504 B IP
ASN #20940 Akamai International B.V.
Hash 3bd6a6d19bf0ab70e4e0cd3d2833afe1
0dd2ee68cf939d2482a9b30bf767f412eb97e492
23c60c02f8a6f1f7fe01f9f4661cf04a03c046522201927dfa7c51ceba6c5449
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "23C60C02F8A6F1F7FE01F9F4661CF04A03C046522201927DFA7C51CEBA6C5449"
Last-Modified: Sat, 20 Jul 2024 20:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9986
Expires: Sun, 21 Jul 2024 23:58:40 GMT
Date: Sun, 21 Jul 2024 21:12:14 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 2f796f6340ac7eef4fa2891ac8f8aa1a
27bbc7bb6314b31dcab89f198bc258b040593aa7
778d02decabf7dff03bf5ec4c4eb0f03ac789e89bcfe58353c266c9d66c08834
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "778D02DECABF7DFF03BF5EC4C4EB0F03AC789E89BCFE58353C266C9D66C08834"
Last-Modified: Sat, 20 Jul 2024 19:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10216
Expires: Mon, 22 Jul 2024 00:02:30 GMT
Date: Sun, 21 Jul 2024 21:12:14 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash cf41dddde2cb04d4f8b233b01318bde1
f7f9259cebf98c255ea506e7d7f0170c1e6a9604
90a7510dc4acc5716c9a82e10dcbb6074af14f502e3847f8b6c43caef244ca12
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "90A7510DC4ACC5716C9A82E10DCBB6074AF14F502E3847F8B6C43CAEF244CA12"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10125
Expires: Mon, 22 Jul 2024 00:01:00 GMT
Date: Sun, 21 Jul 2024 21:12:15 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 44c7dc0b46b7c19b42e7d20a97383e7f
c381770f67933f749e690efeb174b1f8c961b018
00177d3c9c6b0bb3dcbfdc1c5c399a8381dc1b0fafc3fd47427aae3eccbf6653
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "00177D3C9C6B0BB3DCBFDC1C5C399A8381DC1B0FAFC3FD47427AAE3ECCBF6653"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12629
Expires: Mon, 22 Jul 2024 00:42:44 GMT
Date: Sun, 21 Jul 2024 21:12:15 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 41b470cfcb4d809b7689783076e07c76
919b05dba2523cc4b8e9a6e873fe777fd753ee1b
951ae19e1eb066355bf55ff2163f6d14b689088fa3dd443fb01d889bb28fe095
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "951AE19E1EB066355BF55FF2163F6D14B689088FA3DD443FB01D889BB28FE095"
Last-Modified: Sat, 20 Jul 2024 19:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11498
Expires: Mon, 22 Jul 2024 00:23:53 GMT
Date: Sun, 21 Jul 2024 21:12:15 GMT
Connection: keep-alive
GET a.lulucdn.com/js/dnsads.js?ads=1&AdType=1&cbrandom=2&clicktag=http
200 OK 38 B URL GET HTTP/2 a.lulucdn.com/js/dnsads.js?ads=1&AdType=1&cbrandom=2&clicktag=http
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
File type ASCII text, with CRLF line terminators
Hash 99eccae6afa72c589ae54b5c3890282a
0f102f8f5b556635de65d16cf70fa8269c6761b4
b74a58316385de04b054737776e71c160cd60d2d01b5440b32c21651fb0ab8d3
GET /js/dnsads.js?ads=1&AdType=1&cbrandom=2&clicktag=http HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: application/javascript
content-length: 38
last-modified: Mon, 13 Sep 2021 15:50:14 GMT
etag: "26-5cbe26bbab980"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3934
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0BfPXaSplellebK3wVAzlJkphMeMuFKgRbU3Cg8BbTCs7pNXUDz41neUKwa1ojXy6K%2FOFS1fEcJ4VgHURxXVt%2FfDqOcrwBu5k6%2FYhM%2Fc39s%2BPO%2FFgWw8YuNBj82QK4zS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b1f765689-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET img.luluvdo.com/rbswfcfn5jab.jpg
200 OK 48 kB URL GET HTTP/2 img.luluvdo.com/rbswfcfn5jab.jpg
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 720x405, components 3
Hash deeb05353b8ed2b31cdb1e1efed5cb42
cad1fff443691194aad5dceff3245c2547e1b2db
76e2b0c17b1ba392a57f231898beefbde00095bfb7ccaf04649fc1a770f564b5
GET /rbswfcfn5jab.jpg HTTP/1.1
Host: img.luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Cookie: lang=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: image/jpeg
content-length: 47839
cache-control: max-age=604800
cf-bgj: imgq:100,h2pri
cf-polished: origSize=49097
etag: "669bdc15-bfc9"
expires: Sat, 27 Jul 2024 15:47:40 GMT
last-modified: Sat, 20 Jul 2024 15:47:33 GMT
cf-cache-status: HIT
age: 104899
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TmTwngBbx4Z9YORjwaq%2FshyxB0Fp34AmqSRNgO4c%2B0BGEUpm2a5syaWt%2FiCW7P8fSxg7xZngJdPnuiRRaK0ayU%2FWvWza1ADTSkJ55gLFKlfTl7Vulho6V%2For0ELg20NFzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b5f0056ab-OSL
X-Firefox-Spdy: h2
471 B IP
Hash 48e6cdb13626c3c2fb5d2e89efbd9cc4
8af73ba0b074f21efb0ccb33263cddd60f382e8d
0312d1d62a3e023bae9df614d8a572234a9f83e7adb718c708fa02a3075f7189
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:15 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET www.googletagmanager.com/gtag/js?id=G-RFESL45RJX
200 OK 104 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=G-RFESL45RJX
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
FingerprintB3:23:88:EF:34:69:5A:0C:81:CE:02:E2:E3:19:FE:95:71:75:A1:14
ValidityMon, 24 Jun 2024 06:35:05 GMT - Mon, 16 Sep 2024 06:35:04 GMT
File type JavaScript source, ASCII text, with very long lines (5945)
Size 104 kB (104085 bytes)
Hash ecbab42e3faaab8e1fd4d15eb5410ca7
7a0323564252a87b88a38e0fbc936ab4ee1cb28b
cab1ab0d96f618a9f0ae4871549ba6663cfc80c170d22c94fa98a0622728ce17
GET /gtag/js?id=G-RFESL45RJX HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 21 Jul 2024 21:12:16 GMT
expires: Sun, 21 Jul 2024 21:12:16 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 104085
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
471 B IP
Hash 48e6cdb13626c3c2fb5d2e89efbd9cc4
8af73ba0b074f21efb0ccb33263cddd60f382e8d
0312d1d62a3e023bae9df614d8a572234a9f83e7adb718c708fa02a3075f7189
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET luluvdo.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
302 Found 0 B URL GET HTTP/2 luluvdo.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
date: Sun, 21 Jul 2024 21:12:16 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/bbfecc7f1c71/main.js?
cache-control: max-age: 300, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U4uhRnww5xbgkW9TFi%2FjSI4xeg7Jm0xexE8UZfCDVxqc5vFXsROmhS%2FY%2FwaBUny0Re81Ju50gVRGlAzsRygv%2BF4ox6v1Zmy%2BjSqjTb3GuQGaqubt5K66Kbyar1yP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302e1a3a56ab-OSL
X-Firefox-Spdy: h2
472 B IP
Hash 921c9e1c30018e9de75e9b06e5b6f418
29c0ca157230a7ac92c37d2b30c5115b3d1e550b
2ef50c77eddc54a2043f297acc16c22246f2f6a2e950b15d2bacdcfd10ee4846
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET a.lulucdn.com/player/jw8/provider.hlsjs.js
200 OK 115 kB URL GET HTTP/3 a.lulucdn.com/player/jw8/provider.hlsjs.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
File type JavaScript source, ASCII text, with very long lines (65143)
Size 115 kB (114975 bytes)
Hash e133e8e7b97079d4bc7ec71fae611795
14f34839087df4a3a09ba2f11a768f0d14af979d
f0d08bd0271c5d085f5d1419b1af887eb9c250aac800cadc4d5ea64c3a348e97
GET /player/jw8/provider.hlsjs.js HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: application/javascript
last-modified: Wed, 07 Jun 2023 06:30:49 GMT
etag: W/"5e59e-5fd8446d199fb"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3663
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W0XQS7KWrJ1%2BK3ZGB40N9Z8D4yRQCe7xMHnvfAdb30ZA1jKR8NwAjgDBy0YzzHg3NtjuQoLRkwGMPo8CGZoBzqfBmZ9Iuf49ahI6B5Cc4Smrc180fo6zMb%2B57Fh%2FesYQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302dd8f75691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
POST luluvdo.com/cdn-cgi/challenge-platform/h/b/jsd/r/8a6e3026daba56ab
200 OK 0 B URL POST HTTP/2 luluvdo.com/cdn-cgi/challenge-platform/h/b/jsd/r/8a6e3026daba56ab
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/challenge-platform/h/b/jsd/r/8a6e3026daba56ab HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12160
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/e/rbswfcfn5jab
Cookie: lang=1; _ga_RFESL45RJX=GS1.1.1721596336.1.0.1721596336.0.0.0; _ga=GA1.1.590445316.1721596336
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.luluvdo.com; HttpOnly; Secure; SameSite=None
cf_clearance=EGmutHd8ZOvcHPEoHi8QUQeS.3ExqwP3TONuf3sbaGQ-1721596336-1.0.1.1-TGfX4nCuHuW1DQgV7plBxvqjT9th6by1x52nOGT4m6QSwsJwrMN3uaXbsER7ScxDXkpRNl12LPm6S_GxVuNBDA; Path=/; Expires=Mon, 21-Jul-25 21:12:16 GMT; Domain=.luluvdo.com; HttpOnly; Secure; SameSite=None; Partitioned
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CX5TsHDVvqBGdpeQa5mDtRPoxje6eisfqeJbGY9nLkEobF0%2BRkMwHkPCtsmDhELJ5vpjJCHPwv0ALIHkJO%2Fbl%2FfJGj6qnxVXvB9mNR%2BKlypuctShDsMycUsA61d1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e3030fcdc56ab-OSL
X-Firefox-Spdy: h2
GET luluvdo.com/srt/empty.srt
200 OK 42 B URL GET HTTP/2 luluvdo.com/srt/empty.srt
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type SubRip, ASCII text, with CRLF line terminators
Hash 7f8501e8cf0fd2262e1ec59fa6653797
5ea9200f583b21ec2008fc44447b2a15ab31f246
f3adadb235f7ecab4a68f4d0961640c155c0d2057d28fe24e19d36b04904ddc6
GET /srt/empty.srt HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/e/rbswfcfn5jab
Cookie: lang=1; _ga_RFESL45RJX=GS1.1.1721596336.1.0.1721596336.0.0.0; _ga=GA1.1.590445316.1721596336; cf_clearance=EGmutHd8ZOvcHPEoHi8QUQeS.3ExqwP3TONuf3sbaGQ-1721596336-1.0.1.1-TGfX4nCuHuW1DQgV7plBxvqjT9th6by1x52nOGT4m6QSwsJwrMN3uaXbsER7ScxDXkpRNl12LPm6S_GxVuNBDA
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/vtt; charset=utf-8
content-length: 42
last-modified: Fri, 08 Jul 2016 15:03:06 GMT
etag: "2a-537211991fe80"
accept-ranges: bytes
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fyUi83wBrZiG1HAMpMtIZUhkMD5NjSoLg42508uiph0dP2rF3XC%2BuW6tkePSKEKsCj4LR99Ctxg0Jha30neAHl5gMb%2BcmixNlsFT0jJKD67yetZzAtkFbVwZUZSk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e30317d5356ab-OSL
X-Firefox-Spdy: h2
GET a.lulucdn.com/player/jw8/jwplayer.core.controls.js
200 OK 275 kB URL GET HTTP/3 a.lulucdn.com/player/jw8/jwplayer.core.controls.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
File type JavaScript source, ASCII text, with very long lines (65143)
Size 275 kB (275305 bytes)
Hash a8889c5f9e2492b9c3d6f73b5bad08fe
6b942336401bc4ecd598f91fcaa7db96c889e6b4
43502aabf4a1ce166cb2a84a177579663aa32e1ea7db8666bc67534a53a0f368
GET /player/jw8/jwplayer.core.controls.js HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: application/javascript
last-modified: Tue, 28 Nov 2023 20:20:44 GMT
etag: W/"5167f-60b3c274227f4"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3663
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9CCCAzWicU8BwzrO%2BiX6Oqwx6iqeYqHdMSYVArD96OMUfp%2FBM29EpqWOVGePSbNvQNQtA%2FowSvWr17ZtzUHAh3lUDJVWJVfV5aZ8%2Bnq0xO8KQfIZJgWGp%2BiP8sRBlMH5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302dc8ee5691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
471 B IP
Hash 46f85c4a309fcd4386e43c4c515c24af
9f69ef7658bd939f2a65951b7bf2c9426aedeb8a
2892b4c0f1030eb4eb0a651699a7c3a2746c1f7c12a57c37703a88a00431aabc
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2
200 OK 7.9 kB URL GET HTTP/2 fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
FingerprintEE:FE:75:C9:E5:09:76:EB:38:E8:5F:5F:31:DF:88:D1:BF:9A:93:09
ValidityMon, 24 Jun 2024 07:40:48 GMT - Mon, 16 Sep 2024 07:40:47 GMT
File type Web Open Font Format (Version 2), TrueType, length 7884, version 1.0
Hash 9212f6f9860f9fc6c69b02fedf6db8c3
ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
GET /s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7884
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Jul 2024 04:18:20 GMT
expires: Fri, 18 Jul 2025 04:18:20 GMT
cache-control: public, max-age=31536000
age: 320037
last-modified: Fri, 22 Mar 2024 00:00:38 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
200 OK 7.8 kB URL GET HTTP/2 fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
FingerprintEE:FE:75:C9:E5:09:76:EB:38:E8:5F:5F:31:DF:88:D1:BF:9A:93:09
ValidityMon, 24 Jun 2024 07:40:48 GMT - Mon, 16 Sep 2024 07:40:47 GMT
File type Web Open Font Format (Version 2), TrueType, length 7816, version 1.0
Hash 25b0e113ca7cce3770d542736db26368
cb726212d5d525021752a1d8470a0fb593e0c49e
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
GET /s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7816
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 17 Jul 2024 20:36:23 GMT
expires: Thu, 17 Jul 2025 20:36:23 GMT
cache-control: public, max-age=31536000
age: 347754
last-modified: Fri, 22 Mar 2024 00:00:32 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET luluvdo.com/player/jw8/jw8-theme.css
200 OK 55 kB URL GET HTTP/2 luluvdo.com/player/jw8/jw8-theme.css
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type ASCII text, with very long lines (24164), with no line terminators
Hash e0f5307afb3719dc5c4cb76c2600e6e1
cf1afe5bcfbc722ec7e888d1151e8744e6ea8477
2e56f5be5eeac32b43a8abe50d2a38b14fd3d94843eaa1a8acdcabb576019749
GET /player/jw8/jw8-theme.css HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/e/rbswfcfn5jab
Cookie: lang=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/css
access-control-allow-origin: *
cf-bgj: minify
cf-polished: origSize=24379
etag: W/"5f3b-612e330968823"
last-modified: Tue, 05 Mar 2024 05:34:02 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 4126
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2FuSPIc2pRI9l2nP3BHAagOKfgbokVDOiqtiijP%2B0lAH9asgLfa871hwCGWbCp6ND1mT7Qv4R82TdV%2BFnLEFvR9ogLkqKXVFAcC1Yg4TGQ7%2Bss5DJgYUR8uN5uwx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302dc9f056ab-OSL
