLwyURmMomdaI5ReRqGJpNMIBk%2Bo4Rmh6QOiSikuQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74cad56ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7086&min_rtt=1697&rtt_var=5252&sent=73&recv=23&lost=0&retrans=0&sent_bytes=69526&recv_bytes=5930&delivery_rate=7564000&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=342&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/navicon2.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 16374
last-modified: Tue, 30 May 2017 04:42:33 GMT
etag: "3ff6-550b66e93c040"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 6217
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uATh8bV6jG9jNkT5SZvcd1Ve7f2sLCFm6z%2FDO4dmX0INfowTvQ16BbFKwrkg9ddW4wAMCwKZqf1UiHzjRtgSCnro4i8w8zi2NX%2BslOXO0Mr4oVzJlcHpav%2Ft"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74ca656ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=1697&rtt_var=5158&sent=82&recv=24&lost=0&retrans=0&sent_bytes=78883&recv_bytes=5974&delivery_rate=6332516&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=343&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/navicon5.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 15551
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "3cbf-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rl4wcWlyrKmQjCFjx2mDpXkiw10kDKNiQ1yoYrYPPu9oCOi3rvlhiy%2BsWZClP4oGAKzvbHC5sny3XPvBanjF0RI%2FNWWlcYYT7nH9Jp88ykSnvRJW0D%2FcrCtp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74cb056ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=1697&rtt_var=5158&sent=102&recv=24&lost=0&retrans=0&sent_bytes=102125&recv_bytes=5974&delivery_rate=6332516&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=344&x=1", cfExtPri, cfHdrFlush;dur=2

GET /images/userin.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 18182
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "4706-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fM9K1l8xWxqmiT9qpOJ9btVC%2FXLg8qH7nzqOPHWp30PuCTqoUDUl%2B6ontiJ%2BX%2F5tOqxINj7FUodD2NpLoDATvZ3DvdmQr1X2Ufyk%2FU2D66%2FXZbmrx40AZITf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74cb456ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=1697&rtt_var=5158&sent=102&recv=24&lost=0&retrans=0&sent_bytes=102125&recv_bytes=5974&delivery_rate=6332516&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=345&x=1", cfExtPri, cfHdrFlush;dur=1

GET /images/logo1_1x.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 38035
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "9493-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8fhyf0oUBO9qGzWJvfNbMjnETxDl16bq3VTLrrwIdyO77EIWUng%2BOUMAS4xJ0A1N34pcoAbSdlil6Bh8Y8%2FQYoFDNtMWQmQW%2FwmwiMI7GWWOuTCJLS2hqSYv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74ca456ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5913&min_rtt=1697&rtt_var=4995&sent=122&recv=25&lost=0&retrans=0&sent_bytes=125400&recv_bytes=6020&delivery_rate=17537523&cwnd=72000&unsent_bytes=0&cid=99d41842fc6daae7&ts=346&x=1", cfExtPri, cfHdrFlush;dur=2

GET /images/navicon3.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 15889
last-modified: Tue, 30 May 2017 04:42:35 GMT
etag: "3e11-550b66eb244c0"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8AETYLK5l2mYaHQTnztYdjF8zN8a7o7rVEHqdmp6wL8nB32Rfwykhe53oqKFATfyocp2gDLzmnfw8kLz8efS5VMaaA1LBujutPNN6kkTZCI598hdie8O1S88"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74ca856ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=1697&rtt_var=5158&sent=92&recv=24&lost=0&retrans=0&sent_bytes=90883&recv_bytes=5974&delivery_rate=6332516&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=344&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/download1.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 23553
last-modified: Tue, 30 May 2017 04:42:35 GMT
etag: "5c01-550b66eb244c0"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1724
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d9%2B23WkCXY4SW%2BCgVjCKR3aore3P830YHIRux%2BgQ3jVFO7QIafqwN2arPqf0ru4j5HoggVKNfhlYb9gFg9dmttyhYtH5q5b5sz%2FYmd2DLqmlVDBTz3hNI2Y1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74cb856ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=1697&rtt_var=5158&sent=97&recv=24&lost=0&retrans=0&sent_bytes=96348&recv_bytes=5974&delivery_rate=6332516&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=344&x=1", cfExtPri, cfHdrFlush;dur=2

