200 OK 64 B IP
ASN #135097 LUOGELANG FRANCE LIMITED
File type HTML document, ASCII text, with no line terminators
Hash 6ef5e94ac8a048654bbb0e332e1f4d26
90e2fa9edafc8dce78cb7044127f8e4778c4c6ac
b1aa2b3d2e44bf0e0efd02f846bd91fc62ee44487a240e769ef07f158a85875a
GET / HTTP/1.1
Host: down.6lugq4fy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Feb 2025 17:53:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
GET down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
200 OK 64 B URL User Request GET HTTP/1.1 down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
IP
ASN #135097 LUOGELANG FRANCE LIMITED
File type HTML document, ASCII text, with no line terminators
Hash 6ef5e94ac8a048654bbb0e332e1f4d26
90e2fa9edafc8dce78cb7044127f8e4778c4c6ac
b1aa2b3d2e44bf0e0efd02f846bd91fc62ee44487a240e769ef07f158a85875a
GET /cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe HTTP/1.1
Host: down.6lugq4fy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Feb 2025 17:53:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
GET down.6lugq4fy.com/tz.js
200 OK 744 B IP
ASN #135097 LUOGELANG FRANCE LIMITED
Requested by http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
File type JavaScript source, Unicode text, UTF-8 text
Hash cbb3115ba15a3069786c71c103889821
1327b7b0789086dd1bab2ea3e596a1de03397a8c
907aeaa2a4a8cb785ed418684b5551711596fee7f20f6df0c549c18b7873bd94
GET /tz.js HTTP/1.1
Host: down.6lugq4fy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Feb 2025 17:53:32 GMT
Content-Type: application/javascript
Last-Modified: Sun, 09 Feb 2025 11:02:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"67a88b58-4d7"
Expires: Mon, 10 Feb 2025 05:53:32 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
GET down.6lugq4fy.com/favicon.ico
200 OK 0 B URL GET HTTP/1.1 down.6lugq4fy.com/favicon.ico
IP
ASN #135097 LUOGELANG FRANCE LIMITED
Requested by http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: down.6lugq4fy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Feb 2025 17:53:32 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Tue, 30 Jul 2019 15:51:36 GMT
Connection: keep-alive
ETag: "5d406788-0"
Accept-Ranges: bytes
GET hm.baidu.com/hm.js?487ffdec7c2541c36779a4a6ee5ca68b
200 OK 11 kB URL GET HTTP/1.1 hm.baidu.com/hm.js?487ffdec7c2541c36779a4a6ee5ca68b
IP
Requested by http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
Certificate IssuerGlobalSign nv-sa
Subjectbaidu.com
FingerprintEF:0F:BE:13:02:E2:C4:D4:89:BA:8F:BA:88:EF:6F:95:DC:CF:7B:E0
ValidityMon, 08 Jul 2024 01:41:02 GMT - Sat, 09 Aug 2025 01:41:01 GMT
File type JavaScript source, ASCII text, with very long lines (617)
Hash a49ecb122b1f2d0e34684ceaea22ccea
a8f4219390152d3ee8d4b2a2a11e83be33b4359b
0f0544edce55fb95b898d69731ef96afc66e762a71d5fab49ce01b2fa25548b2
GET /hm.js?487ffdec7c2541c36779a4a6ee5ca68b HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://down.6lugq4fy.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11287
Content-Type: application/javascript
Date: Sun, 09 Feb 2025 17:53:33 GMT
Etag: 5d2d4b865bbc2597ebdae9a339094a32
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=3DE72187FE66443A; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
GET hm.baidu.com/hm.gif?hca=3DE72187FE66443A&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1577944250&si=487ffdec7c2541c36779a4a6ee5ca68b&v=1.3.2&lv=1&sn=21319&r=0&ww=1280&u=http%3A%2F%2Fdown.6lugq4fy.com%2Fcx%2F22%2F1%2F%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%25A4%25C3%2583%25C2%2582%25C3%2582%25C2%25A9%25C3%2583%25C2%2583%25C3%2582%25C2%25A7%25C3%2583%25C2%2582%25C3%2582%25C2%258C%25C3%2583%25C2%2582%25C3%2582%25C2%25AB%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%2594%25C3%2583%25C2%2582%25C3%2582%25C2%25AE%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%2590%25C3%2583%25C2%2582%25C3%2582%25C2%258E%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%258A%25C3%2583%25C2%2582%25C3%2582%25C2%25A9%25C3%2583%25C2%2583%25C3%2582%25C2%25A6%25C3%2583%25C2%2582%25C3%2582%25C2%2589%25C3%2583%25C2%2582%25C3%2582%25C2%258B_142_512693.exe