content-encoding: br
X-Firefox-Spdy: h2
471 B IP
Hash 46f85c4a309fcd4386e43c4c515c24af
9f69ef7658bd939f2a65951b7bf2c9426aedeb8a
2892b4c0f1030eb4eb0a651699a7c3a2746c1f7c12a57c37703a88a00431aabc
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET a.lulucdn.com/js/xupload.js
200 OK 39 kB URL GET HTTP/2 a.lulucdn.com/js/xupload.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
File type JavaScript source, ASCII text
Hash e7cb7dae1da48c74b41563b936111f97
bda176bc9fd4060d50006cd31d8c25453362db70
590c624e3400ed1e344d5c44f184356937d2704917289340ec5b099d35d5b9e8
GET /js/xupload.js HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: application/javascript
last-modified: Thu, 12 Jan 2023 11:18:46 GMT
etag: W/"2a26-5f20f47c3d180"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3934
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OkR9WvBCJibqonjcwBCFiBWYn%2Bqs%2FwlydfNJu405TMQjsfB9FOSjb6kEr9hxRKdQUQTDuyseRQBOhvgZ%2FaA%2F%2BgxIPS7A3K%2B9ByUKezqlK4G8PbwaRFfHrM3xL8KqIwwG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b3f875689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET xml.zeusadx.com/redirect?feed=687995&auth=s9cHq9&pubid=207410
302 Found 0 B URL GET HTTP/1.1 xml.zeusadx.com/redirect?feed=687995&auth=s9cHq9&pubid=207410
IP
ASN #27257 WEBAIR-INTERNET
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.zeusadx.com
FingerprintAA:67:88:35:5F:BC:20:3C:44:9B:00:BD:4F:E1:C0:5F:62:D0:69:C0
ValidityMon, 23 Oct 2023 00:00:00 GMT - Wed, 23 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect?feed=687995&auth=s9cHq9&pubid=207410 HTTP/1.1
Host: xml.zeusadx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Location: https://de.forerungirdles.com/i6oKq6spPDgpeY/QrOEQ
GET pop.admpire.com/sub/qp2aprP
200 OK 503 B URL GET HTTP/2 pop.admpire.com/sub/qp2aprP
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectadmpire.com
Fingerprint36:29:B6:35:0C:A6:B0:68:59:73:6F:27:0D:BA:E1:D4:57:3C:B6:29
ValidityWed, 03 Jul 2024 17:21:23 GMT - Tue, 01 Oct 2024 17:21:22 GMT
File type HTML document, ASCII text
Hash 0c4e3847049747a5ed70ca924704478b
d5c5a04b18c9f9a2c30191120165bb8048a1dd51
490f3468322dd9f9c2f96ece863dc8d9983956d5bb46c23480ff6d229e19b852
GET /sub/qp2aprP HTTP/1.1
Host: pop.admpire.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/html; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DjtAyMxvYYKpHXMNVDFpaMpOnzuu%2BwI96ES46BNWtOrk0IKUpKh4dKZF9bQl3M5%2Fc%2BAY6JuD5arbxk1ft1XvXqwH4F4EHngd7aolB4%2FNraHrsQPktt%2FIFnLrdpBL5Q6Hs5Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e302edf01b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET pop.admpire.com/sub/XqVRq1x
200 OK 144 B URL GET HTTP/2 pop.admpire.com/sub/XqVRq1x
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectadmpire.com
Fingerprint36:29:B6:35:0C:A6:B0:68:59:73:6F:27:0D:BA:E1:D4:57:3C:B6:29
ValidityWed, 03 Jul 2024 17:21:23 GMT - Tue, 01 Oct 2024 17:21:22 GMT
File type HTML document, ASCII text
Hash 1f7102dc63d1a3e83042d6774e54dfec
340b8c7a3710c0e121378b9484a204f81387a43b
6d0f23d660a086b0b30e476959b1d3bdd3c10a7c9a04cc5886643212e081a3da
GET /sub/XqVRq1x HTTP/1.1
Host: pop.admpire.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/html; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2BShJIpmw%2BCxZiRnbXFKWVbI2H7ZztkG5EcuuA30J%2Fw%2BhTvrNorjpgXim9wptFW4MOztEbE60CAIlQDraK3YEEHXQzJoSEgFdNo50AgfpQkKmwxIGOX9Q7YNR%2FJDZgJGxpQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e302eceebb517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET xml.xmlking.com/redirect?feed=687997&auth=C3o8rz&pubid=195184
200 OK 0 B URL GET HTTP/1.1 xml.xmlking.com/redirect?feed=687997&auth=C3o8rz&pubid=195184
IP
ASN #27257 WEBAIR-INTERNET
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.xmlking.com
Fingerprint61:F0:9B:53:D2:DF:03:A0:08:09:BE:79:B1:70:10:34:65:07:7B:6D
ValidityWed, 26 Jul 2023 00:00:00 GMT - Fri, 26 Jul 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect?feed=687997&auth=C3o8rz&pubid=195184 HTTP/1.1
Host: xml.xmlking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
504 B IP
ASN #20940 Akamai International B.V.
Hash 92fe046ed30974fab002b18924562af5
a80246a7f4813076cea6cc1629667b43a094fa97
151d89929b8b12751f94a9dd4fab74f68f20aa29ca5135a3b95aea9f366a34e7
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "151D89929B8B12751F94A9DD4FAB74F68F20AA29CA5135A3B95AEA9F366A34E7"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11143
Expires: Mon, 22 Jul 2024 00:18:00 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 92fe046ed30974fab002b18924562af5
a80246a7f4813076cea6cc1629667b43a094fa97
151d89929b8b12751f94a9dd4fab74f68f20aa29ca5135a3b95aea9f366a34e7
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "151D89929B8B12751F94A9DD4FAB74F68F20AA29CA5135A3B95AEA9F366A34E7"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11143
Expires: Mon, 22 Jul 2024 00:18:00 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 92fe046ed30974fab002b18924562af5
a80246a7f4813076cea6cc1629667b43a094fa97
151d89929b8b12751f94a9dd4fab74f68f20aa29ca5135a3b95aea9f366a34e7
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "151D89929B8B12751F94A9DD4FAB74F68F20AA29CA5135A3B95AEA9F366A34E7"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11143
Expires: Mon, 22 Jul 2024 00:18:00 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 92fe046ed30974fab002b18924562af5
a80246a7f4813076cea6cc1629667b43a094fa97
151d89929b8b12751f94a9dd4fab74f68f20aa29ca5135a3b95aea9f366a34e7
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "151D89929B8B12751F94A9DD4FAB74F68F20AA29CA5135A3B95AEA9F366A34E7"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11143
Expires: Mon, 22 Jul 2024 00:18:00 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 92fe046ed30974fab002b18924562af5
a80246a7f4813076cea6cc1629667b43a094fa97
151d89929b8b12751f94a9dd4fab74f68f20aa29ca5135a3b95aea9f366a34e7
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "151D89929B8B12751F94A9DD4FAB74F68F20AA29CA5135A3B95AEA9F366A34E7"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11143
Expires: Mon, 22 Jul 2024 00:18:00 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
POST pop.admpire.com/load
302 Found 359 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectadmpire.com
Fingerprint36:29:B6:35:0C:A6:B0:68:59:73:6F:27:0D:BA:E1:D4:57:3C:B6:29
ValidityWed, 03 Jul 2024 17:21:23 GMT - Tue, 01 Oct 2024 17:21:22 GMT
File type HTML document, ASCII text
Hash f23a160159fc45b49e61e637ddf16ff2
86738d3f8c7f85c3707a5b59d8b3711f9c3b13eb
0fb658f136ac8ad5359e67eec54814417f3514d1853b88a50364302312b58134
POST /load HTTP/1.1
Host: pop.admpire.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 92
Origin: https://pop.admpire.com
DNT: 1
Connection: keep-alive
Referer: https://pop.admpire.com/sub/XqVRq1x
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/html; charset=utf-8
location: https://xml.acertb.com/redirect?feed=687996&auth=g2jD4T&pubid=207411
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=us%2B%2B8kW3EefWFUWDqqnobdJLy4v5kYZRcyw48F86NdNvY8Z4tqLtmCX4e9bQ2AB%2BFN5%2FPuHBI3Hwx%2B9gI32jPxMkW8dD62v71rHNAM9AqsWY5xwg9LqHHn09jUJAi75Xnq8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e303159db56c6-OSL
alt-svc: h3=":443"; ma=86400
504 B IP
ASN #20940 Akamai International B.V.
Hash 31f4eed537e9abb81ae46a34f50dae3a
eef50c82462bfcc6dcc32fd31285a8ffaadaa459
50709e5fdc7b7c2ef00ef7a17d831ee4a90eea2799937b5bbf57ec2cdd81619c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "50709E5FDC7B7C2EF00EF7A17D831EE4A90EEA2799937B5BBF57EC2CDD81619C"
Last-Modified: Sat, 20 Jul 2024 20:42:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12349
Expires: Mon, 22 Jul 2024 00:38:06 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
504 B IP
ASN #20940 Akamai International B.V.
Hash 31f4eed537e9abb81ae46a34f50dae3a
eef50c82462bfcc6dcc32fd31285a8ffaadaa459
50709e5fdc7b7c2ef00ef7a17d831ee4a90eea2799937b5bbf57ec2cdd81619c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "50709E5FDC7B7C2EF00EF7A17D831EE4A90EEA2799937B5BBF57EC2CDD81619C"
Last-Modified: Sat, 20 Jul 2024 20:42:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12349
Expires: Mon, 22 Jul 2024 00:38:06 GMT
Date: Sun, 21 Jul 2024 21:12:17 GMT
Connection: keep-alive
GET de.forerungirdles.com/i6oKq6spPDgpeY/QrOEQ
200 OK 61 B URL GET HTTP/1.1 de.forerungirdles.com/i6oKq6spPDgpeY/QrOEQ
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectde.forerungirdles.com
Fingerprint3B:E3:2F:66:9C:8C:F7:DD:F2:13:FC:A7:C5:30:47:3F:77:EE:DE:62
ValidityFri, 07 Jun 2024 02:51:37 GMT - Thu, 05 Sep 2024 02:51:36 GMT
File type HTML document, ASCII text, with no line terminators
Hash 86733bb66fb84b851592d733e51f0cbd
42eaf19a5ca195667a9212b0ea3557eee76954a8
927676bdf7f1bdcd71f06cc0d9fa573791b12c905629d806851624687c4b4a0d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /i6oKq6spPDgpeY/QrOEQ HTTP/1.1
Host: de.forerungirdles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Mon, 22-Jul-2024 21:12:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Mon, 22-Jul-2024 21:12:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
GET de.forerungirdles.com/i6oKq6spPDgpeY/QrOEQ
200 OK 61 B URL GET HTTP/1.1 de.forerungirdles.com/i6oKq6spPDgpeY/QrOEQ
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectde.forerungirdles.com
Fingerprint3B:E3:2F:66:9C:8C:F7:DD:F2:13:FC:A7:C5:30:47:3F:77:EE:DE:62
ValidityFri, 07 Jun 2024 02:51:37 GMT - Thu, 05 Sep 2024 02:51:36 GMT
File type HTML document, ASCII text, with no line terminators
Hash 86733bb66fb84b851592d733e51f0cbd
42eaf19a5ca195667a9212b0ea3557eee76954a8
927676bdf7f1bdcd71f06cc0d9fa573791b12c905629d806851624687c4b4a0d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /i6oKq6spPDgpeY/QrOEQ HTTP/1.1
Host: de.forerungirdles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Mon, 22-Jul-2024 21:12:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Mon, 22-Jul-2024 21:12:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
GET 6.adsco.re:2087/
200 OK 45 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5b41cb22f84f645a103acc7bfbf084ff
bac3967b26d5ec4a0d09a580714e8219796816bd
709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc
GET / HTTP/1.1
Host: 6.adsco.re:2087
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:17 GMT
content-type: text/plain;charset=UTF-8
content-length: 45
access-control-allow-origin: https://luluvdo.com
cache-control: private, max-age=10
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-max-age: 2592000
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e3037f9ccb529-OSL
alt-svc: h3=":2087"; ma=86400
X-Firefox-Spdy: h2
GET www.animezeno.sbs/
200 OK 638 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectanimezeno.sbs
Fingerprint18:6B:72:E5:C9:BA:4B:E5:CA:48:8F:A8:1A:DF:50:57:E0:AC:B4:3C
ValidityMon, 10 Jun 2024 00:01:14 GMT - Sun, 08 Sep 2024 00:01:13 GMT
File type HTML document, ASCII text, with very long lines (1014)
Hash 7b37bd4f62d715a0873bac41a0aa4f50
cc82e2e935fed4fdf428d295101fe51a9d835da6
41073afd70d67192731d0e6330e0c56eef44eac903dca4baa6b319d8a87928ed
GET / HTTP/1.1
Host: www.animezeno.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:17 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LaRHguDhHJR8UXg7NzG0pRvdqcE8ogRkoM%2F72laUjxeSK9yK6T2DiXfTJ9Ghe1NMKcyn86WCIVv5LOYKXULlRzTuHaAfKvsYje5ZofyQPsDipMXadVSR4XxQZ%2Bu9UlQjcd%2B%2BdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e3036cdd656b9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET 4.adsco.re:2087/
200 OK 62 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5b41cb22f84f645a103acc7bfbf084ff
bac3967b26d5ec4a0d09a580714e8219796816bd
709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc
GET / HTTP/1.1
Host: 4.adsco.re:2087
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://luluvdo.com
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=5
Content-Encoding: gzip
POST pop.admpire.com/load
302 Found 361 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectadmpire.com
Fingerprint36:29:B6:35:0C:A6:B0:68:59:73:6F:27:0D:BA:E1:D4:57:3C:B6:29
ValidityWed, 03 Jul 2024 17:21:23 GMT - Tue, 01 Oct 2024 17:21:22 GMT
File type HTML document, ASCII text
Hash def739adddd65121838c49fd74ba5387
fc438489159f3eef91db030a0cb1df8ac29c94f9
11a6d1475385574b3756b5d51c36b4f30f9ee74d6f41bd158eec77d163749eb3
POST /load HTTP/1.1
Host: pop.admpire.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 93
Origin: https://pop.admpire.com
DNT: 1
Connection: keep-alive
Referer: https://pop.admpire.com/sub/NqD7qY8
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/html; charset=utf-8
location: https://xml.zeusadx.com/redirect?feed=687995&auth=s9cHq9&pubid=207410
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PPWO60Y7Si%2F0ngZWpUeTCYXvmFq%2FIgpBBnSPsjkvr%2ByLSv5vKzmadXhQDi7LeN3hHGcdR4zsLk4yrhm6sPjoXvtwmxqx7z1LCf02N2dn3BiRg%2BDnnwfCW22uKQrFY%2BnAxwE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e303169ef56c6-OSL
alt-svc: h3=":443"; ma=86400
GET 4.adsco.re/
200 OK 62 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5b41cb22f84f645a103acc7bfbf084ff
bac3967b26d5ec4a0d09a580714e8219796816bd
709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc
GET / HTTP/1.1
Host: 4.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://luluvdo.com
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=5
Content-Encoding: gzip
345 B IP
ASN #20940 Akamai International B.V.