GET /images/no211.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 720
last-modified: Mon, 26 Aug 2019 15:38:33 GMT
etag: "2d0-59106f2ce7040"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1724
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3TEYXdmlYBIqXEZC3VBVot9TiAMlzER1bMQ2sjsd7IOLOidOfR%2FasWzXAdF6tN8Zu950BvI%2B8MwvAhv74UQnUfaDEaNbF52X3wDGORNyxqTMo0burS5z3Ga"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c75cc656ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5560&min_rtt=1697&rtt_var=4452&sent=186&recv=26&lost=0&retrans=0&sent_bytes=198125&recv_bytes=6066&delivery_rate=8430567&cwnd=96000&unsent_bytes=0&cid=99d41842fc6daae7&ts=351&x=1", cfExtPri, cfHdrFlush;dur=4

GET /images/yep_d.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 15222
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "3b76-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1724
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SXblPKS%2FPzxfo%2BS3e1q%2B2huzCvzKH9PlhFMTA5BnKhfgIHYmBVvgB0lnLO2Tx5o9s1jqBna2aXP6na%2FFxOCZ4cyy9WCIEZIMskWU4SyxMWZhtFHUJwY29uV%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c75ccc56ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5164&min_rtt=1697&rtt_var=4132&sent=210&recv=27&lost=0&retrans=0&sent_bytes=224800&recv_bytes=6112&delivery_rate=13553058&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=356&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/regicon.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 19508
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "4c34-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vkQSNJEYnMLDXhMrvvM%2B05KXs6ANwYFu0yqmP9Xp8quX5ZLZvOIAZmCxlR1nku51UE7MAg0o%2FyECH9Rqdt58FsXoZZ2D70bpRWXgPseNioZKpBg61i5XgSk0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74cb656ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5164&min_rtt=1697&rtt_var=4132&sent=224&recv=27&lost=0&retrans=0&sent_bytes=241103&recv_bytes=6112&delivery_rate=13553058&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=359&x=1", cfExtPri, cfHdrFlush;dur=0

GET /js/jquery.paging.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/javascript
last-modified: Tue, 30 May 2017 04:42:32 GMT
etag: W/"4ba5-550b66e847e00"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 5556
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XB0R54cwJd58pfuo%2BCRX9AOTTDp0LtTjnT06yexcPQx7WLDcyRbP0y%2F2V9M8vyrQvSyaXKxN%2B9Z1VL3ut5KDTA%2FNDVAVTgpnT1w%2FEfz7XxfvNb3wjI%2FnSGrx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c73c8b56ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8369&min_rtt=1697&rtt_var=5401&sent=14&recv=18&lost=0&retrans=0&sent_bytes=4107&recv_bytes=4670&delivery_rate=349856&cwnd=12000&unsent_bytes=0&cid=99d41842fc6daae7&ts=333&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/navbar.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 22290
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "5712-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 6217
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2fepVB6wB46%2FIkd80DuIHQ0YWwcMC2G1x2WCgJIfkyqL3CokcAz9hMCLXuwHcAoXQ6Vlx89p5KVhcxT7cVDMjTnpGE7QtyYhC8oCBAjst4h2dmmYWtb%2FOyBT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c81df056ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5097&min_rtt=1697&rtt_var=2919&sent=246&recv=32&lost=0&retrans=0&sent_bytes=263410&recv_bytes=7096&delivery_rate=6385741&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=477&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/flags.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/style.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 29723
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "741b-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 6217
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2BwyK%2FPKVhQ90%2B7v3c4OAtbaUDksA2I8aKhU8Bl%2FvzTvM%2FZuBkXBTpznYgZg4Dd7EkZ2AnVcnzl589XMMv%2BaP0TwaVChLWpOePyJzlfxuxRDw0SEb7sC8Lv8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c82df756ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5097&min_rtt=1697&rtt_var=2919&sent=267&recv=33&lost=0&retrans=0&sent_bytes=286983&recv_bytes=7396&delivery_rate=6385741&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=480&x=1", cfExtPri, cfHdrFlush;dur=0

