Report - mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar

Report Overview

Visited public
2025-04-28 06:23:50
Tags
URL
mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Finishing URL
mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
IP / ASN
172.67.153.131
#13335 CLOUDFLARENET
Title
Download G-RJ01214867-v1 part2 rar

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mexa.sh	337577	2019-08-22	2019-08-26	2025-04-24	14 kB	716 kB	104.21.3.103
my.rtmark.net	9054	2014-10-29	2015-02-04	2025-04-23	461 B	830 B	104.18.41.22
waisheph.com	74994	2020-11-23	2020-12-10	2025-04-24	3.4 kB	114 kB	139.45.197.119
www.googletagmanager.com	75	2011-11-11	2012-10-04	2025-04-23	1.0 kB	655 kB	142.250.178.40
obeseglobewimp.com	unknown	2025-03-03	2025-03-05	2025-04-25	443 B	605 B	172.240.108.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-04-27	medium	obeseglobewimp.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (13)

	URL	From	Size	First Seen	Last Seen
	waisheph.com/5/7359319	ScriptElement	108 kB	2025-04-28	2025-04-28
Pretty URL waisheph.com/5/7359319 IP 139.45.197.119 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-28 06:23 Last Seen2025-04-28 06:23 Times Seen1 Hash 1ea2353b12ffdcddb750d9aab33e55ed 70a9592ae50471b3001889a9cb616538a74b1c9b 6fdb87ee56d934eb38d3144c2dd8d76924e6e78a8f2b46c226674c9f83b8cc53 Loading...

	mexa.sh/js/jquery-1.9.1.min.js	ScriptElement	93 kB	2023-03-07	2025-05-08
Pretty URL mexa.sh/js/jquery-1.9.1.min.js IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-08 03:48 Times Seen14327 Hash 397754ba49e9e0cf4e7c190da78dda05 ae49e56999d82802727455f0ba83b63acd90a22b c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Loading...

	mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar	ScriptElement	261 B	2023-03-12	2025-05-06
Pretty URL mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 23:45 Last Seen2025-05-06 04:07 Times Seen64 Hash abbf34430edc9e4d913c44d8a48f2ae3 dc9f6c9c0b7d020d8bc465365a4039daa8cbcc84 f04d076aafba2a5adb1116793b34a04ef9da13f29838dd753bfd7ccfedcda8c9 Loading...

	www.googletagmanager.com/gtag/js?id=UA-79936000-1	ScriptElement	272 kB	2025-04-28	2025-04-28
Pretty URL www.googletagmanager.com/gtag/js?id=UA-79936000-1 IP 142.250.178.40 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-28 06:23 Last Seen2025-04-28 06:23 Times Seen1 Hash 0a53385f1e78648f29b47a440743b5a7 d858a557b8fc65d8c83efbddd7e2f7ba1cb28458 e12a0be9df2145b2b80899f3eae0ece55e644ae71d2467228ed872ec3a58b1f3 Loading...

	mexa.sh/js/jquery.cookie.js	ScriptElement	3.1 kB	2023-03-07	2025-05-07
Pretty URL mexa.sh/js/jquery.cookie.js IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:23 Last Seen2025-05-07 06:11 Times Seen2543 Hash ff14e4812b7f512e620b1ad35542bcfc c40c5f777e7a2f63e7b731b3cdb1fe9c806b23ae c4fb91befcf134b81ecfa1c586e1f9d6426c8f4fc1f6c130ac1fddb49ab5df96 Loading...

	mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar	ScriptElement	666 B	2023-03-12	2025-05-06
Pretty URL mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 23:45 Last Seen2025-05-06 04:07 Times Seen64 Hash 3ff478c8f993edf7fcf9b0a556256ed5 22391de1683e10171a05ac3453143ea297da9f3e 2840b85566767ff50901311c4a2c2545b5b29e94c8c3aaade614902a04dc45d7 Loading...

	www.googletagmanager.com/gtag/js?id=G-SBML259V1V&l=dataLayer&cx=c&gtm=457e54n0za200&tag_exp=102887800~103051953~103071290~103077950~103106314~103106316~103116025~103130360~103130362~103200001	ScriptElement	381 kB	2025-04-28	2025-04-28
Pretty URL www.googletagmanager.com/gtag/js?id=G-SBML259V1V&l=dataLayer&cx=c&gtm=457e54n0za200&tag_exp=102887800~103051953~103071290~103077950~103106314~103106316~103116025~103130360~103130362~103200001 IP 142.250.178.40 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-28 06:23 Last Seen2025-04-28 06:23 Times Seen1 Hash c530633d5ff3c3eb7887f1942db279cb 998536ce6a4b6f54d03c866cb7de96e8051134e3 9e3d7f1d2c25bd0f265a60003d72bfaeff2e35038bc68ec86e0206f32c52dcda Loading...

	mexa.sh/js/jquery.paging.js	ScriptElement	19 kB	2023-03-07	2025-05-07
Pretty URL mexa.sh/js/jquery.paging.js IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:23 Last Seen2025-05-07 06:11 Times Seen2506 Hash d7a2c1c7af2a004a6d68e1e55b1cfb46 7fd6daa7076c30381880519ad06ef5639b19ee28 c8ecfe747c979fbd87624913200a9237343679923b495885bced089b80fc84f6 Loading...

	mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar	ScriptElement	154 B	2023-03-12	2025-05-06
Pretty URL mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 23:45 Last Seen2025-05-06 04:07 Times Seen67 Hash c6b02bbb4255c747368479fd2e4300e5 0a5cd83325ceaab81243a71c4ce359edf2d15c03 8b9d20a60322347d585ec6209ba3e9e1bacc7a8aa14c7aa33f3549d10348614c Loading...