Hash d9a6691a3a8f29daf82589e7c2a08189
bbdb8888a2a87877b948338b8546f1618f89b700
c52a0e8fe0d79386d2f691146c06b561017d7f8ce4171c452b4e5929caff1794
POST / HTTP/1.1
Host: e5.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "C52A0E8FE0D79386D2F691146C06B561017D7F8CE4171C452B4E5929CAFF1794"
Last-Modified: Fri, 19 Jul 2024 10:12:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14361
Expires: Mon, 22 Jul 2024 01:11:39 GMT
Date: Sun, 21 Jul 2024 21:12:18 GMT
Connection: keep-alive
POST z23qigruneny.l4.adsco.re/
200 OK 0 B URL POST HTTP/2 z23qigruneny.l4.adsco.re/
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subject*.l4.adsco.re
FingerprintB3:06:A3:8B:9C:3C:9F:43:F9:CA:19:43:6D:E5:0B:28:30:57:E4:FF
ValidityFri, 19 Jul 2024 09:12:49 GMT - Thu, 17 Oct 2024 09:12:48 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1
Host: z23qigruneny.l4.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/html
content-length: 0
last-modified: Fri, 02 Jun 2023 14:03:32 GMT
etag: "6479f6b4-0"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
X-Firefox-Spdy: h2
346 B IP
ASN #20940 Akamai International B.V.
Hash c22db07f29212cc075067d638aa878a5
0253211a14e0212d49758f99b3b11cfc72ca02d0
b6f73619e322ab70dfb08af0eb0b8396cf50899ef575c6af4987d8f5f0204a44
POST / HTTP/1.1
Host: e5.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "B6F73619E322AB70DFB08AF0EB0B8396CF50899EF575C6AF4987D8F5F0204A44"
Last-Modified: Fri, 19 Jul 2024 10:13:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3720
Expires: Sun, 21 Jul 2024 22:14:18 GMT
Date: Sun, 21 Jul 2024 21:12:18 GMT
Connection: keep-alive
GET 6.adsco.re/
200 OK 45 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5b41cb22f84f645a103acc7bfbf084ff
bac3967b26d5ec4a0d09a580714e8219796816bd
709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc
GET / HTTP/1.1
Host: 6.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://c.adsco.re/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/plain;charset=UTF-8
content-length: 45
access-control-allow-origin: *
cache-control: private, max-age=10
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-max-age: 2592000
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e303a4b5ab511-OSL
alt-svc: h3=":443"; ma=86400
POST z23qigruneny.n4.adsco.re/
200 OK 0 B URL POST HTTP/2 z23qigruneny.n4.adsco.re/
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subject*.n4.adsco.re
FingerprintBB:DF:ED:75:C9:EF:7E:6D:EA:22:08:14:AB:1E:62:F4:83:3E:F9:D4
ValidityFri, 19 Jul 2024 09:12:42 GMT - Thu, 17 Oct 2024 09:12:41 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1
Host: z23qigruneny.n4.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/html
content-length: 0
last-modified: Fri, 16 Jun 2023 08:37:42 GMT
etag: "648c1f56-0"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
X-Firefox-Spdy: h2
GET 4.adsco.re/
200 OK 62 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5b41cb22f84f645a103acc7bfbf084ff
bac3967b26d5ec4a0d09a580714e8219796816bd
709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc
GET / HTTP/1.1
Host: 4.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://c.adsco.re/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 21 Jul 2024 21:12:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=5
Content-Encoding: gzip
GET bedrapiona.com/4/5615727/
200 OK 18 kB URL GET HTTP/2 bedrapiona.com/4/5615727/
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectbedrapiona.com
Fingerprint4F:13:86:8F:6A:7E:D6:58:A2:A9:95:9E:3E:FA:01:4B:0D:E6:7B:B0
ValidityWed, 29 May 2024 19:06:32 GMT - Tue, 27 Aug 2024 19:06:31 GMT
File type gzip compressed data, max speed, from Unix
Hash e3776fed215ca642601dd6685324cf4d
98ad1a644b5fe1e0925cba82fa0868d7dcc0527c
5dc381001d35e39d8926e1798bced3987ea2e1f550fdf0a521029ef006e06b02
GET /4/5615727/ HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.animezeno.sbs/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/html; charset=utf8
x-trace-id: 14ab4db256d80f01e1410d9c1d66ac93
link: <https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; expires=Mon, 21 Jul 2025 21:12:18 GMT; path=/; secure; SameSite=None
oaidts=1721596338; expires=Mon, 21 Jul 2025 21:12:18 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
2 B URL bedrapiona.com/sftouch?userId=0080a0e8d6484f39e1d23c6187c70168&z=5615727&p_rid=27cd04d7-f667-4382-807d-5dddfe0d53bd&p_src=sf&branchId=0&rb=PA-wk_KDI6PIWMV1l7Bi-6oi6Qs_PEGfR_vEyp5X3svcxM-3dpJU6MxHVkjQnnqLH8xcdFyyy5j19ODhq231THsx8mk2SukG6_kMdOtcs3cnH7zznVUNY3zt5MTn2XzFRvkWjuX52A8tPPsSykeE7WYQFAyx1J6p4VRBSLg65ue2LrYtgC0zXtNpbaChK-RUBCH9SS7elVJ2gbr5vHwgDFubkxoFlq-Qphbpt09iAvngxruHtsyMFcnBM2fnjISAePEpue0UalDAnoRwT-sUrPJJItFr4N5C
IP
Certificate IssuerLet's Encrypt
Subjectbedrapiona.com
Fingerprint4F:13:86:8F:6A:7E:D6:58:A2:A9:95:9E:3E:FA:01:4B:0D:E6:7B:B0
ValidityWed, 29 May 2024 19:06:32 GMT - Tue, 27 Aug 2024 19:06:31 GMT
File type ASCII text, with no line terminators
Hash 444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
POST /sftouch?userId=0080a0e8d6484f39e1d23c6187c70168&z=5615727&p_rid=27cd04d7-f667-4382-807d-5dddfe0d53bd&p_src=sf&branchId=0&rb=PA-wk_KDI6PIWMV1l7Bi-6oi6Qs_PEGfR_vEyp5X3svcxM-3dpJU6MxHVkjQnnqLH8xcdFyyy5j19ODhq231THsx8mk2SukG6_kMdOtcs3cnH7zznVUNY3zt5MTn2XzFRvkWjuX52A8tPPsSykeE7WYQFAyx1J6p4VRBSLg65ue2LrYtgC0zXtNpbaChK-RUBCH9SS7elVJ2gbr5vHwgDFubkxoFlq-Qphbpt09iAvngxruHtsyMFcnBM2fnjISAePEpue0UalDAnoRwT-sUrPJJItFr4N5C HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://bedrapiona.com
DNT: 1
Connection: keep-alive
Referer: https://bedrapiona.com/4/5615727/
Cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; oaidts=1721596338
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/plain
content-length: 2
x-trace-id: ef53270068e3c4ba729dd8fbf8f1ccef
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://bedrapiona.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
504 B IP
ASN #20940 Akamai International B.V.
Hash 46d25940ecd69e436b55dcf1c8ae9d7a
c56a78f609d6521568b9b2f3f750456c79641526
aef09d2d98b01066722cb22b2bb6a3308780e76a2e751eae8eea055e41674bd0
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "AEF09D2D98B01066722CB22B2BB6A3308780E76A2E751EAE8EEA055E41674BD0"
Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18588
Expires: Mon, 22 Jul 2024 02:22:06 GMT
Date: Sun, 21 Jul 2024 21:12:18 GMT
Connection: keep-alive
43 B URL my.rtmark.net/img.gif?f=merge&userId=0080a0e8d6484f39e1d23c6187c70168&z=5615727&p_rid=27cd04d7-f667-4382-807d-5dddfe0d53bd&p_src=sf
IP
File type GIF image data, version 89a, 1 x 1
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
GET /img.gif?f=merge&userId=0080a0e8d6484f39e1d23c6187c70168&z=5615727&p_rid=27cd04d7-f667-4382-807d-5dddfe0d53bd&p_src=sf HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bedrapiona.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=0080a0e8d6484f39e1d23c6187c70168; expires=Mon, 21 Jul 2025 21:12:18 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
GET xmlclick.hueadsxml.com/nrtb/click?bid=qmm4BUi8iYUmTm4O8xP2f7aqUxUD1pPP4e1l1PvDlytMXxwmo6hzXCvhphUhHdmY_0_11
302 Found 98 B URL GET HTTP/2 xmlclick.hueadsxml.com/nrtb/click?bid=qmm4BUi8iYUmTm4O8xP2f7aqUxUD1pPP4e1l1PvDlytMXxwmo6hzXCvhphUhHdmY_0_11
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerUnizeto Technologies S.A.
Subject*.hueadsxml.com
Fingerprint3A:00:55:9E:A9:A6:E2:25:DA:69:5B:6B:E4:49:B0:FF:B1:E7:6A:BC
ValidityWed, 03 Apr 2024 12:56:41 GMT - Thu, 03 Apr 2025 12:56:40 GMT
File type HTML document, ASCII text
Hash c2868f993f27d09247ceaa65f071007b
60ec80738b20d69304cb70827a208d43fd8c2d16
41933808e651e2fd2ef10da1179292a03f55e349d895eeaf05b1d17f927cb7e1
GET /nrtb/click?bid=qmm4BUi8iYUmTm4O8xP2f7aqUxUD1pPP4e1l1PvDlytMXxwmo6hzXCvhphUhHdmY_0_11 HTTP/1.1
Host: xmlclick.hueadsxml.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx/1.18.0 (Ubuntu)
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/html; charset=utf-8
content-length: 98
location: https://richtomatos.com/in/p/?spot_id=825066&cat=1&sub_id=199943254
X-Firefox-Spdy: h2
POST adsco.re/p
200 OK 876 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type ASCII text, with very long lines (1106), with no line terminators
Hash 90dad91158d5c9398e5a126f43f35544
d7d29547794fffcb1ba01be3afeb10a49f8bd89d
a25491720f31e82cf9c65ce4c825e0969d6651d5675d820fe6e2d61bd40e1e10
POST /p HTTP/1.1
Host: adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 1561
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 21 Jul 2024 21:12:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
AS-P-1: OK lon123
AS-P-2: OK
AS-P-3: OK
Access-Control-Max-Age: 2592000
Cache-Control: no-transform
Accept-CH: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Device-Memory, Downlink, ECT, RTT, Width, Viewport-Width, DPR
Access-Control-Allow-Origin: https://luluvdo.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
12 B URL bedrapiona.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=27cd04d7-f667-4382-807d-5dddfe0d53bd
IP
Certificate IssuerLet's Encrypt
Subjectbedrapiona.com
Fingerprint4F:13:86:8F:6A:7E:D6:58:A2:A9:95:9E:3E:FA:01:4B:0D:E6:7B:B0
ValidityWed, 29 May 2024 19:06:32 GMT - Tue, 27 Aug 2024 19:06:31 GMT
Hash adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=27cd04d7-f667-4382-807d-5dddfe0d53bd HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1410
Origin: https://bedrapiona.com
DNT: 1
Connection: keep-alive
Referer: https://bedrapiona.com/4/5615727/
Cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; oaidts=1721596338
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: application/json; charset=utf-8
content-length: 12
access-control-allow-origin: https://bedrapiona.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
345 B IP
ASN #20940 Akamai International B.V.