GET /js/jquery.cookie.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/javascript
last-modified: Tue, 30 May 2017 04:42:32 GMT
etag: W/"c31-550b66e847e00"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nDPY4soJW9HzEktJBqIbBin8RLIitRwwvrMT7elpOrmVzk%2B1issKeoTplYg91Apk%2BUMZ9Kllpq2jlQ3pE0rUX%2FglaIkWQE6EgYeE2k99JmCMSND9S3krFrER"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74c9f56ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7086&min_rtt=1697&rtt_var=5252&sent=61&recv=23&lost=0&retrans=0&sent_bytes=55462&recv_bytes=5930&delivery_rate=7564000&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=341&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/premchar.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 69808
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "110b0-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1723
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2y1Ta2p53lONcwUMOKL7je%2BtvxcC29dfLFTFOvK825BkhA36Wzj5FbkMIPciJBTTEguS%2BTc7Iqq6zzQc%2BArEw%2B6w3pi2LWi7uwPY6JDDz2vfxT2KBUOPhNFB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c83e0756ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4532&min_rtt=1697&rtt_var=2630&sent=353&recv=37&lost=0&retrans=0&sent_bytes=387331&recv_bytes=8623&delivery_rate=2731970&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=491&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/free_download.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 32532
last-modified: Sat, 15 Jul 2017 04:35:36 GMT
etag: "7f14-55453b26c1600"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1723
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I40yMMmvqFGVrwkin2f8SmwWabS01BnPF80UeA5so8%2Fw23WSXCUG61aiicCuY9cvwSn9Ko8A1hun00%2Bu8mkaAKhEIP%2BQrk2IMX0TkRLcv7Juu677OMtEBrb7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c83e0856ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4532&min_rtt=1697&rtt_var=2630&sent=363&recv=37&lost=0&retrans=0&sent_bytes=399331&recv_bytes=8623&delivery_rate=2731970&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=491&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/premium_download.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 35695
last-modified: Sat, 15 Jul 2017 04:35:36 GMT
etag: "8b6f-55453b26c1600"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1723
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=816DptVXP8%2BuFbGdRVqMQYjb6HgXQ1W%2B2QwT%2B%2B2k6oeQvngm4LGE5QXWINYWSjOwbtVVvp8Huv2%2Fljs655v3TpHBsdf196yt745Jl3lZbUEOFaj8dntwMdKz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c83e0a56ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4172&min_rtt=1649&rtt_var=2693&sent=443&recv=38&lost=0&retrans=0&sent_bytes=493700&recv_bytes=8668&delivery_rate=3753020&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=497&x=1", cfExtPri, cfHdrFlush;dur=0

GET /images/navbara.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 22290
last-modified: Tue, 30 May 2017 04:42:35 GMT
etag: "5712-550b66eb244c0"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 546
cache-control: max-age=14400
cf-cache-status: HIT
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6MHz3OrkRi7xz3j8LoP3qQT%2F%2FQZpmlOqUKus%2F1QX8elN949CJ9OxKz74TtMgP7BuL9qK%2F5Zb2fp14JNskep9AGR69yybTNmhAl5HChtwcRhHwLRC7fafmKTP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c83e0e56ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4172&min_rtt=1649&rtt_var=2693&sent=475&recv=38&lost=0&retrans=0&sent_bytes=531020&recv_bytes=8668&delivery_rate=3753020&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=499&x=1", cfExtPri, cfHdrFlush;dur=0