	mexa.sh/mpd7k66xsm90/sandbox%20eval%20code		147 B	2023-04-11	2025-05-08
Pretty URL mexa.sh/mpd7k66xsm90/sandbox%20eval%20code IP 0.0.0.0 ASN #0 Introduced by Embedded in HTML false Observations First Seen2023-04-11 21:07 Last Seen2025-05-08 04:29 Times Seen341051 Hash 92b651082ce234f66bb544e678befda3 14c21c55ddce43b6f677caadf51d4ab98c6a3df8 25d57d1d97abeb84531d3d3e5754dd5cb19a2c115edfa7cfc7af8247084faded Loading...

	mexa.sh/js/paging.js	ScriptElement	1.7 kB	2023-03-08	2025-05-07
Pretty URL mexa.sh/js/paging.js IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 03:01 Last Seen2025-05-07 06:11 Times Seen617 Hash 43e50aa00ad654da80af8f7936afd4c6 fb5921b855cce329191077b7e93563029d703545 e8a4ec002545486fb475c977fc9d53ac48a77cfb3d36ac91042c14dc688d5657 Loading...

	mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar	ScriptElement	172 B	2025-04-28	2025-04-28
Pretty URL mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar IP 104.21.3.103 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-28 06:23 Last Seen2025-04-28 06:23 Times Seen1 Hash a1d0593ce3c539f2dbc9c10e56bd0547 96494ccadfd5b54f72703c8f439b4ba9f1c34523 8fabe79c3f070a1351126662db3ae8efdaca8a9c32aaf86f4791b9849a99ff54 Loading...

	www.google-analytics.com/analytics.js	ScriptElement	4.7 kB	2023-04-11	2025-05-08
Pretty URL www.google-analytics.com/analytics.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-11 21:07 Last Seen2025-05-08 04:29 Times Seen340257 Hash f24128d0c9cba7be2916c693427a3483 1b6397d496ea896ebc2018b01b995cee4f166029 58173de4697da1a218f04c3a783a733bab4e769ceabc37cd42da9dc3e036a7e8 Loading...

HTTP Transactions (36)

URL IP Response Size

mexa.sh/js/jquery-1.9.1.min.js

104.21.3.103

200 OK

93 kB

URL GET
mexa.sh/js/jquery-1.9.1.min.js
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
JavaScript source, ASCII text, with very long lines (32089)
Size
93 kB (92629 bytes)
Hash
397754ba49e9e0cf4e7c190da78dda05
ae49e56999d82802727455f0ba83b63acd90a22b
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

HTTP Headers

GET /js/jquery-1.9.1.min.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: application/javascript
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:32 GMT
cf-cache-status: HIT
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
etag: W/"169d5-550b66e847e00"
content-encoding: br
cf-ray: 9374785bd883b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/js/jquery.cookie.js

104.21.3.103

200 OK

3.1 kB

URL GET
mexa.sh/js/jquery.cookie.js
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
JavaScript source, ASCII text
Size
3.1 kB (3121 bytes)
Hash
ff14e4812b7f512e620b1ad35542bcfc
c40c5f777e7a2f63e7b731b3cdb1fe9c806b23ae
c4fb91befcf134b81ecfa1c586e1f9d6426c8f4fc1f6c130ac1fddb49ab5df96

HTTP Headers

GET /js/jquery.cookie.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: application/javascript
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:32 GMT
cf-cache-status: HIT
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
etag: W/"c31-550b66e847e00"
content-encoding: br
cf-ray: 9374785bd885b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/download1.png

104.21.3.103

200 OK

24 kB

URL GET
mexa.sh/images/download1.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced
Size
24 kB (23553 bytes)
Hash
26b1df6a0077b0e57862d48f78ca6f62
c1333ea62ff83bc3ad7e5e79085a4e2054684106
118653ed567e17878bbc0f821c1858d8f2ea9a65a84a2e3dd8177d5393052b86

HTTP Headers

GET /images/download1.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 23553
server: cloudflare
accept-ranges: bytes
last-modified: Tue, 30 May 2017 04:42:35 GMT
etag: "5c01-550b66eb244c0"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 292
cf-ray: 9374785be8a7b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/frechar.png

104.21.3.103

200 OK

67 kB

URL GET
mexa.sh/images/frechar.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 120 x 144, 16-bit/color RGBA, non-interlaced
Size
67 kB (66710 bytes)
Hash
7adab309ecff73216286b6d34b795e7c
f2791da7bcea6e23cb2ae8beb1724c6a003cb3c8
1b2f0a33a03b71c4f76186a368adb3ebacf73dde3b770fe30b93cb4a54188078

HTTP Headers

GET /images/frechar.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 66710
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qRy46tDI9%2FdpKH5GHxhyvxsAifzG4NZN98xD%2FTPKEE%2BmVoFQdcIHR2RqLu8SQddZGj%2FltUbKNWOe8foZDyu6eh6hHqyA9ZDodQ0c1eIqYGPusvpINxs%2BNzDW"}],"group":"cf-nel","max_age":604800}
last-modified: Fri, 19 Jul 2024 07:38:56 GMT
etag: "10496-61d94c9aac4eb"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 291
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785cf86e56b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4643&min_rtt=659&rtt_var=3069&sent=115&recv=120&lost=0&retrans=0&sent_bytes=43374&recv_bytes=8531&delivery_rate=542550&cwnd=24000&unsent_bytes=0&cid=7c928dfaf6a15656&ts=570&x=16"

mexa.sh/images/navicon3.png

104.21.3.103

200 OK

16 kB

URL GET
mexa.sh/images/navicon3.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced
Size
16 kB (15889 bytes)
Hash
715335986af196b81f68fa792f5a7f53
b6b2f12993db399f86883315310869dccbd75ec5
aed030aceb42be1e4b98b63eaac7064b3cd6a08fa4806d967be6bd47c449b76f