Hash 714e07598ee2102274b1811d8e19d36b
107109714e56cf195b8d1754f145c3dea4d3eec9
fd1ed3a36f40444f1920fb63a5d8888a0f29d34338f3062d12774abb036fd056
POST / HTTP/1.1
Host: e6.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "FD1ED3A36F40444F1920FB63A5D8888A0F29D34338F3062D12774ABB036FD056"
Last-Modified: Fri, 19 Jul 2024 10:13:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3788
Expires: Sun, 21 Jul 2024 22:15:26 GMT
Date: Sun, 21 Jul 2024 21:12:18 GMT
Connection: keep-alive
16 B URL bedrapiona.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=27cd04d7-f667-4382-807d-5dddfe0d53bd
IP
Certificate IssuerLet's Encrypt
Subjectbedrapiona.com
Fingerprint4F:13:86:8F:6A:7E:D6:58:A2:A9:95:9E:3E:FA:01:4B:0D:E6:7B:B0
ValidityWed, 29 May 2024 19:06:32 GMT - Tue, 27 Aug 2024 19:06:31 GMT
File type ASCII text, with no line terminators
Hash 7feadfe891c04432562e6d2b4d35f38a
fc25b473cdcdf8551d51bed416dd604f3e1d158f
e836cf151c055c64b3b2991de7067f3d9e925b51d1050e57ff93a7b88667031f
POST /async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=27cd04d7-f667-4382-807d-5dddfe0d53bd HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 438
Origin: https://bedrapiona.com
DNT: 1
Connection: keep-alive
Referer: https://bedrapiona.com/4/5615727/
Cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; oaidts=1721596338
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Sun, 21 Jul 2024 21:12:18 GMT
content-type: text/plain; charset=utf-8
content-length: 16
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://bedrapiona.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
POST bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false
302 Found 0 B URL POST HTTP/2 bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectbedrapiona.com
Fingerprint4F:13:86:8F:6A:7E:D6:58:A2:A9:95:9E:3E:FA:01:4B:0D:E6:7B:B0
ValidityWed, 29 May 2024 19:06:32 GMT - Tue, 27 Aug 2024 19:06:31 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /?z=5615727&syncedCookie=true&rhd=false HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 608
Origin: https://bedrapiona.com
DNT: 1
Connection: keep-alive
Referer: https://bedrapiona.com/afu.php?zoneid=5615727&var=5615727&rid=e8DJqkaKU-A8kEnzk7U3FA%3D%3D&rhd=false&ab2r=0&sf=1
Cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; oaidts=1721596338
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx
date: Sun, 21 Jul 2024 21:12:18 GMT
content-length: 0
location: https://coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
x-trace-id: 89411ad902e968c0a0cd9879f6f4a934
link: <https://coinpriceline.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
referrer-policy: no-referrer
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://bedrapiona.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; expires=Mon, 21 Jul 2025 21:12:18 GMT; path=/; secure; SameSite=None
oaidts=1721596338; expires=Mon, 21 Jul 2025 21:12:18 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Sun, 28 Jul 2024 21:12:18 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
GET xadsmart.com/armxkqjoayqbp?YLulmebn=BQMyAAAAAAAACZUAArCwB1KS5IUCfHbBtoAPLIjdnlLVRlYxvj5mjTfP9wyHB0yBC7TcPy90InJtTCdGHkXqCqBNPuB-tScHVIUYdCu89JXNWICMQkxc3vptPhZBDWWTd0K2F7TQ4qRmrdPxrBB9cXfWMkK1Pu7fb4i7RRPUrlup3fURPDaFf25vPwzczMurUKdb-hw1NFfXw_1tjX0-JlYsJupflYKP8ParywiKdG3nAR4Ckuos0FH_j04yNbEESJjyZkCFNfxiaIBvceaL6hHidHf7JCQaV0u2roRTb77wyaayUiHMSsDU7kOE49BE_MbXSxvj8netIPjo-zRLicbJPGqnO5qb5qNeQNoPmXnsimJi07g4uZcXT4C-lMphacdZ90HN09_SxuqcrbdVJstAuuP8H7l-igGrm_edj6mVBeVyzndPJYNU7qdgj_QAS8guWDMzESPjbMYouNU8LY1bUQMDlMrw5ppNGq8lv1nCaV5qWC3l8Nrwdx3319y4IZrCzIlw4o5hzN1b4AVlPRRIwGxAGz-OuswWcd87zUC7n_ffniBtoNxHJXlsXXYZTm0mWsT-GY0DNNEIvX-xW_Vy1nGSYrMGrAncjPQa3bPnMbY7UugihWK0FLnBMkZYdl0GB5Ozlw7smIZ2ses15QkfTnvgHwpM5E-c3C1KAS87wUlA3z8YaAWtAomh3V8GW8Z_z_xmnuCDqwZcAb2slFjFdW-fS9g8P9hqQuOIPYJNQIyUd4g-RsQGu8r9fpa9T0D0hRcbyBnY8p3tQQ-4f72ToLXKhiyBRFNGZjLvB-zDa0xFzemBy09V7pkz1AlQaLR5it4cXWWcHy23-wDPvSaYKUvkiZtm-_m40YLdS3dpgbaQEpCMiDkGHVgnb10kBHxsgTDlWd-eWjzVPVgvnz0CLG0PwYyrjInjicvC2eI2GA5MGQvC16uiW6qIAfKVvtSGrfELU8RImioYUFduHrX4fz0dEd1kGlpT9DV-Gf0JxcAkZvUUnZDDDe66Wh1Wh4P0d2SFN0tzcRgPqn2YFMg6MS-ynPLthmlmm0HVVsEVIwcWPqgaFB1UqMFjlJmHuhER_zVdlXy0eov2jA&IuRxLygE=4&TmAOyHSz=4998988&VfCmzSAT=&GsqQebmR=0:1,0&zoFrNmfJ=<ATOgvy=&s=1280,1024,1,1280,1024,0
200 OK 44 B URL GET HTTP/2 xadsmart.com/armxkqjoayqbp?YLulmebn=BQMyAAAAAAAACZUAArCwB1KS5IUCfHbBtoAPLIjdnlLVRlYxvj5mjTfP9wyHB0yBC7TcPy90InJtTCdGHkXqCqBNPuB-tScHVIUYdCu89JXNWICMQkxc3vptPhZBDWWTd0K2F7TQ4qRmrdPxrBB9cXfWMkK1Pu7fb4i7RRPUrlup3fURPDaFf25vPwzczMurUKdb-hw1NFfXw_1tjX0-JlYsJupflYKP8ParywiKdG3nAR4Ckuos0FH_j04yNbEESJjyZkCFNfxiaIBvceaL6hHidHf7JCQaV0u2roRTb77wyaayUiHMSsDU7kOE49BE_MbXSxvj8netIPjo-zRLicbJPGqnO5qb5qNeQNoPmXnsimJi07g4uZcXT4C-lMphacdZ90HN09_SxuqcrbdVJstAuuP8H7l-igGrm_edj6mVBeVyzndPJYNU7qdgj_QAS8guWDMzESPjbMYouNU8LY1bUQMDlMrw5ppNGq8lv1nCaV5qWC3l8Nrwdx3319y4IZrCzIlw4o5hzN1b4AVlPRRIwGxAGz-OuswWcd87zUC7n_ffniBtoNxHJXlsXXYZTm0mWsT-GY0DNNEIvX-xW_Vy1nGSYrMGrAncjPQa3bPnMbY7UugihWK0FLnBMkZYdl0GB5Ozlw7smIZ2ses15QkfTnvgHwpM5E-c3C1KAS87wUlA3z8YaAWtAomh3V8GW8Z_z_xmnuCDqwZcAb2slFjFdW-fS9g8P9hqQuOIPYJNQIyUd4g-RsQGu8r9fpa9T0D0hRcbyBnY8p3tQQ-4f72ToLXKhiyBRFNGZjLvB-zDa0xFzemBy09V7pkz1AlQaLR5it4cXWWcHy23-wDPvSaYKUvkiZtm-_m40YLdS3dpgbaQEpCMiDkGHVgnb10kBHxsgTDlWd-eWjzVPVgvnz0CLG0PwYyrjInjicvC2eI2GA5MGQvC16uiW6qIAfKVvtSGrfELU8RImioYUFduHrX4fz0dEd1kGlpT9DV-Gf0JxcAkZvUUnZDDDe66Wh1Wh4P0d2SFN0tzcRgPqn2YFMg6MS-ynPLthmlmm0HVVsEVIwcWPqgaFB1UqMFjlJmHuhER_zVdlXy0eov2jA&IuRxLygE=4&TmAOyHSz=4998988&VfCmzSAT=&GsqQebmR=0:1,0&zoFrNmfJ=<ATOgvy=&s=1280,1024,1,1280,1024,0
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subjectxadsmart.com
FingerprintFC:E8:BA:57:31:46:6D:51:70:B5:42:35:6E:CF:97:6F:AF:38:C5:58
ValidityMon, 14 Aug 2023 00:00:00 GMT - Fri, 13 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash d5f0a25e4d3522d56d48ce7bc3e518fb
86794caff58f7fee6e684c2ba7195f970a8d6f4c
9d781128a8ece413b003d5612b8398bf9340ef7f5b751d12bd125ba523d3ceb5
GET /armxkqjoayqbp?YLulmebn=BQMyAAAAAAAACZUAArCwB1KS5IUCfHbBtoAPLIjdnlLVRlYxvj5mjTfP9wyHB0yBC7TcPy90InJtTCdGHkXqCqBNPuB-tScHVIUYdCu89JXNWICMQkxc3vptPhZBDWWTd0K2F7TQ4qRmrdPxrBB9cXfWMkK1Pu7fb4i7RRPUrlup3fURPDaFf25vPwzczMurUKdb-hw1NFfXw_1tjX0-JlYsJupflYKP8ParywiKdG3nAR4Ckuos0FH_j04yNbEESJjyZkCFNfxiaIBvceaL6hHidHf7JCQaV0u2roRTb77wyaayUiHMSsDU7kOE49BE_MbXSxvj8netIPjo-zRLicbJPGqnO5qb5qNeQNoPmXnsimJi07g4uZcXT4C-lMphacdZ90HN09_SxuqcrbdVJstAuuP8H7l-igGrm_edj6mVBeVyzndPJYNU7qdgj_QAS8guWDMzESPjbMYouNU8LY1bUQMDlMrw5ppNGq8lv1nCaV5qWC3l8Nrwdx3319y4IZrCzIlw4o5hzN1b4AVlPRRIwGxAGz-OuswWcd87zUC7n_ffniBtoNxHJXlsXXYZTm0mWsT-GY0DNNEIvX-xW_Vy1nGSYrMGrAncjPQa3bPnMbY7UugihWK0FLnBMkZYdl0GB5Ozlw7smIZ2ses15QkfTnvgHwpM5E-c3C1KAS87wUlA3z8YaAWtAomh3V8GW8Z_z_xmnuCDqwZcAb2slFjFdW-fS9g8P9hqQuOIPYJNQIyUd4g-RsQGu8r9fpa9T0D0hRcbyBnY8p3tQQ-4f72ToLXKhiyBRFNGZjLvB-zDa0xFzemBy09V7pkz1AlQaLR5it4cXWWcHy23-wDPvSaYKUvkiZtm-_m40YLdS3dpgbaQEpCMiDkGHVgnb10kBHxsgTDlWd-eWjzVPVgvnz0CLG0PwYyrjInjicvC2eI2GA5MGQvC16uiW6qIAfKVvtSGrfELU8RImioYUFduHrX4fz0dEd1kGlpT9DV-Gf0JxcAkZvUUnZDDDe66Wh1Wh4P0d2SFN0tzcRgPqn2YFMg6MS-ynPLthmlmm0HVVsEVIwcWPqgaFB1UqMFjlJmHuhER_zVdlXy0eov2jA&IuRxLygE=4&TmAOyHSz=4998988&VfCmzSAT=&GsqQebmR=0:1,0&zoFrNmfJ=<ATOgvy=&s=1280,1024,1,1280,1024,0 HTTP/1.1
Host: xadsmart.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
popads-node: wb9
access-control-allow-origin: *
asf: 9
popads-ec: ASB
content-type: text/javascript;charset=UTF-8
content-length: 44
date: Sun, 21 Jul 2024 21:12:19 GMT
X-Firefox-Spdy: h2
POST z23qigruneny.s4.adsco.re/
200 OK 0 B URL POST HTTP/2 z23qigruneny.s4.adsco.re/
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subject*.s4.adsco.re
FingerprintC6:23:9D:C5:DA:0C:7F:2F:1A:17:3A:87:20:2B:BB:62:FA:77:AF:89
ValidityFri, 19 Jul 2024 09:12:43 GMT - Thu, 17 Oct 2024 09:12:42 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1
Host: z23qigruneny.s4.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: text/html
content-length: 0
last-modified: Tue, 03 Oct 2023 13:29:59 GMT
etag: "651c1757-0"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
X-Firefox-Spdy: h2
504 B IP
ASN #20940 Akamai International B.V.
Hash a23952baf2f9ab4586afd85ec180e0b9
a04fb1b5aba2c53ea0cc6a503a3733dd40841a4d
a311001f4aae64383914ea47aa2b818553842d8f2d992de14af3e0223a5b2701
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A311001F4AAE64383914EA47AA2B818553842D8F2D992DE14AF3E0223A5B2701"
Last-Modified: Sat, 20 Jul 2024 19:20:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4060
Expires: Sun, 21 Jul 2024 22:19:59 GMT
Date: Sun, 21 Jul 2024 21:12:19 GMT
Connection: keep-alive
6.9 kB URL coinpriceline.com/wp-content/uploads/2022/05/coinpricelogotext33689.png
IP
File type PNG image data, 336 x 89, 8-bit/color RGBA, non-interlaced
Hash a9c0affebf0fe0d19574925481bfa11d
eececae9d5afe101904f47c10fe46742a8c0ac8d
86f1682cb7e4e9dbf1b915e6e37d7385f835057e9149a90fa9bf3bbdd08ad67b
GET /wp-content/uploads/2022/05/coinpricelogotext33689.png HTTP/1.1
Host: coinpriceline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: image/png
content-length: 6946
last-modified: Wed, 08 May 2024 15:16:49 GMT
etag: "663b9761-1b22"
cache-control: public, max-age=31536000
cf-cache-status: HIT
age: 1426939
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tsZ5Hqo%2BtEZv6HBOhYMEGaQ8mGWLQAoBHPqx6R%2BbETMNG3l54yylBDr9CAELDuLaRksRJkkhm2qjnWRhAvxts8C2584V03V5HDrKHOOKtJfnpWduGsefLwU9EL83faUkZNUCYA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e30406ab40b3d-OSL
alt-svc: h3=":443"; ma=86400
3.2 kB URL coinpriceline.com/wp-content/uploads/2022/05/coinpricelogotext16844.png
IP
File type PNG image data, 168 x 44, 8-bit/color RGBA, non-interlaced
Hash 6e30711cab4f35a12183a17702679c50
a59ddb55509216fcc100752c6eca9c82ae37d73b
aca42b1a0d7220f6285ebdc6f5d59011d3d89555bdb6489b3d92fd982adc7c45
GET /wp-content/uploads/2022/05/coinpricelogotext16844.png HTTP/1.1
Host: coinpriceline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: image/png
content-length: 3188
last-modified: Wed, 08 May 2024 15:16:49 GMT
etag: "663b9761-c74"
cache-control: public, max-age=31536000
cf-cache-status: HIT
age: 1426741
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7UilEP43QHz%2BiT7MbHKCD39nuMDZYxyzEA9gomOnFFwSgJ6EFwkEdjsq7wE3RU%2FzW8QNC9oO974%2BbuGbkDpNuMe1xacSOOy8PCZhOa9xcI6xS51SqpdPUw7tpXwg2oOwqLBnIw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e30406ab60b3d-OSL
alt-svc: h3=":443"; ma=86400
31 kB URL coinpriceline.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
IP
File type gzip compressed data, from Unix
Hash 3059c0c26a392211cddf161078b237fa
937cc1a5c3576bec4ef63970234a7416f3c4ce62
89aaa3e27190135861cb3fbe14de3ae72d68e071c9f8d20f107d5b26fe1ffe77
GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1
Host: coinpriceline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: application/javascript
last-modified: Wed, 08 May 2024 15:17:31 GMT
vary: Accept-Encoding
etag: W/"663b978b-15601"
cache-control: public, max-age=31536000
content-encoding: gzip
cf-cache-status: HIT
age: 1426939
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B6%2B9AvZkAfRn3cMuL2i2QHz296mkihYL%2FURZDCz%2FsYrz8gmwPUqcaCvp6LgVg20ENnK5lXj7Dl1FBDPdco3Vp4%2Bvs6dbiFhmWWSIWlxey3napT2J%2F8zYx%2F2lp4XS5SaW6QsXdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e30405aa40b3d-OSL
alt-svc: h3=":443"; ma=86400
28 kB URL coinpriceline.com/wp-content/themes/smart-mag/js/theme.js?ver=10.0.0
IP
File type gzip compressed data, from Unix
Hash cf17d8960382258287ed72d66db6bfeb
48877a442b40fdd7edb7334520f0ea0887fd7ac0
aeb20c01896f436eb8dbe4edfa21d143ddce53154cccb30fd9d0f64407637433
GET /wp-content/themes/smart-mag/js/theme.js?ver=10.0.0 HTTP/1.1
Host: coinpriceline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: application/javascript
last-modified: Wed, 08 May 2024 15:17:30 GMT
vary: Accept-Encoding
etag: W/"663b978a-d2b7"
cache-control: public, max-age=31536000
content-encoding: gzip
cf-cache-status: HIT
age: 3319952
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8eJI%2FD2uGZyBdXn5hoer%2BVCWlxQ3qvlPa8inP%2FvzY7pQOxNji5Y1Nz45SwZjZHXySKeiNpG%2BDOnlLTQlwawXMBY7eGq4NUvFguMYdFHYi2%2FYomsgaGkLCHICV1JPBCePDcz40w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e30406abc0b3d-OSL
alt-svc: h3=":443"; ma=86400
23 kB URL coinpriceline.com/wp-content/themes/smart-mag/js/jquery.mfp-lightbox.js?ver=10.0.0
IP
File type gzip compressed data, from Unix
Hash 5a609a7664cf312f7af9477106f32486
fe6e9689a816013e99854062da837f253024c554
61adb3fad5c74a8a9c162851e13f8a7fa16b710778b36f69b9d67fe30b1d6583
GET /wp-content/themes/smart-mag/js/jquery.mfp-lightbox.js?ver=10.0.0 HTTP/1.1
Host: coinpriceline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: application/javascript
last-modified: Wed, 08 May 2024 15:17:30 GMT
vary: Accept-Encoding
etag: W/"663b978a-4ef8"
cache-control: public, max-age=31536000