GET /gtag/js?id=UA-79936000-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 19 Feb 2025 21:27:47 GMT
expires: Wed, 19 Feb 2025 21:27:47 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
server: Google Tag Manager
content-length: 85906
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET /rB5i0tSGtu5/115994 HTTP/1.1
Host: ni.aspcafarcie.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Feb 2025 21:27:47 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mexa.sh
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Thu, 20-Feb-2025 21:27:47 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Thu, 20-Feb-2025 21:27:47 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET /gid.js?userId=008175bf6d964875ea72341d92c4c51f HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://mexa.sh
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
set-cookie: ID=008175bf6d964875ea72341d92c4c51f; expires=Thu, 19 Feb 2026 21:27:47 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 914957c9a9f1712e-OSL
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET /ev0rroa6k53h/favicon.ico HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 302 Found
date: Wed, 19 Feb 2025 21:27:47 GMT
content-length: 0
location: https://mexa.sh/ev0rroa6k53h
x-test-header: 1
x-content-type-options: nosniff
cf-cache-status: BYPASS
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NuBMZDz8Kx9sHJfOatNzXAMJB7zkEm%2FZFMxnDejUYqQz5kHF7hwL8nH8zLH7CQxs6rir3Xuz%2BqougE1Mj0I4zeYVEbW8XbHbTj2Rll06mOWW%2Fmxtvv9LPWNz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c94f7056ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3706&min_rtt=1649&rtt_var=2352&sent=496&recv=41&lost=0&retrans=0&sent_bytes=554599&recv_bytes=9068&delivery_rate=2143003&cwnd=237000&unsent_bytes=0&cid=99d41842fc6daae7&ts=891&x=1", cfExtPri, cfHdrFlush;dur=0

POST /cuid/?f=https%3A%2F%2Fmexa.sh HTTP/1.1
Host: duomoscrinkum.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/
Content-Type: application/json
Content-Length: 10
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Feb 2025 21:27:47 GMT
Content-Type: application/json
Content-Length: 32
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mexa.sh
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: a97fa794a0f9=67a628f9b523ddfef10704; expires=Mon, 17 Jun 2052 20:18:56 GMT; domain=duomoscrinkum.shop; path=/; secure; SameSite=None
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET /images/.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: text/html; charset=utf-8
last-modified: Tue, 17 Dec 2019 16:49:23 GMT
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 140
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wBfZprnembMrqxNdZRs%2Fsuv95vKfJiB%2FnrLM0GvcKPK%2B9XFnuABlTvoPtuxQgMfkPWK6csObqacYQv%2F8vnNJGkw%2BvaqBQlGCWC4%2BFssnR8YVupRW%2FnhsIhic"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c81dee56ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5097&min_rtt=1697&rtt_var=2919&sent=244&recv=32&lost=0&retrans=0&sent_bytes=261844&recv_bytes=7096&delivery_rate=6385741&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=477&x=1", cfExtPri, cfHdrFlush;dur=0