200 OK 43 B URL GET HTTP/1.1 hm.baidu.com/hm.gif?hca=3DE72187FE66443A&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1577944250&si=487ffdec7c2541c36779a4a6ee5ca68b&v=1.3.2&lv=1&sn=21319&r=0&ww=1280&u=http%3A%2F%2Fdown.6lugq4fy.com%2Fcx%2F22%2F1%2F%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%25A4%25C3%2583%25C2%2582%25C3%2582%25C2%25A9%25C3%2583%25C2%2583%25C3%2582%25C2%25A7%25C3%2583%25C2%2582%25C3%2582%25C2%258C%25C3%2583%25C2%2582%25C3%2582%25C2%25AB%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%2594%25C3%2583%25C2%2582%25C3%2582%25C2%25AE%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%2590%25C3%2583%25C2%2582%25C3%2582%25C2%258E%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%258A%25C3%2583%25C2%2582%25C3%2582%25C2%25A9%25C3%2583%25C2%2583%25C3%2582%25C2%25A6%25C3%2583%25C2%2582%25C3%2582%25C2%2589%25C3%2583%25C2%2582%25C3%2582%25C2%258B_142_512693.exe
IP
Requested by http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
Certificate IssuerGlobalSign nv-sa
Subjectbaidu.com
FingerprintEF:0F:BE:13:02:E2:C4:D4:89:BA:8F:BA:88:EF:6F:95:DC:CF:7B:E0
ValidityMon, 08 Jul 2024 01:41:02 GMT - Sat, 09 Aug 2025 01:41:01 GMT
File type GIF image data, version 89a, 1 x 1
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?hca=3DE72187FE66443A&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1577944250&si=487ffdec7c2541c36779a4a6ee5ca68b&v=1.3.2&lv=1&sn=21319&r=0&ww=1280&u=http%3A%2F%2Fdown.6lugq4fy.com%2Fcx%2F22%2F1%2F%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%25A4%25C3%2583%25C2%2582%25C3%2582%25C2%25A9%25C3%2583%25C2%2583%25C3%2582%25C2%25A7%25C3%2583%25C2%2582%25C3%2582%25C2%258C%25C3%2583%25C2%2582%25C3%2582%25C2%25AB%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%2594%25C3%2583%25C2%2582%25C3%2582%25C2%25AE%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%2590%25C3%2583%25C2%2582%25C3%2582%25C2%258E%25C3%2583%25C2%2583%25C3%2582%25C2%25A5%25C3%2583%25C2%2582%25C3%2582%25C2%258A%25C3%2583%25C2%2582%25C3%2582%25C2%25A9%25C3%2583%25C2%2583%25C3%2582%25C2%25A6%25C3%2583%25C2%2582%25C3%2582%25C2%2589%25C3%2583%25C2%2582%25C3%2582%25C2%258B_142_512693.exe HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://down.6lugq4fy.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Sun, 09 Feb 2025 17:53:33 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=E3DF58090869A8B2; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
GET 168.ying888.top/static/code.js
200 OK 4.2 kB URL GET HTTP/2 168.ying888.top/static/code.js
IP
ASN #137951 ASLINE LIMITED
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type gzip compressed data, from Unix
Hash f9aacc813cf1601e7baa1fc5526d7ea0
55b9ffb92e30521679f308607308221975858595
314095c8d2f94b5d15060cf4e28c6f0c3ff172d70fc40def994e68763538a650
GET /static/code.js HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://168.ying888.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: application/javascript
last-modified: Tue, 14 Jan 2025 13:57:08 GMT
vary: Accept-Encoding
etag: W/"67866d34-4a"
expires: Mon, 10 Feb 2025 05:53:33 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET 168.ying888.top/static/picture/jy1.png
200 OK 62 kB URL GET HTTP/2 168.ying888.top/static/picture/jy1.png
IP
ASN #137951 ASLINE LIMITED
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type PNG image data, 918 x 220, 8-bit/color RGBA, non-interlaced
Hash dbebb8da9fe8fa1f603761cd7924c89b
53e77c74152e66387b4ae7164c110b043e32d117
70805887f90c05c5c21c9955386f0d3f186fb4fc4a723ce1fee22a138c76607b
GET /static/picture/jy1.png HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://168.ying888.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: image/png
last-modified: Tue, 02 Apr 2024 12:20:00 GMT
vary: Accept-Encoding
etag: W/"660bf7f0-f44d"
expires: Tue, 11 Mar 2025 17:53:33 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET 168.ying888.top/link.js
200 OK 2.2 kB IP