content-encoding: gzip
cf-cache-status: HIT
age: 1426939
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yNqg0370fPKBdTE6W48M6m1%2BYFfjl3sxuCwNP5WowEO0iE%2FzVRN7mFA1bPVy7x9ZL7vmfqdr4a6evdPE%2B1ueCZqXujJdgNL5T%2FQUlfIj9XsF5y7iehjwgp%2BdqanRX4bp9UDAWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e30406ab90b3d-OSL
alt-svc: h3=":443"; ma=86400
GET cmpuwps.com/get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxMDk2LCJ0eXBlIjoicG9wIiwic3BhY2VpZCI6MTA5Niwic3ViaWQiOiIxOTk5NDMyNTQiLCJsYWJlbHMiOiI1NSw2MSw1NCw0Nyw0Niw5LDgsNyw2LDUsNCIsInNzcCI6Mzc1OCwic3BvdF9pZCI6ODI1MDY2LCJyY2hhbmdlIjpmYWxzZX19XSwic2l0ZSI6eyJpZCI6IjgyNTA2NiIsInBhZ2UiOiJodHRwczovL3BvcC5hZG1waXJlLmNvbS8iLCJjYXQiOlsiSUFCMSJdfSwiZGV2aWNlIjp7InciOjEyODAsImgiOjEwMjR9LCJ1c2VyIjp7ImlkIjoibDFxZXk3Z3I3Zmo1aDV6dXBzZGQ2MiJ9LCJleHQiOnsiZHQiOjE3MjE1OTYzMzkwNDJ9fQ==
302 Found 0 B URL GET HTTP/2 cmpuwps.com/get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxMDk2LCJ0eXBlIjoicG9wIiwic3BhY2VpZCI6MTA5Niwic3ViaWQiOiIxOTk5NDMyNTQiLCJsYWJlbHMiOiI1NSw2MSw1NCw0Nyw0Niw5LDgsNyw2LDUsNCIsInNzcCI6Mzc1OCwic3BvdF9pZCI6ODI1MDY2LCJyY2hhbmdlIjpmYWxzZX19XSwic2l0ZSI6eyJpZCI6IjgyNTA2NiIsInBhZ2UiOiJodHRwczovL3BvcC5hZG1waXJlLmNvbS8iLCJjYXQiOlsiSUFCMSJdfSwiZGV2aWNlIjp7InciOjEyODAsImgiOjEwMjR9LCJ1c2VyIjp7ImlkIjoibDFxZXk3Z3I3Zmo1aDV6dXBzZGQ2MiJ9LCJleHQiOnsiZHQiOjE3MjE1OTYzMzkwNDJ9fQ==
IP
ASN #24940 Hetzner Online GmbH
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectpuwpush.com
Fingerprint7C:BA:82:62:FA:3B:B1:C4:E6:C9:56:D4:A6:B4:F3:90:38:DF:20:28
ValidityTue, 02 Jul 2024 09:31:09 GMT - Mon, 30 Sep 2024 09:31:08 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxMDk2LCJ0eXBlIjoicG9wIiwic3BhY2VpZCI6MTA5Niwic3ViaWQiOiIxOTk5NDMyNTQiLCJsYWJlbHMiOiI1NSw2MSw1NCw0Nyw0Niw5LDgsNyw2LDUsNCIsInNzcCI6Mzc1OCwic3BvdF9pZCI6ODI1MDY2LCJyY2hhbmdlIjpmYWxzZX19XSwic2l0ZSI6eyJpZCI6IjgyNTA2NiIsInBhZ2UiOiJodHRwczovL3BvcC5hZG1waXJlLmNvbS8iLCJjYXQiOlsiSUFCMSJdfSwiZGV2aWNlIjp7InciOjEyODAsImgiOjEwMjR9LCJ1c2VyIjp7ImlkIjoibDFxZXk3Z3I3Zmo1aDV6dXBzZGQ2MiJ9LCJleHQiOnsiZHQiOjE3MjE1OTYzMzkwNDJ9fQ== HTTP/1.1
Host: cmpuwps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://richtomatos.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx/1.16.0
date: Sun, 21 Jul 2024 21:12:19 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
location: https://cmpuwps.com/popunder/in/click/?mid=151324366298569897&pid=0&site=825066&sc=NO&usage_type=DCH&subid=199943254&sid=0&cid=0&price=0&is_cpm=0&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=pop.admpire.com&hostname=auc-popunder-hz-3&site_id=0&spot_id=825066&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB1&min_cpm=0.099&placement_type_id=7&skin_test=&verify_hash=86abb998ffeea987b105d8efa10bf063&score=1.0113303727782672&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=1096&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB1&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.099&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D199943254%26site_id%3D825066%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D0%26spot_id%3D825066%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252Fpop.admpire.com%252F%26sid%3D1096%26katds_labels%3D55%2C61%2C54%2C47%2C46%2C9%2C8%2C7%2C6%2C5%2C4%26is_iframe%3D1%26btype%3D0%26score%3D1.0113303727782672%26bf%3D0.099%26iabcat%3DIAB1%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=1&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model=
X-Firefox-Spdy: h2
78 kB URL www.googletagmanager.com/gtm.js?id=GTM-PTL8Q7L
IP
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
FingerprintB3:23:88:EF:34:69:5A:0C:81:CE:02:E2:E3:19:FE:95:71:75:A1:14
ValidityMon, 24 Jun 2024 06:35:05 GMT - Mon, 16 Sep 2024 06:35:04 GMT
File type JavaScript source, ASCII text, with very long lines (3999)
Hash aad043accd00a070786ad08272de677d
b51704f22f6c12896d0b2f11312b5eed8b21fc11
3da9f9f3578976eb25d05851f8384a688a702d15a82e07d77db79bc37e245f38
GET /gtm.js?id=GTM-PTL8Q7L HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 21 Jul 2024 21:12:19 GMT
expires: Sun, 21 Jul 2024 21:12:19 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 78117
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET cmpuwps.com/popunder/in/click/?mid=151324366298569897&pid=0&site=825066&sc=NO&usage_type=DCH&subid=199943254&sid=0&cid=0&price=0&is_cpm=0&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=pop.admpire.com&hostname=auc-popunder-hz-3&site_id=0&spot_id=825066&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB1&min_cpm=0.099&placement_type_id=7&skin_test=&verify_hash=86abb998ffeea987b105d8efa10bf063&score=1.0113303727782672&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=1096&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB1&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.099&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D199943254%26site_id%3D825066%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D0%26spot_id%3D825066%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252Fpop.admpire.com%252F%26sid%3D1096%26katds_labels%3D55%2C61%2C54%2C47%2C46%2C9%2C8%2C7%2C6%2C5%2C4%26is_iframe%3D1%26btype%3D0%26score%3D1.0113303727782672%26bf%3D0.099%26iabcat%3DIAB1%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=1&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model=
302 Found 0 B URL GET HTTP/2 cmpuwps.com/popunder/in/click/?mid=151324366298569897&pid=0&site=825066&sc=NO&usage_type=DCH&subid=199943254&sid=0&cid=0&price=0&is_cpm=0&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=pop.admpire.com&hostname=auc-popunder-hz-3&site_id=0&spot_id=825066&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB1&min_cpm=0.099&placement_type_id=7&skin_test=&verify_hash=86abb998ffeea987b105d8efa10bf063&score=1.0113303727782672&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=1096&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB1&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.099&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D199943254%26site_id%3D825066%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D0%26spot_id%3D825066%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252Fpop.admpire.com%252F%26sid%3D1096%26katds_labels%3D55%2C61%2C54%2C47%2C46%2C9%2C8%2C7%2C6%2C5%2C4%26is_iframe%3D1%26btype%3D0%26score%3D1.0113303727782672%26bf%3D0.099%26iabcat%3DIAB1%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=1&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model=
IP
ASN #24940 Hetzner Online GmbH
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectpuwpush.com
Fingerprint7C:BA:82:62:FA:3B:B1:C4:E6:C9:56:D4:A6:B4:F3:90:38:DF:20:28
ValidityTue, 02 Jul 2024 09:31:09 GMT - Mon, 30 Sep 2024 09:31:08 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /popunder/in/click/?mid=151324366298569897&pid=0&site=825066&sc=NO&usage_type=DCH&subid=199943254&sid=0&cid=0&price=0&is_cpm=0&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=pop.admpire.com&hostname=auc-popunder-hz-3&site_id=0&spot_id=825066&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB1&min_cpm=0.099&placement_type_id=7&skin_test=&verify_hash=86abb998ffeea987b105d8efa10bf063&score=1.0113303727782672&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=1096&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB1&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.099&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D199943254%26site_id%3D825066%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D0%26spot_id%3D825066%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252Fpop.admpire.com%252F%26sid%3D1096%26katds_labels%3D55%2C61%2C54%2C47%2C46%2C9%2C8%2C7%2C6%2C5%2C4%26is_iframe%3D1%26btype%3D0%26score%3D1.0113303727782672%26bf%3D0.099%26iabcat%3DIAB1%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=1&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model= HTTP/1.1
Host: cmpuwps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://richtomatos.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx/1.16.0
date: Sun, 21 Jul 2024 21:12:19 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
location: https://popdemission.com/in/849/?source=199943254&site_id=825066&utm1=&utm2=&utm3=&utm4=&idzone=0&spot_id=825066&mo=&ve=&ad_tags=&p=https%3A%2F%2Fpop.admpire.com%2F&sid=1096&katds_labels=55,61,54,47,46,9,8,7,6,5,4&is_iframe=1&btype=0&score=1.0113303727782672&bf=0.099&iabcat=IAB1&allowed_labels=
X-Firefox-Spdy: h2
344 B IP
ASN #20940 Akamai International B.V.
Hash e3d090e1b74f245f060d9872bdc3335a
3c5c9e3dab1ce48eb030dd44ae7acac06c9b8c05
539657af6d76d3e90790e52224304ea509f591f6c4526364975fee2c2b4e26a6
POST / HTTP/1.1
Host: e6.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "539657AF6D76D3E90790E52224304EA509F591F6C4526364975FEE2C2B4E26A6"
Last-Modified: Sat, 20 Jul 2024 19:22:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3838
Expires: Sun, 21 Jul 2024 22:16:17 GMT
Date: Sun, 21 Jul 2024 21:12:19 GMT
Connection: keep-alive
GET popdemission.com/in/849/?source=199943254&site_id=825066&utm1=&utm2=&utm3=&utm4=&idzone=0&spot_id=825066&mo=&ve=&ad_tags=&p=https%3A%2F%2Fpop.admpire.com%2F&sid=1096&katds_labels=55,61,54,47,46,9,8,7,6,5,4&is_iframe=1&btype=0&score=1.0113303727782672&bf=0.099&iabcat=IAB1&allowed_labels=
302 Found 0 B URL GET HTTP/2 popdemission.com/in/849/?source=199943254&site_id=825066&utm1=&utm2=&utm3=&utm4=&idzone=0&spot_id=825066&mo=&ve=&ad_tags=&p=https%3A%2F%2Fpop.admpire.com%2F&sid=1096&katds_labels=55,61,54,47,46,9,8,7,6,5,4&is_iframe=1&btype=0&score=1.0113303727782672&bf=0.099&iabcat=IAB1&allowed_labels=
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectpopdemission.com
Fingerprint59:74:C0:88:E0:54:0A:F4:FB:B7:70:F0:A5:B3:D3:B2:36:1F:79:69
ValiditySat, 08 Jun 2024 20:19:40 GMT - Fri, 06 Sep 2024 20:19:39 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/849/?source=199943254&site_id=825066&utm1=&utm2=&utm3=&utm4=&idzone=0&spot_id=825066&mo=&ve=&ad_tags=&p=https%3A%2F%2Fpop.admpire.com%2F&sid=1096&katds_labels=55,61,54,47,46,9,8,7,6,5,4&is_iframe=1&btype=0&score=1.0113303727782672&bf=0.099&iabcat=IAB1&allowed_labels= HTTP/1.1
Host: popdemission.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://richtomatos.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx/1.20.1
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://google.com/
pragma: no-cache
vary: *
cache-control: no-cache, no-store, must-revalidate
set-cookie: 849.0=1; expires=Mon, 22 Jul 2024 21:12:18 GMT; path=/; secure; SameSite=None
X-Firefox-Spdy: h2
222 kB URL thubanoa.com/27/7552beb94fc0bdff7bbb33cad3d1ab0a
IP
File type gzip compressed data, max speed, from Unix
Size 222 kB (221507 bytes)
Hash 657e67122949277998a8661ef86909e9
c8774a58d438be6df36b21740918a6d1234308b6
0866b65ea3dfb60e873ddcbfeda156eeed1670404c8594773270ebb0b2e2a68c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /27/7552beb94fc0bdff7bbb33cad3d1ab0a HTTP/1.1
Host: thubanoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Cookie: scm=1; OAID=0400a0f0fa054e26f94cc7492ae8d435; oaidts=1721596339
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: application/javascript
access-control-allow-credentials: true
access-control-allow-origin:
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION, X-Ancestor-Origins, X-Zone-ID, baggage, sentry-trace
x-trace-id: a934ec088bce565b26fbd4fa510f8221
cache-control: max-age:290304000, public
last-modified: Thu, 16 May 2024 06:01:25 GMT
expires: Thu, 15 Jun 2084 06:01:25 GMT
access-control-expose-headers: X-Sc
strict-transport-security: max-age=1
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
472 B IP
Hash 77c9c08ce375f17e98c9171053f6924a
9e4dbfec6c0ede12b95d0b73c9fd4648f6186a11
32c9cb624161be64e47a6a353e2c0a326a56f407e21bda3e8f80c1e7d6aff44d
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
21 kB URL lib.wtg-ads.com/publisher/coinpriceline.com/dc234d802520aab423ad.js
IP
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Hash 23818419031d78770cae7223688dfd22
845b1f2ce60155977adff27412b3078eef833ab5
00ea9bd7ab9d680071d04fa56826bb2f7358fbff8bcf89a3e0c8eb8aa574e765
GET /publisher/coinpriceline.com/dc234d802520aab423ad.js HTTP/1.1
Host: lib.wtg-ads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 12 Jun 2023 10:16:24 GMT
etag: W/"6486f078-10815"
expires: Thu, 11 Jul 2024 14:15:49 GMT
cache-control: max-age=10800
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-max-age: 1728000
cf-cache-status: HIT
age: 899790
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ksbod4mKTr9z2h2K14uJ5CVtT9gR5ALiKFHBQn9VS6YgH8Dp41NrvnJsppJ0mlf%2F%2FpzDRrabE2joIZV%2B1MtZOtM0kPcK8zb03nRLXxIpkR8X%2BQJwct2mJPGywftPavG2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-visitor-country: NO
server: cloudflare
cf-ray: 8a6e3040cc15b4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