HTTP Headers

GET /images/navicon3.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 15889
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:35 GMT
etag: "3e11-550b66eb244c0"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be8a0b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/.png

104.21.3.103

404 Not Found

3.3 kB

URL GET
mexa.sh/images/.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
HTML document, ASCII text
Size
3.3 kB (3301 bytes)
Hash
f3c091a2b91e7970fa4602d60103dc67
af5f70406fabc9e192b349e5aee7dc9a67d05f18
6e9e4b1516efd000e0f4b2ce737cb6b418c14f8b6029733c23853db1ed532f14

HTTP Headers

GET /images/.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: text/html; charset=utf-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=76vsBJVR5wahiJNSI2g7BI%2FyGBHqxbG%2Fn%2BN4mv%2F0%2F%2FdbMlxhiabCqpXOI%2BJlTH5mNXVpo%2FNQSMwnJQZSJ62kZJJyO37JGUgV7DCY%2BZ1b4YMh0i1w%2BqBPITw5"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 17 Dec 2019 16:49:23 GMT
x-test-header: 1
x-content-type-options: nosniff
age: 92
cache-control: max-age=14400
cf-cache-status: HIT
content-encoding: br
cf-ray: 9374785cf86b56b9-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4994&min_rtt=659&rtt_var=3158&sent=82&recv=119&lost=0&retrans=0&sent_bytes=7374&recv_bytes=8486&delivery_rate=2183&cwnd=12000&unsent_bytes=0&cid=7c928dfaf6a15656&ts=566&x=16"

mexa.sh/images/navbar.png

104.21.3.103

200 OK

22 kB

URL GET
mexa.sh/images/navbar.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 1350 x 63, 8-bit/color RGBA, non-interlaced
Size
22 kB (22290 bytes)
Hash
e7c056eea6e071b1f5309d5db50c057a
833e979751da5fffe28b8761b322d16481a24c2e
34785757170123855e1669c212f2987c30f2714200d8d5e8738ca3418f79e4c9

HTTP Headers

GET /images/navbar.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 22290
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IQIUTTl2mHYGnFkvQLiu1d3Jit0V9uFhn8jZ1q8mZznbfZeeZoG7YZ3M1NSPCn6D9Ol8PJKn88YF9u2jDCs1g1CFdVmHphJCce5GY4gX8mANvSpkoKnznm%2FI"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "5712-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1827
accept-ranges: bytes
cf-ray: 9374785cf86d56b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3656&min_rtt=659&rtt_var=2766&sent=175&recv=123&lost=0&retrans=0&sent_bytes=112458&recv_bytes=8663&delivery_rate=11093537&cwnd=58800&unsent_bytes=0&cid=7c928dfaf6a15656&ts=573&x=16"

mexa.sh/images/premchar.png

104.21.3.103

200 OK

70 kB

URL GET
mexa.sh/images/premchar.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 120 x 142, 16-bit/color RGBA, non-interlaced
Size
70 kB (69808 bytes)
Hash
e3a6c4b647e9c8b789b17a98fb6d75f8
c7428a76951933962ef1d7400b37ba9ef91d6afd
0b96b573944cb4d34a5ee132b09eb322845c82a7ef1a3db0931927c336735d69

HTTP Headers

GET /images/premchar.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 69808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7I%2BBasQH%2Fv%2B0vcrAo10WTfVX19gNi%2FR5ciIMZLn7RP%2FisdvfKi%2F%2FCz7Oc5pFff2bWWU24Ju%2BuIZkjWgeiIeddmT3DBavyozEt6HJmUda%2Fx14BsbZUtZHsqwc"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "110b0-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 291
accept-ranges: bytes
cf-ray: 9374785cf86f56b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4994&min_rtt=659&rtt_var=3158&sent=86&recv=119&lost=0&retrans=0&sent_bytes=8982&recv_bytes=8486&delivery_rate=2183&cwnd=12000&unsent_bytes=0&cid=7c928dfaf6a15656&ts=567&x=16"

mexa.sh/images/navbara.png

104.21.3.103

200 OK

22 kB

URL GET
mexa.sh/images/navbara.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 1350 x 63, 8-bit/color RGBA, non-interlaced
Size
22 kB (22290 bytes)
Hash
e7c056eea6e071b1f5309d5db50c057a
833e979751da5fffe28b8761b322d16481a24c2e
34785757170123855e1669c212f2987c30f2714200d8d5e8738ca3418f79e4c9

HTTP Headers

GET /images/navbara.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:19 GMT
content-type: image/png
content-length: 22290
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YjtPgKhEz1hy0PmCmI%2BcYgLqpqwzwaL1pzxRHi%2BKGwOiKkvtWHw%2BRuSm8TDSHM%2Fw04gfgI2Qf5rus54oRGpGOdfJ%2BQqQkaaEt4lNyXGfTiX%2FRb0D52ndhTEk"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 30 May 2017 04:42:35 GMT
etag: "5712-550b66eb244c0"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1826
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 93747861288656b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3104&min_rtt=659&rtt_var=1653&sent=318&recv=128&lost=0&retrans=0&sent_bytes=276123&recv_bytes=9146&delivery_rate=8990360&cwnd=153300&unsent_bytes=0&cid=7c928dfaf6a15656&ts=1234&x=16"

my.rtmark.net/gid.js?userId=0081b90b6b5d4ab0e75be47daa20cd0f

104.18.41.22

200 OK

65 B

URL GET
my.rtmark.net/gid.js?userId=0081b90b6b5d4ab0e75be47daa20cd0f
IP
104.18.41.22:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmy.rtmark.net
Fingerprint03:52:6A:BD:35:83:43:81:AF:25:BB:A3:26:97:D1:78:25:73:A4:C9
ValidityTue, 04 Mar 2025 10:39:32 GMT - Mon, 02 Jun 2025 11:39:29 GMT