OPTIONS /gd/115994?md=eyJhIjo4MDYzLCJzIjoiMTI4MHgxMDI0IiwiYiI6IjEyODB4MTAyNCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9tZXhhLnNoL2V2MHJyb2E2azUzaC9BODI3MS5yYXIuaHRtbCIsImgiOjY0NDgsImwiOiJlbi1VUyIsInQiOjAsInoiOjkxNTgsImsiOjAsInUiOiIiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoidG14NHpoYzg5bG4ycjBkIiwibyI6dHJ1ZSwibSI6MTc0MDAwMDQ2NzQ5MCwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyRG93bmxvYWQlMjBBODI3MSUyMHJhciUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTIyYTgyNzElMjIlMkMlMjJyYXIlMjIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMnRoZSUzQTEzJTIyJTJDJTIyeW91JTNBMTAlMjIlMkMlMjJhbmQlM0ExMCUyMiUyQyUyMnlvdXIlM0ExMCUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pr=Kkme4XgEMH..VcV0rdPRSA HTTP/1.1
Host: fouterwicket.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://mexa.sh/
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Feb 2025 21:27:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mexa.sh
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET /wrr?z=7359319&p_rid=277c4fcc-6645-48b9-8b90-149bfc4da8be&rb=Og9ZQFhLF4ZFC92fe-oggNxH2PPf6PvOCD1eAcBt0mIuWJY4Gh0_f_EtZduS6kW5t4CRIk92IBJvnnG3OqdgaFLdavaGqVsPiBGEE8N8MhDzfffRDHjP_2onrHGi6DegTHLUMlr72g3ibLlQAi4V-MGvXNSNeKq6Ilx14xdD-2V69zlM9tLAgpJie0A7SHxYbQibsQbv8y9wrO-ZvgCiIEgTcz9NTg3nsF82RCuzBHNUDKa1D7c23GJe-ZR9meIUEXjbBRKWaQDgH8r-Aqi1MGh1iuE=&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=0&pl=https%3A%2F%2Fmexa.sh%2Fev0rroa6k53h%2FA8271.rar.html&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=1&wgl=&js_build=iclick-v1.1091.1-auto&navlng=en-US&vsbl=true&pnt=0&pnrc=0&wasm=1&dmn=waisheph.com&userId=008175bf6d964875ea72341d92c4c51f HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: text/plain
content-length: 2
x-trace-id: fa7e12f05705c40d2ddacb2ecc707cd3
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://mexa.sh
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=008175bf6d964875ea72341d92c4c51f; expires=Thu, 19 Feb 2026 21:27:47 GMT; path=/; secure; SameSite=None
oaidts=1740000467; expires=Thu, 19 Feb 2026 21:27:47 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Wed, 26 Feb 2025 21:27:47 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

POST /gd/115994?md=eyJhIjo4MDYzLCJzIjoiMTI4MHgxMDI0IiwiYiI6IjEyODB4MTAyNCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9tZXhhLnNoL2V2MHJyb2E2azUzaC9BODI3MS5yYXIuaHRtbCIsImgiOjY0NDgsImwiOiJlbi1VUyIsInQiOjAsInoiOjkxNTgsImsiOjAsInUiOiIiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoidG14NHpoYzg5bG4ycjBkIiwibyI6dHJ1ZSwibSI6MTc0MDAwMDQ2NzQ5MCwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyRG93bmxvYWQlMjBBODI3MSUyMHJhciUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTIyYTgyNzElMjIlMkMlMjJyYXIlMjIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMnRoZSUzQTEzJTIyJTJDJTIyeW91JTNBMTAlMjIlMkMlMjJhbmQlM0ExMCUyMiUyQyUyMnlvdXIlM0ExMCUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pr=Kkme4XgEMH..VcV0rdPRSA HTTP/1.1
Host: fouterwicket.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/
Content-Type: application/json
Content-Length: 82
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Feb 2025 21:27:47 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mexa.sh
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Thu, 20-Feb-2025 21:27:47 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Thu, 20-Feb-2025 21:27:47 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET /5/7359319 HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/javascript
x-trace-id: 545375f1501170a6a82df7dae1327696
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=008175bf6d964875ea72341d92c4c51f; expires=Thu, 19 Feb 2026 21:27:47 GMT; path=/; secure; SameSite=None
oaidts=1740000467; expires=Thu, 19 Feb 2026 21:27:47 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2