GET google.com/
301 Moved Permanently 220 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subject*.google.com
Fingerprint0B:28:0E:1B:FF:FC:C8:1B:AF:D7:4E:50:F3:EE:75:59:BB:D5:46:24
ValidityMon, 24 Jun 2024 06:35:44 GMT - Mon, 16 Sep 2024 06:35:43 GMT
File type HTML document, ASCII text, with CRLF, LF line terminators
Hash 276bbb20c29087e88db63899fd8f9129
b52854d1f79de5ebeebf0160447a09c7a8c2cde4
5b61b0c2032b4aa9519d65cc98c6416c12415e02c7fbbaa1be5121dc75162edb
GET / HTTP/1.1
Host: google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://richtomatos.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
location: https://www.google.com/
content-type: text/html; charset=UTF-8
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-3YdbLwE9CvO0s8_22HZ8CA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Sun, 21 Jul 2024 21:12:19 GMT
expires: Tue, 20 Aug 2024 21:12:19 GMT
cache-control: public, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
0 B URL thubanoa.com/9?z=5336119&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&oaid=0080a0e8d6484f39e1d23c6187c70168
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /9?z=5336119&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&oaid=0080a0e8d6484f39e1d23c6187c70168 HTTP/1.1
Host: thubanoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://coinpriceline.com/
Origin: https://coinpriceline.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 21 Jul 2024 21:12:19 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://coinpriceline.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION, X-Ancestor-Origins, X-Zone-ID, baggage, sentry-trace
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
472 B IP
Hash 77c9c08ce375f17e98c9171053f6924a
9e4dbfec6c0ede12b95d0b73c9fd4648f6186a11
32c9cb624161be64e47a6a353e2c0a326a56f407e21bda3e8f80c1e7d6aff44d
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
471 B IP
Hash 6c2350f4c43ca6f1a3d58f9e071c6f3e
1553552a00488a9e943efaf327e248f265276c8a
ae9ad0902702287830e52c32652c43e0275ac67ffa53e4c75f65db019b51afe0
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 21 Jul 2024 21:12:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
0 B URL thubanoa.com/11?rnd=3527576967&z=5336119&b=20709254&var=&varid=0&rqtdbc=1&rcvdbc=1&btp=1&rb=kBjflIT5naVPw63QxD5Kx3Nr5481NkuO9HKPQcfGwSk1P6-BAQhEkjT7I-j-WGlUN1uXRwEB0VFGnc6nD8asGX5PU4duNaqwC-jXm5PNbumn5fwkQqyzfKgsTdKY-iNEAiW66eGIti3WaB1mtjhDHCaLJEEHTPP7pXAw50jX-3MPRkFWIcYbluEr1lEEO88VbjP7xeSxaEGqKUbMBf7JU82CKJxTaUyZqLFQVjOJISyaY6r2C9icp-pVivHa9FqrpHcQtw_zTEeuqzr42ai_iw6veWxWsZ3KtDn5SMTrGmuxqg_PM1Uk_lsS-o9CiRnREwxmdD1L1XF2X_bb-40gimllcmWmfTJHxGXJIxYzrxvGXz14tmKq19eUErTfECW3iNpUHXyd4eDmDkWt7sjjah5Bzu8U6bR9wm2OXbcxDls10FxlV0wIYLK3x1ktP_iRhflBkTvZNOhG5LPsJp9rAxOcMTDB-68ifD2WJGEctRwYWIrC8m_B8nPy6f6UvvoXFk4GJQ5S_0_9SLN-UgonQBpMRd_N3pErh1am-mdS1G15PuRhDXWfc33W64hnnNpmHRUL1NPO8n6F3l8AhBFWKZ8x4bN_Y86Mr1sbFVoQ8VEbUwYl7of756qJ8bqtk9ghsvqzl7nUU7BzFiMHJ6JPSR0V1yu7IubmF0PI9j2bCKuOEJ6zDwg29sdwTMwpuoKKuJvk7B6XlB-yCIIYpzyasiaLSQYVwhKYyI_H4C_VCd7jTIIcBcRpvfbH1e1_VwXLHOI9PDx1VbngfEa2ADgNftmcT44GkXLeIdrhMane9pP1BRLOgQiYLh4-_Nl9e6ZtrNBe7tLbcQDXoDNSNgKdM9aMa4Ucm0fg2EF22CKVrlTWftYs&ruid=cff38e2a-a8d8-4bc7-9352-1076e90d4dbe&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&ot=97
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /11?rnd=3527576967&z=5336119&b=20709254&var=&varid=0&rqtdbc=1&rcvdbc=1&btp=1&rb=kBjflIT5naVPw63QxD5Kx3Nr5481NkuO9HKPQcfGwSk1P6-BAQhEkjT7I-j-WGlUN1uXRwEB0VFGnc6nD8asGX5PU4duNaqwC-jXm5PNbumn5fwkQqyzfKgsTdKY-iNEAiW66eGIti3WaB1mtjhDHCaLJEEHTPP7pXAw50jX-3MPRkFWIcYbluEr1lEEO88VbjP7xeSxaEGqKUbMBf7JU82CKJxTaUyZqLFQVjOJISyaY6r2C9icp-pVivHa9FqrpHcQtw_zTEeuqzr42ai_iw6veWxWsZ3KtDn5SMTrGmuxqg_PM1Uk_lsS-o9CiRnREwxmdD1L1XF2X_bb-40gimllcmWmfTJHxGXJIxYzrxvGXz14tmKq19eUErTfECW3iNpUHXyd4eDmDkWt7sjjah5Bzu8U6bR9wm2OXbcxDls10FxlV0wIYLK3x1ktP_iRhflBkTvZNOhG5LPsJp9rAxOcMTDB-68ifD2WJGEctRwYWIrC8m_B8nPy6f6UvvoXFk4GJQ5S_0_9SLN-UgonQBpMRd_N3pErh1am-mdS1G15PuRhDXWfc33W64hnnNpmHRUL1NPO8n6F3l8AhBFWKZ8x4bN_Y86Mr1sbFVoQ8VEbUwYl7of756qJ8bqtk9ghsvqzl7nUU7BzFiMHJ6JPSR0V1yu7IubmF0PI9j2bCKuOEJ6zDwg29sdwTMwpuoKKuJvk7B6XlB-yCIIYpzyasiaLSQYVwhKYyI_H4C_VCd7jTIIcBcRpvfbH1e1_VwXLHOI9PDx1VbngfEa2ADgNftmcT44GkXLeIdrhMane9pP1BRLOgQiYLh4-_Nl9e6ZtrNBe7tLbcQDXoDNSNgKdM9aMa4Ucm0fg2EF22CKVrlTWftYs&ruid=cff38e2a-a8d8-4bc7-9352-1076e90d4dbe&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&ot=97 HTTP/1.1
Host: thubanoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://coinpriceline.com
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Cookie: scm=1; OAID=0080a0e8d6484f39e1d23c6187c70168; oaidts=1721596339
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: image/jpeg
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: https://coinpriceline.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION, X-Ancestor-Origins, X-Zone-ID, baggage, sentry-trace
x-trace-id: 3b99848d7f52420747203f1b4687c048
access-control-expose-headers: X-Sc
set-cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; expires=Mon, 21 Jul 2025 21:12:19 GMT; secure; SameSite=None
oaidts=1721596339; expires=Mon, 21 Jul 2025 21:12:19 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
43 kB URL d3x2.myfastcdn.com/www/images/21b31932930c2a50ee2e1e58d7392aa3.png?width=984
IP
File type RIFF (little-endian) data, Web/P image
Hash 30bb4015bb0cd7e338c325bb81aad8e3
660d00d3425c97be8f025f94f5ef0a7199e87082
7b509d4ae9eda22d53167f762c8ea8dc068e166379a445bdc49641a1be1d8f65
GET /www/images/21b31932930c2a50ee2e1e58d7392aa3.png?width=984 HTTP/1.1
Host: d3x2.myfastcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: image/webp
content-length: 43394
access-control-allow-headers: X-Requested-With
access-control-allow-origin: *
edge-cache-tag: 606292609127993205271994854662605111426,613570411217116831189459287628353010494,29ecf9b93bbf306179626feeda1fab70
etag: "4c8defa23f7c331aa265bf03b61002e4"
last-modified: Fri, 28 Jun 2024 19:27:49 GMT
req-referer: https://www.yt1s.com/
status: 200 OK
surrogate-reporting: width=900,height=600,bytes=67407,owidth=900,oheight=600,obytes=743567,ef=(1,13,17,23,30)
x-ratelimit-limit: 101
x-ratelimit-remaining: 100
x-ratelimit-reset: 1
x-envoy-upstream-service-time: 1967
cache-control: max-age=86400
age: 10670
vary: ImageFormat, Accept-Encoding
x-vcl-time-ms: 1
expires: Mon, 22 Jul 2024 18:14:29 GMT
timing-allow-origin: *
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8a6e3044cf13b511-OSL
X-Firefox-Spdy: h2
0 B URL thubanoa.com/11?rnd=3527576967&z=5336119&b=20709254&var=&varid=0&rqtdbc=0&rcvdbc=0&btp=1&rb=kBjflIT5naVPw63QxD5Kx3Nr5481NkuO9HKPQcfGwSk1P6-BAQhEkjT7I-j-WGlUN1uXRwEB0VFGnc6nD8asGX5PU4duNaqwC-jXm5PNbumn5fwkQqyzfKgsTdKY-iNEAiW66eGIti3WaB1mtjhDHCaLJEEHTPP7pXAw50jX-3MPRkFWIcYbluEr1lEEO88VbjP7xeSxaEGqKUbMBf7JU82CKJxTaUyZqLFQVjOJISyaY6r2C9icp-pVivHa9FqrpHcQtw_zTEeuqzr42ai_iw6veWxWsZ3KtDn5SMTrGmuxqg_PM1Uk_lsS-o9CiRnREwxmdD1L1XF2X_bb-40gimllcmWmfTJHxGXJIxYzrxvGXz14tmKq19eUErTfECW3iNpUHXyd4eDmDkWt7sjjah5Bzu8U6bR9wm2OXbcxDls10FxlV0wIYLK3x1ktP_iRhflBkTvZNOhG5LPsJp9rAxOcMTDB-68ifD2WJGEctRwYWIrC8m_B8nPy6f6UvvoXFk4GJQ5S_0_9SLN-UgonQBpMRd_N3pErh1am-mdS1G15PuRhDXWfc33W64hnnNpmHRUL1NPO8n6F3l8AhBFWKZ8x4bN_Y86Mr1sbFVoQ8VEbUwYl7of756qJ8bqtk9ghsvqzl7nUU7BzFiMHJ6JPSR0V1yu7IubmF0PI9j2bCKuOEJ6zDwg29sdwTMwpuoKKuJvk7B6XlB-yCIIYpzyasiaLSQYVwhKYyI_H4C_VCd7jTIIcBcRpvfbH1e1_VwXLHOI9PDx1VbngfEa2ADgNftmcT44GkXLeIdrhMane9pP1BRLOgQiYLh4-_Nl9e6ZtrNBe7tLbcQDXoDNSNgKdM9aMa4Ucm0fg2EF22CKVrlTWftYs&ruid=cff38e2a-a8d8-4bc7-9352-1076e90d4dbe&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&ri=1&wvd=0&wvr=1.0000&isions=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /11?rnd=3527576967&z=5336119&b=20709254&var=&varid=0&rqtdbc=0&rcvdbc=0&btp=1&rb=kBjflIT5naVPw63QxD5Kx3Nr5481NkuO9HKPQcfGwSk1P6-BAQhEkjT7I-j-WGlUN1uXRwEB0VFGnc6nD8asGX5PU4duNaqwC-jXm5PNbumn5fwkQqyzfKgsTdKY-iNEAiW66eGIti3WaB1mtjhDHCaLJEEHTPP7pXAw50jX-3MPRkFWIcYbluEr1lEEO88VbjP7xeSxaEGqKUbMBf7JU82CKJxTaUyZqLFQVjOJISyaY6r2C9icp-pVivHa9FqrpHcQtw_zTEeuqzr42ai_iw6veWxWsZ3KtDn5SMTrGmuxqg_PM1Uk_lsS-o9CiRnREwxmdD1L1XF2X_bb-40gimllcmWmfTJHxGXJIxYzrxvGXz14tmKq19eUErTfECW3iNpUHXyd4eDmDkWt7sjjah5Bzu8U6bR9wm2OXbcxDls10FxlV0wIYLK3x1ktP_iRhflBkTvZNOhG5LPsJp9rAxOcMTDB-68ifD2WJGEctRwYWIrC8m_B8nPy6f6UvvoXFk4GJQ5S_0_9SLN-UgonQBpMRd_N3pErh1am-mdS1G15PuRhDXWfc33W64hnnNpmHRUL1NPO8n6F3l8AhBFWKZ8x4bN_Y86Mr1sbFVoQ8VEbUwYl7of756qJ8bqtk9ghsvqzl7nUU7BzFiMHJ6JPSR0V1yu7IubmF0PI9j2bCKuOEJ6zDwg29sdwTMwpuoKKuJvk7B6XlB-yCIIYpzyasiaLSQYVwhKYyI_H4C_VCd7jTIIcBcRpvfbH1e1_VwXLHOI9PDx1VbngfEa2ADgNftmcT44GkXLeIdrhMane9pP1BRLOgQiYLh4-_Nl9e6ZtrNBe7tLbcQDXoDNSNgKdM9aMa4Ucm0fg2EF22CKVrlTWftYs&ruid=cff38e2a-a8d8-4bc7-9352-1076e90d4dbe&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&ri=1&wvd=0&wvr=1.0000&isions=1 HTTP/1.1
Host: thubanoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://coinpriceline.com
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Cookie: scm=1; OAID=0080a0e8d6484f39e1d23c6187c70168; oaidts=1721596339
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:20 GMT
content-type: image/jpeg
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: https://coinpriceline.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION, X-Ancestor-Origins, X-Zone-ID, baggage, sentry-trace
x-trace-id: 2a4b794b8c957780181ba4142868b666
access-control-expose-headers: X-Sc
set-cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; expires=Mon, 21 Jul 2025 21:12:20 GMT; secure; SameSite=None
oaidts=1721596339; expires=Mon, 21 Jul 2025 21:12:20 GMT; secure; SameSite=None
oaidvc=1; expires=Mon, 21 Jul 2025 21:12:20 GMT; secure; SameSite=None
CNT=1_v1_hv87AQEAAADVTQAA; expires=Sun, 21 Jul 2024 22:12:20 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
2.8 kB URL thubanoa.com/9?z=5336119&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&oaid=0080a0e8d6484f39e1d23c6187c70168
IP
Hash ab3037bc36fab5e0ee29824faf53e47d
027f97bc50492a57f2e281e749600597d9c350a1
bbd9617d2698d7ebfe228dc208f2d7cdf0e79feac1a39e94dce66c70ec325ec6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /9?z=5336119&ng=0&ix=1&pt=0&np=0&gp=5&bp=4&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fcoinpriceline.com%2Flatest-crypto-news%2F%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D5615727&wy=0&wx=0&ww=1280&wh=1024&cw=1920&wiw=1920&wih=1080&wfc=0&sah=1024&drf=&hil=1&ist=0&oaid=0080a0e8d6484f39e1d23c6187c70168 HTTP/1.1
Host: thubanoa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 72
Origin: https://coinpriceline.com
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Cookie: scm=1; OAID=0400a0f0fa054e26f94cc7492ae8d435; oaidts=1721596339
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-origin: https://coinpriceline.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION, X-Ancestor-Origins, X-Zone-ID, baggage, sentry-trace
x-trace-id: e439837b2a621db6a1a04819535cce63
access-control-expose-headers: X-Sc
set-cookie: OAID=0080a0e8d6484f39e1d23c6187c70168; expires=Mon, 21 Jul 2025 21:12:19 GMT; secure; SameSite=None
oaidts=1721596339; expires=Mon, 21 Jul 2025 21:12:19 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
1.3 kB URL fonts.googleapis.com/css?family=helvetica%3A400%2C500%2C600%2C700%7CRoboto%3A400%2C500%2C600%2C700%7CPoppins%3A600%2C400%2C500%2C700&display=swap
IP
File type gzip compressed data, max compression
Hash 559d813da86b794334e6c960ab412969
0eba223c1878a69a8575fba7392f8784e0233850
3d9ddf15c5c0af8561e6f306e237e182131648f6be8b216555bd56925dca4f94
GET /css?family=helvetica%3A400%2C500%2C600%2C700%7CRoboto%3A400%2C500%2C600%2C700%7CPoppins%3A600%2C400%2C500%2C700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://coinpriceline.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 21 Jul 2024 21:12:19 GMT
date: Sun, 21 Jul 2024 21:12:19 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/master.m3u8?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
200 OK 339 B URL GET HTTP/1.1 enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/master.m3u8?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectenc-4.tnmr.org
Fingerprint57:F8:19:7B:76:5A:CC:26:D3:22:10:4B:93:B9:91:CD:B1:3E:B4:2C
ValidityFri, 14 Jun 2024 07:49:10 GMT - Thu, 12 Sep 2024 07:49:09 GMT
Hash 81659cd3db33f093d1d8fc88adcef6ec
ad0e282a1088b69d0a0b3e33ca38e146abb8bc6a
f1583671fb0be2821b71c8a5c3b3769f806a3512c419b72595a9c9171b29421b
GET /hls2/01/00355/rbswfcfn5jab_h/master.m3u8?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4 HTTP/1.1
Host: enc-4.tnmr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:27 GMT
Content-Type: application/vnd.apple.mpegurl
Last-Modified: Sun, 21 Jul 2024 21:12:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 29 Oct 2024 18:16:56 GMT
Cache-Control: max-age=8640000, public, no-transform
Access-Control-Allow-Origin: *
X-Cache-Status: HIT
Content-Encoding: gzip