File type
JSON text data
Size
65 B (65 bytes)
Hash
d6fe4cbb620229afc5690924ca90eae3
b67ce45510a9217dc96fe8cc46cb4b072b4b1831
cbfe5d4c6fec62fd1afd1361844198546f41c60c7a402e27b89670f81ce73193

HTTP Headers

GET /gid.js?userId=0081b90b6b5d4ab0e75be47daa20cd0f HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:19 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://mexa.sh
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=0081b90b6b5d4ab0e75be47daa20cd0f; expires=Tue, 28 Apr 2026 06:23:19 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 937478601a1456ae-OSL
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

waisheph.com/?rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE%3D&request_ab2=0&zoneid=7359319&js_build=iclick-v1.1127.2-auto&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=0&pl=https%3A%2F%2Fmexa.sh%2Fmpd7k66xsm90%2FG-RJ01214867-v1.15.part2.rar&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=1&wgl=llvmpipe&js_build=iclick-v1.1127.2-auto&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=59876e00-e651-40e2-9168-4274585d486b&wasm=1&userId=0081b90b6b5d4ab0e75be47daa20cd0f&m=link

139.45.197.119

200 OK

2.4 kB

URL GET
waisheph.com/?rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE%3D&request_ab2=0&zoneid=7359319&js_build=iclick-v1.1127.2-auto&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=0&pl=https%3A%2F%2Fmexa.sh%2Fmpd7k66xsm90%2FG-RJ01214867-v1.15.part2.rar&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=1&wgl=llvmpipe&js_build=iclick-v1.1127.2-auto&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=59876e00-e651-40e2-9168-4274585d486b&wasm=1&userId=0081b90b6b5d4ab0e75be47daa20cd0f&m=link
IP
139.45.197.119:443
ASN
#9002 RETN Limited

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerLet's Encrypt
Subjectwaisheph.com
Fingerprint2F:DC:B5:CD:9D:81:2D:67:4D:2A:BF:A5:28:D4:1A:B9:F9:CE:C6:AC
ValidityFri, 11 Apr 2025 05:22:09 GMT - Thu, 10 Jul 2025 05:22:08 GMT

File type
JSON text data
Size
2.4 kB (2416 bytes)
Hash
88e3771b398594da97d3847aca08d645
65ce0d1abe42de5b13cc4bb85070f28fa8793125
0d40d6af3c2dd6536754926a3a4e55d7d96a23da0ddf3da6108d699aaded01d8

HTTP Headers

GET /?rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE%3D&request_ab2=0&zoneid=7359319&js_build=iclick-v1.1127.2-auto&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=0&pl=https%3A%2F%2Fmexa.sh%2Fmpd7k66xsm90%2FG-RJ01214867-v1.15.part2.rar&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=1&wgl=llvmpipe&js_build=iclick-v1.1127.2-auto&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=59876e00-e651-40e2-9168-4274585d486b&wasm=1&userId=0081b90b6b5d4ab0e75be47daa20cd0f&m=link HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Cookie: OAID=0081b90b6b5d4ab0e75be47daa20cd0f; oaidts=1745821398
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Mon, 28 Apr 2025 06:23:19 GMT
content-type: application/json
x-trace-id: 68c76f42f6a97c5672d4932c548008a5
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://mexa.sh
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=0081b90b6b5d4ab0e75be47daa20cd0f; expires=Tue, 28 Apr 2026 06:23:19 GMT; path=/; secure; SameSite=None
oaidts=1745821399; expires=Tue, 28 Apr 2026 06:23:19 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Mon, 05 May 2025 06:23:19 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2

mexa.sh/js/paging.js

104.21.3.103

200 OK

1.7 kB

URL GET
mexa.sh/js/paging.js
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
HTML document, ASCII text
Size
1.7 kB (1709 bytes)
Hash
43e50aa00ad654da80af8f7936afd4c6
fb5921b855cce329191077b7e93563029d703545
e8a4ec002545486fb475c977fc9d53ac48a77cfb3d36ac91042c14dc688d5657

HTTP Headers

GET /js/paging.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: application/javascript
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:32 GMT
cf-cache-status: HIT
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
etag: W/"6ad-550b66e847e00"
content-encoding: br
cf-ray: 9374785bd886b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/navicon2.png

104.21.3.103

200 OK

16 kB

URL GET
mexa.sh/images/navicon2.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced
Size
16 kB (16374 bytes)
Hash
86665a37cea72cd507ceb7e7282c74f8
f7707000a81a04f217ec9bd93995a0b9fc424037
ee6d96bdbf6cffc4e603a1845255d94861452f9132d400388c10c2b3d6fb3db1

HTTP Headers

GET /images/navicon2.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 16374
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:33 GMT
etag: "3ff6-550b66e93c040"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be896b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/mpd7k66xsm90

104.21.3.103

200 OK

14 kB

URL GET
mexa.sh/mpd7k66xsm90
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
HTML document, ASCII text, with very long lines (10969), with CRLF line terminators
Size
14 kB (14119 bytes)
Hash
8036e74976cd432d6699a095218e0e36
04cf2ea93802c3afa4f43938a9d6585547ee59c7
4136dd336530729421e47c5b481723d677c4690af46518bf0d5266cfc57d9dba