GET /ev0rroa6k53h HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
DNT: 1
Connection: keep-alive
Cookie: lang=english; prefetchAd_7359319=true
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:48 GMT
content-type: text/html ; charset=UTF-8
expires: Tue, 18 Feb 2025 21:27:48 GMT
x-test-header: 1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4TWzMunHAKKvIwSvTNyjYwKSHY8suHjMqWc9nI52%2BjjTdMkpMWPSGECBJc1iNVuu1K5DbVU7RSBiYLVIAT3lnlDrDVp%2F3vPDIntkX9kov1zO4avnu7judiXp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 914957cc0c0f56ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5871&min_rtt=1649&rtt_var=6094&sent=498&recv=43&lost=0&retrans=0&sent_bytes=555296&recv_bytes=9432&delivery_rate=2582&cwnd=237000&unsent_bytes=0&cid=99d41842fc6daae7&ts=1325&x=1", cfExtPri, cfHdrFlush;dur=0

GET /css_newTheme/main.css HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: text/css
last-modified: Sun, 13 Jan 2019 07:31:45 GMT
etag: W/"89fe-57f51eb945a40"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 5556
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V0iq7Xz%2BGS94LVyoezT6N3tpYfAkt%2FnFMDWTFmZdzL2Ifoy8pXVqOwVQIicCivqP2N10MdkxymqXW7pfOpC%2B8S6VH7k1c0sM5htqRrm%2Bi6ycuNlnl8VUQWUS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c72c8156ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8369&min_rtt=1697&rtt_var=5401&sent=14&recv=18&lost=0&retrans=0&sent_bytes=4107&recv_bytes=4670&delivery_rate=349856&cwnd=12000&unsent_bytes=0&cid=99d41842fc6daae7&ts=333&x=1", cfExtPri, cfHdrFlush;dur=0

GET /css_newTheme/style.css HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: text/css
last-modified: Wed, 09 Aug 2017 05:59:44 GMT
etag: W/"9b82-5564bc956d400"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 5556
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e0YwABNMy5VG%2Fg3zgfQY5xARLqd70rxIIOxnSRCjw5O4FN1%2FV596CRt%2BKdkgBZX8LgP1xCZtAvNOQZGzXbzHDGH8dH%2BtbD%2BPH7tFFWmtv%2FJfWC3DOQ18uc81"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c72c7d56ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=1697&rtt_var=5158&sent=102&recv=24&lost=0&retrans=0&sent_bytes=102125&recv_bytes=5974&delivery_rate=6332516&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=345&x=1", cfExtPri, cfHdrFlush;dur=1

GET /gtag/js?id=G-SBML259V1V&l=dataLayer&cx=c&gtm=457e52d0za200 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 19 Feb 2025 21:27:47 GMT
expires: Wed, 19 Feb 2025 21:27:47 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
server: Google Tag Manager
content-length: 114828
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET /js/paging.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/javascript
last-modified: Tue, 30 May 2017 04:42:32 GMT
etag: W/"6ad-550b66e847e00"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p1QDOIf5J6sfVlTVqpEHruYb522H8Odsysoz9CUFUor7n1TzAY5Bsqlup9M5aX9bEhHktkE02RsBCM1MnEunYIt5pgVDWkRJ%2FXnqeFo8whlgfG6MmnWBXNJd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c74ca256ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7086&min_rtt=1697&rtt_var=5252&sent=59&recv=23&lost=0&retrans=0&sent_bytes=54125&recv_bytes=5930&delivery_rate=7564000&cwnd=48000&unsent_bytes=0&cid=99d41842fc6daae7&ts=341&x=1", cfExtPri, cfHdrFlush;dur=0