GET enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/index-v1-a1.m3u8?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
200 OK 2.1 kB URL GET HTTP/1.1 enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/index-v1-a1.m3u8?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectenc-4.tnmr.org
Fingerprint57:F8:19:7B:76:5A:CC:26:D3:22:10:4B:93:B9:91:CD:B1:3E:B4:2C
ValidityFri, 14 Jun 2024 07:49:10 GMT - Thu, 12 Sep 2024 07:49:09 GMT
Hash e9f2906504811e9c8cb7c6c4135b5d14
cc66a684859f42fadabb0f84b990f6f8efb7b148
9b3a4d82659773eefa247c8ad74b1ff143aedb85a8b84d669945788dcf184e18
GET /hls2/01/00355/rbswfcfn5jab_h/index-v1-a1.m3u8?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4 HTTP/1.1
Host: enc-4.tnmr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:27 GMT
Content-Type: application/vnd.apple.mpegurl
Last-Modified: Sun, 21 Jul 2024 21:12:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 29 Oct 2024 18:16:56 GMT
Cache-Control: max-age=8640000, public, no-transform
Access-Control-Allow-Origin: *
X-Cache-Status: HIT
Content-Encoding: gzip
GET enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/seg-1-v1-a1.ts?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
200 OK 3.7 MB URL GET HTTP/1.1 enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/seg-1-v1-a1.ts?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectenc-4.tnmr.org
Fingerprint57:F8:19:7B:76:5A:CC:26:D3:22:10:4B:93:B9:91:CD:B1:3E:B4:2C
ValidityFri, 14 Jun 2024 07:49:10 GMT - Thu, 12 Sep 2024 07:49:09 GMT
File type MPEG transport stream data
Size 3.7 MB (3712248 bytes)
Hash 33d133994a70421499cde56b095a398d
b226efacf1df6f76b5ffac300615d4966f0c05b3
a0e93363e6b5ad7b17d298849a060df86054fa75b4d9bc058a44dd78ed079e90
GET /hls2/01/00355/rbswfcfn5jab_h/seg-1-v1-a1.ts?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4 HTTP/1.1
Host: enc-4.tnmr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:27 GMT
Content-Type: video/MP2T
Content-Length: 3712248
Connection: keep-alive
Last-Modified: Sun, 19 Nov 2000 08:52:00 GMT
Expires: Tue, 29 Oct 2024 18:16:57 GMT
ETag: "5f693e80-38a4f8"
Cache-Control: max-age=8640000, public, no-transform
Access-Control-Allow-Origin: *
X-Cache-Status: HIT
Accept-Ranges: bytes
GET enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/seg-2-v1-a1.ts?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
200 OK 3.4 MB URL GET HTTP/1.1 enc-4.tnmr.org/hls2/01/00355/rbswfcfn5jab_h/seg-2-v1-a1.ts?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectenc-4.tnmr.org
Fingerprint57:F8:19:7B:76:5A:CC:26:D3:22:10:4B:93:B9:91:CD:B1:3E:B4:2C
ValidityFri, 14 Jun 2024 07:49:10 GMT - Thu, 12 Sep 2024 07:49:09 GMT
File type MPEG transport stream data
Size 3.4 MB (3375352 bytes)
Hash 48f5612ad590356aa116cee5b31325e6
679424c727c5e2c505554cdfe91fc1c00061147d
c309746b04e978d559365a36605b93c4f895059cb38a68aac455176aeb0c06d4
GET /hls2/01/00355/rbswfcfn5jab_h/seg-2-v1-a1.ts?t=H90dUAUj9EYdOsf1L5xApt2GMw2BGo_ekfw5aTMmJ3s&s=1721596335&e=43200&f=1775494&srv=cdn1011&i=0.3&sp=0&p1=enc-4&p2=enc-4 HTTP/1.1
Host: enc-4.tnmr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 21 Jul 2024 21:12:28 GMT
Content-Type: video/MP2T
Content-Length: 3375352
Connection: keep-alive
Last-Modified: Sun, 19 Nov 2000 08:52:00 GMT
Expires: Tue, 29 Oct 2024 18:17:13 GMT
ETag: "5f693e80-3380f8"
Cache-Control: max-age=8640000, public, no-transform
Access-Control-Allow-Origin: *
X-Cache-Status: HIT
Accept-Ranges: bytes
GET luluvdo.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/bbfecc7f1c71/main.js?
200 OK 7.9 kB URL GET HTTP/2 luluvdo.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/bbfecc7f1c71/main.js?
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type JavaScript source, ASCII text, with very long lines (7875), with no line terminators
Hash dc87880865b89271097b015c8fd29546
a7cd719c7fb32b2edc0949e72e0f6ca3ff860f6a
13dac793169fbff1a69e5b211e80e2636e00665c7d82eaeae0639824c6b8f54c
GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/bbfecc7f1c71/main.js? HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: lang=1; _ga_RFESL45RJX=GS1.1.1721596336.1.0.1721596336.0.0.0; _ga=GA1.1.590445316.1721596336
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6qYfewu%2Fb3UJPvsbH31B3Gz0DchL%2FBzGJNok17wDnV%2BnGumdgXLPsAqkZOWCtY9%2BK1SmYXGeyBiABAenmJf1AXjGN8MAbBJr5XOlHIUjBh7cFSxq8Nu5INEfPxe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302edacc56ab-OSL
content-encoding: br
X-Firefox-Spdy: h2
GET pop.admpire.com/sub/NqD7qY8
200 OK 234 B URL GET HTTP/2 pop.admpire.com/sub/NqD7qY8
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectadmpire.com
Fingerprint36:29:B6:35:0C:A6:B0:68:59:73:6F:27:0D:BA:E1:D4:57:3C:B6:29
ValidityWed, 03 Jul 2024 17:21:23 GMT - Tue, 01 Oct 2024 17:21:22 GMT
File type HTML document, ASCII text, with no line terminators
Hash c69570e23c26b099fd1630cf298473f1
5d4c788b90d5b6e8974b667e92d7d8e6956f5e4b
29d13e2807e070cbdcc7b8829ed3583caac0fec0677d8acd6acab41b0ef938f7
GET /sub/NqD7qY8 HTTP/1.1
Host: pop.admpire.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/html; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X570sJiOJtFJ9APSPTqK91lnsfoVhnTDfVEi2DihmKiCEuSzK11VdB5xt7%2Fm5lBm2j7JeDlYvbRTwoZk3wSZcrTT7ZoGM5QIfOmjXopjcDdxAzSc8qbBBKRKa0%2B5xlHRbO8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e302ebed4b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET www.google.com/
200 OK 0 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectwww.google.com
Fingerprint8C:C2:35:30:95:5A:AF:BF:64:28:C5:B3:AD:C4:92:7D:9F:BF:E7:DA
ValidityMon, 24 Jun 2024 07:42:34 GMT - Mon, 16 Sep 2024 07:42:33 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://richtomatos.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
expires: -1
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-fJG4w9uRxmx-FDiG2cRKPA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 72717
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: AEC=AVYB7cpOiY06ajH7KML7Efo5NEYVWD858wlIRYcKJbxfQT5_HXjSQi3L8Y8; expires=Fri, 17-Jan-2025 21:12:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
__Secure-ENID=21.SE=EQfOEvSv0eOLG2TUovFwYnd4pBvp8ZMgy3Nn3NPPKUywKBiRVXMdxU-mLLegqHvTosJbIu0-v4vMEyi3sXpheD3UNPQcLbp7CR3rs1ryJKnajO5vrKGO-awevY9Vtz7tzhsZ9VAH55LgFdZ3UtjLkkXWk7xuJJ9gLTWF7849Vx1H18pLd4bPShQ62OA8L9GEmJcPWcQsnuCW9KYZj-C5; expires=Thu, 21-Aug-2025 13:30:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET a.lulucdn.com/player/jw8/jwplayer.js?v=2
200 OK 121 kB URL GET HTTP/2 a.lulucdn.com/player/jw8/jwplayer.js?v=2
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
Size 121 kB (120878 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /player/jw8/jwplayer.js?v=2 HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: application/javascript
last-modified: Wed, 07 Jun 2023 23:02:18 GMT
etag: W/"1d82e-5fd9220ac069a"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3934
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B0vlnMB9wntJ7FA7VWCrHNCsNLTfw08TLMFpRcqDbfPiho5NBQW0pDfI7GTcwdpYbnJj7daagUwzIhj5HOXUGRCb4Yz62MGd4JRGEuYoIuKAfi2%2F3ZP5JcVey42KGxbX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b5faa5689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET a.lulucdn.com/js/jquery.cookie.js
200 OK 4.3 kB URL GET HTTP/2 a.lulucdn.com/js/jquery.cookie.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
File type JavaScript source, ASCII text, with very long lines (4427), with no line terminators
Hash c8a0b7f16c38377537c6ab251cb5bc72
528e37de81abf523b92ce0b457cb593983ed347a
e31179e4a4fffc7faee4f95d4f67ce056d12a57c451dee1dae3e9062b126a00e
GET /js/jquery.cookie.js HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: application/javascript
last-modified: Tue, 31 May 2011 12:53:56 GMT
etag: W/"10eb-4a491e5980100"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3934
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YTcjoyMR3piGLE6yUocPGIPtl3Rf6Iy4IDW6G9hqPCBnqXjyKl1yJ%2Be09imCbPNn7FzVHgmxbbYbjRENn12Eu3sRFLLGe27suIbZf5p0%2Bkj26NBfxoausAlk7MupvK0D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b4fa45689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET img.luluvdo.com/rbswfcfn5jab_xt.jpg
200 OK 188 kB URL GET HTTP/2 img.luluvdo.com/rbswfcfn5jab_xt.jpg
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 0x0, segment length 16, progressive, precision 8, 1200x679, components 3
Size 188 kB (188101 bytes)
Hash 746db6448b7a931e44dcead248dd7d1e
539f0ece33da7625550d1127ab1c12803a5af7e8
44c77a42b22e6387262ef02994a974d811b9885eefa385dcc00ebd2a45b5c581
GET /rbswfcfn5jab_xt.jpg HTTP/1.1
Host: img.luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Cookie: lang=1; _ga_RFESL45RJX=GS1.1.1721596336.1.0.1721596336.0.0.0; _ga=GA1.1.590445316.1721596336; cf_clearance=EGmutHd8ZOvcHPEoHi8QUQeS.3ExqwP3TONuf3sbaGQ-1721596336-1.0.1.1-TGfX4nCuHuW1DQgV7plBxvqjT9th6by1x52nOGT4m6QSwsJwrMN3uaXbsER7ScxDXkpRNl12LPm6S_GxVuNBDA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: image/jpeg
content-length: 188101
cache-control: max-age=604800
cf-bgj: imgq:100,h2pri
cf-polished: origSize=195105
etag: "669bdc1b-2fa21"
expires: Sat, 27 Jul 2024 15:47:40 GMT
last-modified: Sat, 20 Jul 2024 15:47:39 GMT
cf-cache-status: HIT
age: 104910
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lpV%2B2I%2Bd%2B3WuPhHQ6kuFjnZmKGyomIPMfFeJtBUi93wRdueP1OAEMUmrJPRDZjhvHsERUXR2r5O7GE1GSBmPrSEhAeMnJJudtUddGJ8g%2B92CCnMxaDt2fIGOdrgTZ5yr5A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e3031cdbb56ab-OSL
X-Firefox-Spdy: h2
GET a.lulucdn.com/player/jw8/polyfills.webvtt.js
200 OK 11 kB URL GET HTTP/3 a.lulucdn.com/player/jw8/polyfills.webvtt.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /player/jw8/polyfills.webvtt.js HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: application/javascript
last-modified: Wed, 07 Jun 2023 06:30:47 GMT
etag: W/"2a27-5fd8446b4edf7"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3662
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XVYklUl7WPZzhJiA6LLcexMEufcptZ47NjOl1YfXKv%2F67Y4PwM493NwGVa%2Bl3Tns50fnxfevRGSE35zxFB4g6PwKqR0sSOclluGCPhmwOyfXff2h5dkzh4I0Nakj8YPk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e30317e6c5691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET c.adsco.re/
200 OK 78 kB IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (881)
Hash 70e681d122073a9bc3f704fb0f96a82d
5916b6dea0ea58b5807287ca1cd4faf9c9f3aae5
73bfce45d382df02d75ef2ef688325cc973139931db445ee753c2af8a85f3965
GET / HTTP/1.1
Host: c.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 21 Jul 2024 21:12:17 GMT
content-type: text/html
cache-control: public, max-age=2678400
accept-ch: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Device-Memory, Downlink, ECT, RTT, Width, Viewport-Width, DPR
permissions-policy: ch-ua=(self "https://adsco.re"),ch-ua-mobile=(self "https://adsco.re"),ch-ua-full-version=(self "https://adsco.re"),ch-ua-platform=(self "https://adsco.re"),ch-ua-platform-version=(self "https://adsco.re"),ch-ua-arch=(self "https://adsco.re"),ch-ua-model=(self "https://adsco.re"),ch-device-memory=(self "https://adsco.re"),ch-downlink=(self "https://adsco.re"),ch-ect=(self "https://adsco.re"),ch-rtt=(self "https://adsco.re"),ch-width=(self "https://adsco.re"),ch-viewport-width=(self "https://adsco.re"),ch-dpr=(self "https://adsco.re")
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=preconnect
expires: Wed, 21 Aug 2024 21:12:17 GMT
etag: W/"cOaB0SIHOpvD9wT7D5aoLQ=="
content-encoding: gzip
cf-cache-status: HIT
age: 699659
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e303798d1b511-OSL
alt-svc: h3=":443"; ma=86400
GET xml.acertb.com/redirect?feed=687996&auth=g2jD4T&pubid=207411
302 Found 52 B URL GET HTTP/1.1 xml.acertb.com/redirect?feed=687996&auth=g2jD4T&pubid=207411
IP
ASN #27257 WEBAIR-INTERNET
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.acertb.com
FingerprintFF:96:FE:4C:D9:51:B0:C8:2F:82:F5:07:D7:D4:64:0B:AF:65:F2:72
ValidityThu, 14 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect?feed=687996&auth=g2jD4T&pubid=207411 HTTP/1.1
Host: xml.acertb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Location: https://de.forerungirdles.com/i6oKq6spPDgpeY/QrOEQ
GET lulustream.com/player/jw8/player-logo.svg
200 OK 4.2 kB URL GET HTTP/2 lulustream.com/player/jw8/player-logo.svg
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulustream.com
Fingerprint25:63:8C:78:EE:8C:5A:40:C0:66:1A:75:62:14:1F:C8:00:28:DA:A0
ValidityWed, 19 Jun 2024 04:27:33 GMT - Tue, 17 Sep 2024 04:27:32 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (4404), with no line terminators
Hash 85d346a69d39f2ff5a2b5c57d08e394b
ca6bb128f19e49205d42838ae87ef6860e5b96ba
d38eb2eb0cace39309c3306ff875f4e5c40c3978b0c0c7f4fe13f38ee2621e8b
GET /player/jw8/player-logo.svg HTTP/1.1