HTTP Headers

GET /mpd7k66xsm90 HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
DNT: 1
Connection: keep-alive
Cookie: lang=english; _ga_SBML259V1V=GS1.1.1745821399.1.0.1745821399.0.0.0; _ga=GA1.1.1356882894.1745821399
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:19 GMT
content-type: text/html ; charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ul0PTCc1fmZb2UsPcPTLwZq7bTghVP4mUR9QwLT4yv4KOLlR2u073rBgfudQKzHBR0MoAdVKcd7SpMkBJ0Mi0XBTbsfWqt0buJxveM5lGCiSMBCUfEytbJOO"}],"group":"cf-nel","max_age":604800}
expires: Sun, 27 Apr 2025 06:23:19 GMT
x-test-header: 1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
cf-ray: 93747862e88f56b9-OSL
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3123&min_rtt=659&rtt_var=1151&sent=342&recv=132&lost=0&retrans=0&sent_bytes=300285&recv_bytes=9930&delivery_rate=2862&cwnd=153300&unsent_bytes=0&cid=7c928dfaf6a15656&ts=1697&x=16"

mexa.sh/css_newTheme/main.css

104.21.3.103

200 OK

35 kB

URL GET
mexa.sh/css_newTheme/main.css
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
assembler source, ASCII text, with very long lines (1426)
Size
35 kB (35326 bytes)
Hash
2f075bd8c1fed47ee1ebcaea76c5f036
66e03118be7fa1415deebd13efa08362224f1ed9
eb10cdca88afebbb0b6af470c50a76cbabfc864193b0c535d93dcea81321c49e

HTTP Headers

GET /css_newTheme/main.css HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: text/css
server: cloudflare
last-modified: Sun, 13 Jan 2019 07:31:45 GMT
cf-cache-status: HIT
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
etag: W/"89fe-57f51eb945a40"
content-encoding: br
cf-ray: 9374785bd880b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/flags.png

104.21.3.103

200 OK

30 kB

URL GET
mexa.sh/images/flags.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 1248 x 11, 8-bit/color RGBA, non-interlaced
Size
30 kB (29723 bytes)
Hash
df0a3afc77d0c08cdea27ac3a7b9620c
8248d5c5e5eddeaa75a5a0b5490b58e0e61b6900
a38e9ae7d0318307be9b3c7aaccaf64e484d775fe9a507f850b9e4bfa314cf03

HTTP Headers

GET /images/flags.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/style.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 29723
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zjqSBftRUdWecM%2FYGR106LZVP49hmt4BUzslzy23wxt%2FnVjp0lfCfATiskbldKgPqlVItuebqIFyFrP457g4WlZxOL0s5z6NkwqaCO5EYIrSyVs9SueUqRuY"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "741b-550b66ea30280"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1826
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785cf86c56b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4994&min_rtt=659&rtt_var=3158&sent=95&recv=119&lost=0&retrans=0&sent_bytes=19374&recv_bytes=8486&delivery_rate=2183&cwnd=12000&unsent_bytes=0&cid=7c928dfaf6a15656&ts=567&x=16"

mexa.sh/images/premium_download.png

104.21.3.103

200 OK

36 kB

URL GET
mexa.sh/images/premium_download.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 323 x 71, 8-bit/color RGBA, non-interlaced
Size
36 kB (35695 bytes)
Hash
75737b3b7b2586619b43ab184c2f95bf
89878f4f4aafb8637e9e9c50eedbba12e1cb74eb
e05df009685a645cba141b9e0d534c8abd9b23ec997e0894e585702c73e04a5f

HTTP Headers

GET /images/premium_download.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 35695
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1e6Z53BaHzZTXK0fTzpnvXlNWiIDIrkDS%2F3XMtx%2BjC6vDqJXhR0208L33rnkSvNmty0yoggEFkG%2FnexlT%2BYHHCsVpAyI9zCn7YgZ%2FDsF8I536ev3gM%2FY1cm2"}],"group":"cf-nel","max_age":604800}
last-modified: Sat, 15 Jul 2017 04:35:36 GMT
etag: "8b6f-55453b26c1600"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 291
accept-ranges: bytes
cf-ray: 9374785d087156b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4994&min_rtt=659&rtt_var=3158&sent=95&recv=119&lost=0&retrans=0&sent_bytes=19374&recv_bytes=8486&delivery_rate=2183&cwnd=12000&unsent_bytes=0&cid=7c928dfaf6a15656&ts=567&x=16"

waisheph.com/wrr?z=7359319&p_rid=59876e00-e651-40e2-9168-4274585d486b&rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE=&dmn=waisheph.com&userId=0081b90b6b5d4ab0e75be47daa20cd0f

139.45.197.119

204 No Content

0 B

URL OPTIONS
waisheph.com/wrr?z=7359319&p_rid=59876e00-e651-40e2-9168-4274585d486b&rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE=&dmn=waisheph.com&userId=0081b90b6b5d4ab0e75be47daa20cd0f
IP
139.45.197.119:443
ASN
#9002 RETN Limited

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerLet's Encrypt
Subjectwaisheph.com
Fingerprint2F:DC:B5:CD:9D:81:2D:67:4D:2A:BF:A5:28:D4:1A:B9:F9:CE:C6:AC
ValidityFri, 11 Apr 2025 05:22:09 GMT - Thu, 10 Jul 2025 05:22:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

OPTIONS /wrr?z=7359319&p_rid=59876e00-e651-40e2-9168-4274585d486b&rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE=&dmn=waisheph.com&userId=0081b90b6b5d4ab0e75be47daa20cd0f HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://mexa.sh/
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
server: nginx
date: Mon, 28 Apr 2025 06:23:19 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://mexa.sh
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

139.45.197.119

204 No Content

0 B

URL POST
waisheph.com/wrr?z=7359319&p_rid=59876e00-e651-40e2-9168-4274585d486b&rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE=&dmn=waisheph.com&userId=0081b90b6b5d4ab0e75be47daa20cd0f
IP
139.45.197.119:443
ASN
#9002 RETN Limited