GET /?rb=Og9ZQFhLF4ZFC92fe-oggNxH2PPf6PvOCD1eAcBt0mIuWJY4Gh0_f_EtZduS6kW5t4CRIk92IBJvnnG3OqdgaFLdavaGqVsPiBGEE8N8MhDzfffRDHjP_2onrHGi6DegTHLUMlr72g3ibLlQAi4V-MGvXNSNeKq6Ilx14xdD-2V69zlM9tLAgpJie0A7SHxYbQibsQbv8y9wrO-ZvgCiIEgTcz9NTg3nsF82RCuzBHNUDKa1D7c23GJe-ZR9meIUEXjbBRKWaQDgH8r-Aqi1MGh1iuE%3D&request_ab2=0&zoneid=7359319&js_build=iclick-v1.1091.1-auto&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=0&pl=https%3A%2F%2Fmexa.sh%2Fev0rroa6k53h%2FA8271.rar.html&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=1&wgl=&js_build=iclick-v1.1091.1-auto&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=277c4fcc-6645-48b9-8b90-149bfc4da8be&wasm=1&userId=008175bf6d964875ea72341d92c4c51f&m=link HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Cookie: OAID=008175bf6d964875ea72341d92c4c51f; oaidts=1740000467
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/json
x-trace-id: ebea3b0d3362c1975ea34a2b182f8908
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://mexa.sh
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=008175bf6d964875ea72341d92c4c51f; expires=Thu, 19 Feb 2026 21:27:47 GMT; path=/; secure; SameSite=None
oaidts=1740000467; expires=Thu, 19 Feb 2026 21:27:47 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Wed, 26 Feb 2025 21:27:47 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2

GET /images/frechar.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: image/png
content-length: 66710
last-modified: Fri, 19 Jul 2024 07:38:56 GMT
etag: "10496-61d94c9aac4eb"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1723
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cCDcvvzmyAGZMqGFSkC%2FnC3V3PNS2WryuIuVXuQXCv7B3PXUBxaYyQQHXpaq917F%2Br%2BEVLw%2B%2FvOK7wHEv5odXRN%2Fd%2F266Rm5o5ZjctuEiNry0TD2SlFJhnkA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c82e0056ae-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4532&min_rtt=1697&rtt_var=2630&sent=295&recv=37&lost=0&retrans=0&sent_bytes=318205&recv_bytes=8623&delivery_rate=2731970&cwnd=192000&unsent_bytes=0&cid=99d41842fc6daae7&ts=490&x=1", cfExtPri, cfHdrFlush;dur=0

GET /ev0rroa6k53h/A8271.rar.html HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 19 Feb 2025 21:27:46 GMT
content-type: text/html ; charset=UTF-8
expires: Tue, 18 Feb 2025 21:27:46 GMT
set-cookie: lang=english; domain=mexa.sh; path=/
x-test-header: 1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KLNinWuBBvesQSGOHxKo32Ss9dpmgE%2FrnoWYC4bPwWr%2Btlu%2B%2FNpPsERvzQepGWB3MbtnwWM%2FTXlz%2F5YO5MQPdIkH5WWk6hYNgsHxDO%2F%2Fpb3HO5tmjPFttLOr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 914957c47adb712e-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5878&min_rtt=548&rtt_var=10616&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3188&recv_bytes=1139&delivery_rate=4987370&cwnd=254&unsent_bytes=0&cid=398b65c3aff630ea&ts=130&x=0"
X-Firefox-Spdy: h2

GET /js/jquery-1.9.1.min.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/ev0rroa6k53h/A8271.rar.html
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 19 Feb 2025 21:27:47 GMT
content-type: application/javascript
last-modified: Tue, 30 May 2017 04:42:32 GMT
etag: W/"169d5-550b66e847e00"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 547
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8HD9dBUXeEA3IjVaFiOtkDku7fs9rVlIQ6XSKNZvVIMVQFOgBAmuJF03UZ580v2UpVtP%2Fx9me4U2DH4YOCLIF2GsOzkiH9myKc%2FaaLBSQEywZcrb%2BN%2B67hPw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 914957c73c8556ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8369&min_rtt=1697&rtt_var=5401&sent=14&recv=18&lost=0&retrans=0&sent_bytes=4107&recv_bytes=4670&delivery_rate=349856&cwnd=12000&unsent_bytes=0&cid=99d41842fc6daae7&ts=333&x=1", cfExtPri, cfHdrFlush;dur=1