ASN #137951 ASLINE LIMITED
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type Unicode text, UTF-8 text, with very long lines (2306), with no line terminators
Hash 749bd33ba2a104f8cd73fe060614e610
d4af2bffa652c92b0eaace4a28d8dfaf803493fd
fca65544d49a1a7dcd28b17945ceefc7897bc19287f56084d7213c6a2dccb683
GET /link.js HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://168.ying888.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: application/javascript
last-modified: Sun, 09 Feb 2025 09:06:16 GMT
vary: Accept-Encoding
etag: W/"67a87008-894"
expires: Mon, 10 Feb 2025 05:53:33 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET 168.ying888.top/
200 OK 2.0 kB IP
ASN #137951 ASLINE LIMITED
Requested by http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%A4%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A7%C3%83%C2%82%C3%82%C2%8C%C3%83%C2%82%C3%82%C2%AB%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%94%C3%83%C2%82%C3%82%C2%AE%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%90%C3%83%C2%82%C3%82%C2%8E%C3%83%C2%83%C3%82%C2%A5%C3%83%C2%82%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%A6%C3%83%C2%82%C3%82%C2%89%C3%83%C2%82%C3%82%C2%8B_142_512693.exe
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (2092), with no line terminators
Hash 800148d08dd5f5682907150baf6c6ebe
5dc3794a84960f78e9688bb37bdb579b00478d76
0433541480dbfe029caa9c60cd925cf82e5c7f391433760a8e7341a915ceb16d
GET / HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://down.6lugq4fy.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET 168.ying888.top/static/picture/bg1.jpg
200 OK 86 kB URL GET HTTP/2 168.ying888.top/static/picture/bg1.jpg
IP
ASN #137951 ASLINE LIMITED
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3840x2160, components 3
Hash ea68b88baf20c974aca2dfc04c3d2260
5b32700ad6ccec9ab72ff036fc0eb7a590b94e49
346245dbeb20cb69fe0b18a656607d02ee9f4a309512ffaf4e0d62bbaec27496
GET /static/picture/bg1.jpg HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://168.ying888.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: image/jpeg
last-modified: Tue, 02 Apr 2024 12:20:00 GMT
vary: Accept-Encoding
etag: W/"660bf7f0-15211"
expires: Tue, 11 Mar 2025 17:53:33 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET 168.ying888.top/static/picture/kaiyun.png
200 OK 24 kB URL GET HTTP/2 168.ying888.top/static/picture/kaiyun.png
IP
ASN #137951 ASLINE LIMITED
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type PNG image data, 918 x 220, 8-bit colormap, non-interlaced
Hash 5ac1aae1401f4abd5ab81f8741e44ee9
67e8bdf179f4b0fda1c1e3f5ddccaed51dd961ca
bbf1492b152a535d42b16c0c3b2dde9de8aa5b0afea11d2beefcd7c9aef066e0
GET /static/picture/kaiyun.png HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://168.ying888.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: image/png
last-modified: Tue, 02 Apr 2024 12:20:01 GMT
vary: Accept-Encoding
etag: W/"660bf7f1-5ce3"
expires: Tue, 11 Mar 2025 17:53:33 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET 168.ying888.top/static/picture/ayx.png
200 OK 24 kB URL GET HTTP/2 168.ying888.top/static/picture/ayx.png
IP
ASN #137951 ASLINE LIMITED
Certificate IssuerLet's Encrypt
Subject168.ying888.top
Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9
ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT
File type PNG image data, 918 x 220, 8-bit colormap, non-interlaced
Hash 553c082a1103cfc44f9813dcb343600f
930cca7568d14b8523fe966f891c6dd761dc63ed
6a25744e4e31c7dff4d2f2b8584a5ee1e74be7ba317782dd38bd5e262b12b9dc
GET /static/picture/ayx.png HTTP/1.1
Host: 168.ying888.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://168.ying888.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 09 Feb 2025 17:53:33 GMT
content-type: image/png
last-modified: Tue, 02 Apr 2024 12:20:00 GMT
vary: Accept-Encoding
etag: W/"660bf7f0-5f90"
expires: Tue, 11 Mar 2025 17:53:33 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
156.226.123.142
14.215.183.79
168.206.204.221