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerLet's Encrypt
Subjectwaisheph.com
Fingerprint2F:DC:B5:CD:9D:81:2D:67:4D:2A:BF:A5:28:D4:1A:B9:F9:CE:C6:AC
ValidityFri, 11 Apr 2025 05:22:09 GMT - Thu, 10 Jul 2025 05:22:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /wrr?z=7359319&p_rid=59876e00-e651-40e2-9168-4274585d486b&rb=7h6wXlmjFCRbCUazjHmDJBT3oJ0gICkJ1UPju-bi_m3FyID6dH-ZnHZUwIqMAr5mCjjpS5PER3OXU-pjzO1-tiOqYHGT1UT8xatU4ygGQwu9sEY7-lrpw7VttpUkHnrKy3SQ4cwvLLhuY-iqgz2knCsL1SkWhUX2uFJPU0oQ4a7hKaWRue19DkuUkyIRgKmO4gnmlbk0cdeekdappvbOBxxDcKu6vIsiVYiSSA1RA4jJiXou1ybM9kb3nNOpAy4HlhIwcG7C9H_DtK3I1BUK449wowE=&dmn=waisheph.com&userId=0081b90b6b5d4ab0e75be47daa20cd0f HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mexa.sh/
content-type: application/json
Content-Length: 2601
Origin: https://mexa.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
server: nginx
date: Mon, 28 Apr 2025 06:23:19 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://mexa.sh
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar

104.21.3.103

200 OK

14 kB

URL User Request GET
mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
HTML document, ASCII text, with very long lines (10912), with CRLF line terminators
Size
14 kB (14062 bytes)
Hash
3d73a689c44390b66dd2dbc9df89549e
bc58f33292d8de6740e56cfd73e335a045c1374e
c2866f4602b75f3aad735fdf481a3d6967768448c52c84f82b2bec7ac681d0f5

HTTP Headers

GET /mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:17 GMT
content-type: text/html ; charset=UTF-8
server: cloudflare
expires: Sun, 27 Apr 2025 06:23:17 GMT
x-test-header: 1
x-content-type-options: nosniff
cf-cache-status: BYPASS
content-encoding: br
set-cookie: lang=english; Path=/; Domain=mexa.sh
cf-ray: 937478582bdeb4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/css_newTheme/style.css

104.21.3.103

200 OK

40 kB

URL GET
mexa.sh/css_newTheme/style.css
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
ASCII text
Size
40 kB (39810 bytes)
Hash
3c6420826cc1647abda78120299c0eb6
bf10714579e64ee828627f828695fe093c5b810f
3688ad50ef9e8944e982c4e017363d2454b84814b3a289af6dc9a341988180e7

HTTP Headers

GET /css_newTheme/style.css HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: text/css
server: cloudflare
last-modified: Wed, 09 Aug 2017 05:59:44 GMT
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1829
etag: W/"9b82-5564bc956d400"
content-encoding: br
cf-ray: 9374785bd87fb4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/regicon.png

104.21.3.103

200 OK

20 kB

URL GET
mexa.sh/images/regicon.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 18 x 22, 8-bit/color RGBA, non-interlaced
Size
20 kB (19508 bytes)
Hash
363e2a7e57bf3cb4da7d113445cd676f
15c3bba1a21d1543ee17ccd57a304f1efedca876
012602b63f0fb6df165120eddb63fd137f160b56be0185cbe59aa6731f994779

HTTP Headers

GET /images/regicon.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 19508
server: cloudflare
accept-ranges: bytes
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "4c34-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1829
cf-ray: 9374785be8a6b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

www.googletagmanager.com/gtag/js?id=G-SBML259V1V&l=dataLayer&cx=c&gtm=457e54n0za200&tag_exp=102887800~103051953~103071290~103077950~103106314~103106316~103116025~103130360~103130362~103200001

142.250.178.40

200 OK

381 kB

URL GET
www.googletagmanager.com/gtag/js?id=G-SBML259V1V&l=dataLayer&cx=c&gtm=457e54n0za200&tag_exp=102887800~103051953~103071290~103077950~103106314~103106316~103116025~103130360~103130362~103200001
IP
142.250.178.40:443
ASN
#15169 GOOGLE

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subject*.google-analytics.com
FingerprintE4:97:12:2A:2B:30:84:66:33:9D:D6:09:14:D3:8F:CE:3E:20:73:24
ValidityMon, 31 Mar 2025 08:54:37 GMT - Mon, 23 Jun 2025 08:54:36 GMT

File type
JavaScript source, ASCII text, with very long lines (6129)
Size
381 kB (381253 bytes)
Hash
c530633d5ff3c3eb7887f1942db279cb
998536ce6a4b6f54d03c866cb7de96e8051134e3
9e3d7f1d2c25bd0f265a60003d72bfaeff2e35038bc68ec86e0206f32c52dcda

HTTP Headers

GET /gtag/js?id=G-SBML259V1V&l=dataLayer&cx=c&gtm=457e54n0za200&tag_exp=102887800~103051953~103071290~103077950~103106314~103106316~103116025~103130360~103130362~103200001 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 28 Apr 2025 06:23:18 GMT
expires: Mon, 28 Apr 2025 06:23:18 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
server: Google Tag Manager
content-length: 126949
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

mexa.sh/images/navicon6.png

104.21.3.103

200 OK

1.2 kB

URL GET
mexa.sh/images/navicon6.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced
Size
1.2 kB (1175 bytes)
Hash
91f3dc42cd20fcc67b1f9e4d026ae636
4eb701d8acffe7471ca14183d83fdc8e5d57bec5
a9a1670e3a3b68ddead344606fe60843fc01d9cb439094ad9f813a5b6f072659