Host: lulustream.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:17 GMT
content-type: image/svg+xml
last-modified: Sat, 02 Mar 2024 14:00:06 GMT
etag: W/"1042-612ade8e6b08c"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3663
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2FGw907wzsaHkMr%2FZTP8ci84sq0KPt%2BtB43ggkX2EI8EayriyYZcSdSE5JWvpB7hsaqPSSJbcW5N8EGdP6zSFYGJVRCwpDuvEMG2JxyT1PdBe25LYduLwnMX%2BNZEk9agXg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e3032a8515684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css2?family=Poppins:wght@400;500;700&display=swap
200 OK 2.4 kB URL GET HTTP/2 fonts.googleapis.com/css2?family=Poppins:wght@400;500;700&display=swap
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
Fingerprint8F:1C:80:D7:A7:FA:04:F3:EE:EF:70:FD:56:35:32:FD:55:AB:63:5F
ValidityMon, 24 Jun 2024 07:40:53 GMT - Mon, 16 Sep 2024 07:40:52 GMT
File type ASCII text, with very long lines (2413), with no line terminators
Hash b72cff3c04bb76ce624eec0070eacbb9
0ceb769e9c6e3a83ef15281ad0e9a7e7f374816d
4d5ee6be2b87e15cc3027f863c271bac7859fcd285dd8bea94a579fbfa37bcc5
GET /css2?family=Poppins:wght@400;500;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 21 Jul 2024 21:12:16 GMT
date: Sun, 21 Jul 2024 21:12:16 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET img.luluvdo.com/rbswfcfn5jab.jpg?nocache=1
200 OK 48 kB URL GET HTTP/2 img.luluvdo.com/rbswfcfn5jab.jpg?nocache=1
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 720x405, components 3
Hash deeb05353b8ed2b31cdb1e1efed5cb42
cad1fff443691194aad5dceff3245c2547e1b2db
76e2b0c17b1ba392a57f231898beefbde00095bfb7ccaf04649fc1a770f564b5
GET /rbswfcfn5jab.jpg?nocache=1 HTTP/1.1
Host: img.luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Cookie: lang=1; _ga_RFESL45RJX=GS1.1.1721596336.1.0.1721596336.0.0.0; _ga=GA1.1.590445316.1721596336; cf_clearance=EGmutHd8ZOvcHPEoHi8QUQeS.3ExqwP3TONuf3sbaGQ-1721596336-1.0.1.1-TGfX4nCuHuW1DQgV7plBxvqjT9th6by1x52nOGT4m6QSwsJwrMN3uaXbsER7ScxDXkpRNl12LPm6S_GxVuNBDA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:17 GMT
content-type: image/jpeg
content-length: 47839
cache-control: max-age=604800
cf-bgj: imgq:100,h2pri
cf-polished: origSize=49097
etag: "669bdc15-bfc9"
expires: Sat, 27 Jul 2024 16:02:38 GMT
last-modified: Sat, 20 Jul 2024 15:47:33 GMT
cf-cache-status: HIT
age: 104897
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=600EsfDcPZiEzuY5u5JK5CzyZI9fEEqAb3kGo11Gqogc4UpovTwJVM5AJCwjyZi3pcANq3MzRYDuY5ZHLgM4o0QI6bfrplWqCA%2FOVrzKZANtaI%2Fqgk1DIBTpxH0Ct2PG4w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e30328e4d56ab-OSL
X-Firefox-Spdy: h2
GET coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
200 OK 134 kB URL GET HTTP/2 coinpriceline.com/latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectcoinpriceline.com
FingerprintA3:49:3E:3D:D0:EE:76:F2:D9:01:DD:55:C5:45:6D:7A:A8:EF:D1:DB
ValidityFri, 12 Jul 2024 07:43:44 GMT - Thu, 10 Oct 2024 07:43:43 GMT
Size 134 kB (133932 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /latest-crypto-news/?utm_source=google&utm_medium=cpc&utm_campaign=5615727 HTTP/1.1
Host: coinpriceline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
last-modified: Sun, 21 Jul 2024 15:40:37 GMT
cache-control: max-age=0
expires: Sun, 21 Jul 2024 19:40:39 GMT
age: 5499
x-cache: HIT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1VKCCFfVt8%2BkpNRmR%2B5S7BimDg5qpBftwGg6dzfk1p7GPPw6R6RS9hH8FAqV1P8tcpYj4maW%2BYYm3nMmgD5GtapGQFdLmFRLVlkc1p%2Bx50Sa9thZM7%2BUHU8F%2FvOusMSCZ7RY5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e303e0e7056bd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET www.xadsmart.com/tabby.min.js
200 OK 37 kB URL GET HTTP/2 www.xadsmart.com/tabby.min.js
IP
ASN #60068 Datacamp Limited
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subject1376341044.rsc.cdn77.org
Fingerprint27:47:79:5F:AB:25:21:63:81:5C:AD:A0:0E:17:1A:98:CE:62:C6:B2
ValidityTue, 09 Jul 2024 10:53:46 GMT - Mon, 07 Oct 2024 10:53:45 GMT
File type JavaScript source, ASCII text, with very long lines (1568)
Hash aaac7f7b11e5006775d63f590a5dea21
821bfb107a03101076f10335b3af6919e583d29c
fe3d7fadb6500c95cf4dbda5da52a17b1ce87bdb2c9d3321a9e8fd6ba73b134b
GET /tabby.min.js HTTP/1.1
Host: www.xadsmart.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://luluvdo.com
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: application/x-javascript
popads-node: wb8
expires: Sat, 27 Jul 2024 00:14:59 GMT
access-control-allow-origin: https://luluvdo.com
link: <https://xadsmart.com/>;rel=preconnect
cache-control: public, max-age=604800
x-77-nzt: EwwBuUwJFAH3KXgCAAgBuUwKCQFBDAGKxyXEAfcEAAAA
x-77-nzt-ray: af585630776dedb1b0799d66ba55d11b
x-accel-expires: @1722039299
x-accel-date: 1721434503
x-77-cache: HIT
x-77-age: 161833
vary: Accept-Encoding, Origin
content-encoding: gzip
server: CDN77-Turbo
x-accel-date-max: 1721434503
x-cache: HIT
x-age: 161833
x-77-pop: stockholmSE
X-Firefox-Spdy: h2
GET richtomatos.com/in/p/?spot_id=825066&cat=1&sub_id=199943254
200 OK 5.8 kB URL GET HTTP/2 richtomatos.com/in/p/?spot_id=825066&cat=1&sub_id=199943254
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerLet's Encrypt
Subjectrichtomatos.com
FingerprintBE:47:74:24:5B:07:BB:78:16:AB:16:1E:13:57:FE:3E:A1:07:47:04
ValidityMon, 13 May 2024 15:24:50 GMT - Sun, 11 Aug 2024 15:24:49 GMT
File type HTML document, ASCII text, with very long lines (5913), with no line terminators
Hash e8acc88c48b95685c0f2af37960c6106
30f1718e83e500425e1a3f319a1da793529b07a5
bbeb3686d13fac55486cf33685ec35e16422dbb24d098664820aa59a092a9674
GET /in/p/?spot_id=825066&cat=1&sub_id=199943254 HTTP/1.1
Host: richtomatos.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 21 Jul 2024 21:12:19 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
vary: Accept-Encoding, *
set-cookie: 1095.0=1; expires=Mon, 22 Jul 2024 21:12:18 GMT; path=/; secure; SameSite=None
content-encoding: gzip
X-Firefox-Spdy: h2
GET a.lulucdn.com/css/main.css
200 OK 49 kB URL GET HTTP/2 a.lulucdn.com/css/main.css
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /css/main.css HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: text/css
last-modified: Thu, 18 May 2023 18:01:36 GMT
etag: W/"c05b-5fbfb986a0000"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 4123
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v6%2BvjeJKwZ3dhxEa8Ieg%2Fw1pIcZW8Zbf0Kvcp%2B7neWMzKrm9fmViOpcmCK%2BMeF9Rnn2WQUigjYWT98WIq2u9%2F9AvgSQm1weHhyOTSzW4HKK5BMVTk9kAJNpYAjLl%2BvPc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b2f815689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET a.lulucdn.com/js/jquery.min.js
200 OK 90 kB URL GET HTTP/2 a.lulucdn.com/js/jquery.min.js
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectlulucdn.com
Fingerprint02:D4:0C:22:29:84:55:04:36:84:9F:63:C7:22:C2:8C:49:A4:8A:92
ValidityThu, 13 Jun 2024 19:16:58 GMT - Wed, 11 Sep 2024 19:16:57 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /js/jquery.min.js HTTP/1.1
Host: a.lulucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: application/javascript
last-modified: Wed, 03 Mar 2021 00:27:20 GMT
etag: W/"15d9d-5bc96e9f7ca00"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 3934
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S41ga4y85JLeG0zfrIXm0xRPZjjOe5SSjS7WGzLhKVVDiGciHsW9r%2BcTFip8pdsFiI7kIwUKq0o4TEY60Ck6eq5zJfMZPQcOyytsT3%2FP8qwetfVtCD6kE7jGjTrt8vS7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e302b3f8c5689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET luluvdo.com/favicon.ico
200 OK 449 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
File type MS Windows icon resource - 1 icon, 30x30 with PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Hash 91a7665e37c2eeb49f2ee2fbc2e2d19d
8f93836b06e6c2fac65258b7420c1df09ad58d37
ff27be6c1a1eba3dc17d16581d680e8faba2536b565e90ad7c09c43d62495dd7
GET /favicon.ico HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/e/rbswfcfn5jab
Cookie: lang=1; _ga_RFESL45RJX=GS1.1.1721596336.1.0.1721596336.0.0.0; _ga=GA1.1.590445316.1721596336
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 01 Jun 2023 18:52:04 GMT
etag: W/"1c1-5fd15eeb261fb"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 5929
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KubsXorTUKKEBDp93YrgCYJujLpuwEk1znRXzAUtImc%2ByN5VKn9S7kIF1b%2Bb84YNy%2BjcDj4N7I3Bg8quwy1VBiiaw4yGk9jFDm915gMY7DMMph1fvc8UD3Nl4VgW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e30307c7356ab-OSL
content-encoding: br
X-Firefox-Spdy: h2
GET pop.admpire.com/sub/NqD7qY8
200 OK 234 B URL GET HTTP/2 pop.admpire.com/sub/NqD7qY8
IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerGoogle Trust Services
Subjectadmpire.com
Fingerprint36:29:B6:35:0C:A6:B0:68:59:73:6F:27:0D:BA:E1:D4:57:3C:B6:29
ValidityWed, 03 Jul 2024 17:21:23 GMT - Tue, 01 Oct 2024 17:21:22 GMT
File type HTML document, ASCII text, with no line terminators
Hash c69570e23c26b099fd1630cf298473f1
5d4c788b90d5b6e8974b667e92d7d8e6956f5e4b
29d13e2807e070cbdcc7b8829ed3583caac0fec0677d8acd6acab41b0ef938f7
GET /sub/NqD7qY8 HTTP/1.1
Host: pop.admpire.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:16 GMT
content-type: text/html; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ubnWcboM2eQlqZcIYsKIrQn1YRXRZyZmxp7%2FPBKV6fpPotqGZ6A1P6aO4RMjX3QSbexTAZkzi6meLiqGxuLl5jyCeWy6A%2BQwSk%2BBLFrebVjJbCx1lkofe7k1v18iGpOAD6s%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e302ebedcb517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET luluvdo.com/e/rbswfcfn5jab
200 OK 25 kB URL User Request GET HTTP/2 luluvdo.com/e/rbswfcfn5jab
IP
Certificate IssuerGoogle Trust Services LLC
Subjectluluvdo.com
FingerprintED:04:FC:7C:CF:78:F3:FD:83:8B:79:F7:BC:9F:A9:11:FA:37:B5:CC
ValidityWed, 29 May 2024 14:15:21 GMT - Tue, 27 Aug 2024 14:15:20 GMT
Hash 37e386eecf1e06111a1e164953a4faae
89d8d0fdabb4dbd4e7cfc6cb8ef86878bbd1cfba
023a8fa81ed60ff10d45828dc1cfd54dd3e43b3cbbd594200b36693a9fbd1747
GET /e/rbswfcfn5jab HTTP/1.1
Host: luluvdo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:15 GMT
content-type: text/html; charset=UTF-8
expires: Sat, 20 Jul 2024 21:12:15 GMT
set-cookie: lang=1; domain=.luluvdo.com; path=/; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oljmeRgDJ7Z%2BZ2DKFSPfE4OaQGnvGcI0uJYEqfvITQLMlqUsZznR3kC%2BHFptgVn3ecGWtVz786YT%2FlOtKiRPduxkJbafsV7sYNP%2FBGjqjEiDcDPfovaCTF6eK9aG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a6e3026daba56ab-OSL
content-encoding: br
X-Firefox-Spdy: h2
GET c.adsco.re/
0 B IP
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.adsco.re
Fingerprint40:64:05:9C:99:0A:1E:9F:A7:49:61:8E:86:4C:4B:06:9C:73:83:73
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sun, 29 Sep 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: c.adsco.re
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://luluvdo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 21 Jul 2024 21:12:17 GMT
content-type: text/html
cache-control: public, max-age=2678400
accept-ch: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Device-Memory, Downlink, ECT, RTT, Width, Viewport-Width, DPR
permissions-policy: ch-ua=(self "https://adsco.re"),ch-ua-mobile=(self "https://adsco.re"),ch-ua-full-version=(self "https://adsco.re"),ch-ua-platform=(self "https://adsco.re"),ch-ua-platform-version=(self "https://adsco.re"),ch-ua-arch=(self "https://adsco.re"),ch-ua-model=(self "https://adsco.re"),ch-device-memory=(self "https://adsco.re"),ch-downlink=(self "https://adsco.re"),ch-ect=(self "https://adsco.re"),ch-rtt=(self "https://adsco.re"),ch-width=(self "https://adsco.re"),ch-viewport-width=(self "https://adsco.re"),ch-dpr=(self "https://adsco.re")
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=preconnect
expires: Wed, 21 Aug 2024 21:12:17 GMT
etag: W/"cOaB0SIHOpvD9wT7D5aoLQ=="
content-encoding: gzip
cf-cache-status: HIT
age: 699659
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a6e30336a831bfa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET xml.acertb.com/redirect?feed=687996&auth=g2jD4T&pubid=207411
302 Found 1.4 kB URL GET HTTP/1.1 xml.acertb.com/redirect?feed=687996&auth=g2jD4T&pubid=207411
IP
ASN #27257 WEBAIR-INTERNET
Requested by https://luluvdo.com/e/rbswfcfn5jab
Certificate IssuerSectigo Limited
Subject*.acertb.com
FingerprintFF:96:FE:4C:D9:51:B0:C8:2F:82:F5:07:D7:D4:64:0B:AF:65:F2:72
ValidityThu, 14 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect?feed=687996&auth=g2jD4T&pubid=207411 HTTP/1.1
Host: xml.acertb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pop.admpire.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Sun, 21 Jul 2024 21:12:17 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Location: https://www.animezeno.sbs/
104.26.7.79
188.114.96.1
162.252.214.5
23.36.76.226
139.45.195.8
185.200.116.51
37.59.30.198
94.130.197.239
185.76.9.24