HTTP Headers

GET /images/navicon6.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 1175
server: cloudflare
accept-ranges: bytes
last-modified: Fri, 11 Jun 2021 12:43:51 GMT
etag: "497-5c47cdc166fc0"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 1829
cf-ray: 9374785be8a1b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/no211.png

104.21.3.103

200 OK

720 B

URL GET
mexa.sh/images/no211.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
Size
720 B (720 bytes)
Hash
5508fda2890fd7f0368dcb662b600dd8
1bcb3a7bfbb7d9085116d57ff120929628d68440
4412e2285d723b472c86f2bd2ecc0b8009d26eea38d3a906d7bce0e512677726

HTTP Headers

GET /images/no211.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 720
server: cloudflare
last-modified: Mon, 26 Aug 2019 15:38:33 GMT
etag: "2d0-59106f2ce7040"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 291
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be8a8b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

waisheph.com/5/7359319

139.45.197.119

200 OK

108 kB

URL GET
waisheph.com/5/7359319
IP
139.45.197.119:443
ASN
#9002 RETN Limited

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerLet's Encrypt
Subjectwaisheph.com
Fingerprint2F:DC:B5:CD:9D:81:2D:67:4D:2A:BF:A5:28:D4:1A:B9:F9:CE:C6:AC
ValidityFri, 11 Apr 2025 05:22:09 GMT - Thu, 10 Jul 2025 05:22:08 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
108 kB (107553 bytes)
Hash
1ea2353b12ffdcddb750d9aab33e55ed
70a9592ae50471b3001889a9cb616538a74b1c9b
6fdb87ee56d934eb38d3144c2dd8d76924e6e78a8f2b46c226674c9f83b8cc53

HTTP Headers

GET /5/7359319 HTTP/1.1
Host: waisheph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: application/javascript
x-trace-id: d4e940f14fb479b8a250608f04b20362
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=0081b90b6b5d4ab0e75be47daa20cd0f; expires=Tue, 28 Apr 2026 06:23:18 GMT; path=/; secure; SameSite=None
oaidts=1745821398; expires=Tue, 28 Apr 2026 06:23:18 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2

obeseglobewimp.com/48/ea/c2/48eac25e15d2aeed70d260fa57ee3c42.js

172.240.108.76

403 Forbidden

0 B

URL GET
obeseglobewimp.com/48/ea/c2/48eac25e15d2aeed70d260fa57ee3c42.js
IP
172.240.108.76:443
ASN
#7979 SERVERS-COM

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerLet's Encrypt
Subjectobeseglobewimp.com
Fingerprint2B:15:3C:49:E3:1F:CD:ED:DC:1D:2A:15:38:00:BC:58:19:D2:A1:59
ValidityMon, 03 Mar 2025 19:05:17 GMT - Sun, 01 Jun 2025 19:05:16 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /48/ea/c2/48eac25e15d2aeed70d260fa57ee3c42.js HTTP/1.1
Host: obeseglobewimp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Server: nginx/1.21.6
Date: Mon, 28 Apr 2025 06:23:18 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
accept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
x-envoy-upstream-service-time: 1
Host: obeseglobewimp.com

mexa.sh/mpd7k66xsm90/favicon.ico

104.21.3.103

302 Found

14 kB

URL GET
mexa.sh/mpd7k66xsm90/favicon.ico
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type

Size
14 kB (14119 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /mpd7k66xsm90/favicon.ico HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 302 Found
date: Mon, 28 Apr 2025 06:23:19 GMT
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DOQMyO8dbi1KX6UrqSbBU2028pm206o1p6E2iuk1OIhn4k9TQzuUfighhkI5OxBG6ZN0hn96TOiN1VTzoW3hb7DSI18ix0kFpOQTDEDxe6xerBHO3tahZB5d"}],"group":"cf-nel","max_age":604800}
location: https://mexa.sh/mpd7k66xsm90
x-test-header: 1
x-content-type-options: nosniff
cf-cache-status: BYPASS
cf-ray: 93747861688956b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3052&min_rtt=659&rtt_var=1345&sent=340&recv=130&lost=0&retrans=0&sent_bytes=299653&recv_bytes=9510&delivery_rate=1436674&cwnd=153300&unsent_bytes=0&cid=7c928dfaf6a15656&ts=1444&x=16"

mexa.sh/images/free_download.png

104.21.3.103

200 OK

32 kB

URL GET
mexa.sh/images/free_download.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 323 x 71, 8-bit/color RGBA, non-interlaced
Size
32 kB (32532 bytes)
Hash
46a5fd5732a87850dd58f70c8c870430
9ae7b42ff28fd2129aa5e67057f9d4d198a717eb
9d83ca5cc56ca22555b7760e69827e4cb916ededbedf291e5d877f6e01219487

HTTP Headers

GET /images/free_download.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/css_newTheme/main.css
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 32532
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=48EBvwJB%2Bwo32nDRJxnoqTNrS%2FsqBJ5ZukmBzMkDsrhx0rT83IwsE9%2F%2FY%2FDlttSIBxFCxn6a%2FkSFJZznG8jz%2B67LvOa47X710%2BImVOMiS%2Fk5IMDO%2Bc%2B76Zou"}],"group":"cf-nel","max_age":604800}
last-modified: Sat, 15 Jul 2017 04:35:36 GMT
etag: "7f14-55453b26c1600"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 115
accept-ranges: bytes
cf-ray: 9374785cf87056b9-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4994&min_rtt=659&rtt_var=3158&sent=95&recv=119&lost=0&retrans=0&sent_bytes=19374&recv_bytes=8486&delivery_rate=2183&cwnd=12000&unsent_bytes=0&cid=7c928dfaf6a15656&ts=567&x=16"

mexa.sh/js/jquery.paging.js

104.21.3.103

200 OK

19 kB

URL GET
mexa.sh/js/jquery.paging.js
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
JavaScript source, ASCII text
Size
19 kB (19365 bytes)
Hash
d7a2c1c7af2a004a6d68e1e55b1cfb46
7fd6daa7076c30381880519ad06ef5639b19ee28
c8ecfe747c979fbd87624913200a9237343679923b495885bced089b80fc84f6

HTTP Headers

GET /js/jquery.paging.js HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: application/javascript
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:32 GMT
cf-cache-status: HIT
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
etag: W/"4ba5-550b66e847e00"
content-encoding: br
cf-ray: 9374785bd884b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

www.googletagmanager.com/gtag/js?id=UA-79936000-1

142.250.178.40

200 OK

272 kB

URL GET
www.googletagmanager.com/gtag/js?id=UA-79936000-1
IP
142.250.178.40:443
ASN
#15169 GOOGLE

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subject*.google-analytics.com
FingerprintE4:97:12:2A:2B:30:84:66:33:9D:D6:09:14:D3:8F:CE:3E:20:73:24
ValidityMon, 31 Mar 2025 08:54:37 GMT - Mon, 23 Jun 2025 08:54:36 GMT

File type
JavaScript source, ASCII text, with very long lines (5436)
Size
272 kB (271961 bytes)
Hash
0a53385f1e78648f29b47a440743b5a7
d858a557b8fc65d8c83efbddd7e2f7ba1cb28458
e12a0be9df2145b2b80899f3eae0ece55e644ae71d2467228ed872ec3a58b1f3

HTTP Headers

GET /gtag/js?id=UA-79936000-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 28 Apr 2025 06:23:18 GMT
expires: Mon, 28 Apr 2025 06:23:18 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
server: Google Tag Manager
content-length: 95764
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

mexa.sh/images/logo1_1x.png

104.21.3.103

200 OK

38 kB

URL GET
mexa.sh/images/logo1_1x.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 300 x 70, 8-bit/color RGBA, non-interlaced
Size
38 kB (38035 bytes)
Hash
037f1c3e351f635f706eda54b812c40a
8aa7dd796e3b41fdf3f523edf6a24995fc6ca8fa
30ef46dd068df61a603fa7a022c1aecd1a841c58d98fd1ceceea80ba342e8408

HTTP Headers

GET /images/logo1_1x.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 38035
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "9493-550b66ea30280"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be890b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/navicon1.png

104.21.3.103

200 OK

18 kB

URL GET
mexa.sh/images/navicon1.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Size
18 kB (18288 bytes)
Hash
ae9204e9914f4e3c5b146c488d5a1811
fe60b0cf1bbb856f93fca9183404d698e873f33e
f570af26ff118159a429ef1f0add1fa3431fe4ab22e15e80da0407e5bbac2125

HTTP Headers

GET /images/navicon1.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 18288
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "4770-550b66ea30280"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be894b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/navicon5.png

104.21.3.103

200 OK

16 kB

URL GET
mexa.sh/images/navicon5.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced
Size
16 kB (15551 bytes)
Hash
002d70c5e45c4d81587ca7d82dca6577
d830a98de6a02ca22933b9f24cadf848499419d3
de5ce08ee842e8f12bfcc0c14dde4bb1e3c2fb695d32a36122b859c7f42b39d3

HTTP Headers

GET /images/navicon5.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 15551
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "3cbf-550b66ea30280"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be8a3b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/userin.png

104.21.3.103

200 OK

18 kB

URL GET
mexa.sh/images/userin.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 18 x 22, 8-bit/color RGBA, non-interlaced
Size
18 kB (18182 bytes)
Hash
f7354ba97c4568ef41c764f1d5641336
78041d1b15b6af69d015b1dff67bb9d2501fe325
71657baf0148a08ee00ee4b43ab8106c192c670b34f853817a64dcff40fe1eba

HTTP Headers

GET /images/userin.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 18182
server: cloudflare
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "4706-550b66ea30280"
accept-ranges: bytes
x-test-header: 1
x-content-type-options: nosniff
age: 1828
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9374785be8a4b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mexa.sh/images/yep_d.png

104.21.3.103

200 OK

15 kB

URL GET
mexa.sh/images/yep_d.png
IP
104.21.3.103:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Certificate
IssuerGoogle Trust Services
Subjectmexa.sh
Fingerprint12:DD:C9:07:B0:0E:09:D5:D6:A1:89:A9:52:7A:8D:51:C2:58:DF:B0
ValiditySat, 15 Mar 2025 05:28:49 GMT - Fri, 13 Jun 2025 06:26:04 GMT

File type
PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Size
15 kB (15222 bytes)
Hash
662d1738accf3ec5f5c95a0e4896b232
8b1907196139b8819ffd1a77b3b71d3872ca848f
2c3e1756a8ea4bb4fca505be1a11e169adf01017e5fecd3602f3895f1b4450c3

HTTP Headers

GET /images/yep_d.png HTTP/1.1
Host: mexa.sh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mexa.sh/mpd7k66xsm90/G-RJ01214867-v1.15.part2.rar
Cookie: lang=english
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 28 Apr 2025 06:23:18 GMT
content-type: image/png
content-length: 15222
server: cloudflare
accept-ranges: bytes
last-modified: Tue, 30 May 2017 04:42:34 GMT
etag: "3b76-550b66ea30280"
x-test-header: 1
x-content-type-options: nosniff
cache-control: max-age=14400
cf-cache-status: HIT
age: 292
cf-ray: 9374785be8a9b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (13)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML