GET www.googletagmanager.com/gtag/js?id=G-BL9163LYG1
200 OK 92 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=G-BL9163LYG1
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintC1:58:7C:BF:5A:61:79:08:CB:C2:00:63:60:07:86:BD:EA:0A:45:8A
ValidityMon, 20 Nov 2023 08:02:50 GMT - Mon, 12 Feb 2024 08:02:49 GMT
File type ASCII text, with very long lines (4179)
Hash bbfc31b58787195176a8fdb1b4021b9a
ae190749bc9cc05b5805c775ba366571bfebfe97
bf7d81e1c7f9c068dc55999b2305260958dea6f5b6e4e9b3bc67608686eff796
GET /gtag/js?id=G-BL9163LYG1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 28 Dec 2023 19:50:29 GMT
expires: Thu, 28 Dec 2023 19:50:29 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 91984
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET static.depositfiles.com/js/function.js
200 OK 35 kB URL GET HTTP/2 static.depositfiles.com/js/function.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type ASCII text, with very long lines (4240)
Hash a5779d2f560cd50376dbba372b0fd15b
07b08e35b9254288c1372e37577db8b9e4da01b4
51d26403861d61a7842bc73f518d4a4351a7027c40c9f0347f61421226950b84
GET /js/function.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-8863"
expires: Thu, 28 Dec 2023 19:55:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 34915
X-Firefox-Spdy: h2
GET static.depositfiles.com/js/jquery.validate.js
200 OK 38 kB URL GET HTTP/2 static.depositfiles.com/js/jquery.validate.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type Unicode text, UTF-8 text, with very long lines (1238)
Hash d5231b6378847ebdb55f64c77d5a234f
eed97aa0b2aa9486b6f6831ed8a85dc729ad6b9c
95434a8a2568a6481a1fbcf5808a75dd58e77348ed6d70b4f7aeda8842e8f0c7
GET /js/jquery.validate.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-957d"
expires: Thu, 28 Dec 2023 19:55:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 38269
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/speed_small_gold.gif
200 OK 14 kB URL GET HTTP/2 static.depositfiles.com/images/speed_small_gold.gif
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type GIF image data, version 89a, 200 x 200
Hash c5f8f0e9ecd16637e267912376c24bed
324567a641d318ecfafe6374dfba86ccb2f90dd7
13678b229b6c4224bcb9578a2f29bc3686958f4bea73af7645eb39af4246e6a9
GET /images/speed_small_gold.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-389c"
expires: Tue, 02 Jan 2024 19:50:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 14492
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/speed_small.gif
200 OK 24 kB URL GET HTTP/2 static.depositfiles.com/images/speed_small.gif
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type GIF image data, version 89a, 200 x 200
Hash 5cbc96bbb7230dd17ed38b5dd6e3271c
6ee1f0b9e29ac3e824cccd6e5135d51c8d3aaea1
01edcbb65e514def555b1e999d3a72f118f67e572f628293b91893b3758c6991
GET /images/speed_small.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-5dac"
expires: Tue, 02 Jan 2024 19:50:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 23980
X-Firefox-Spdy: h2
GET static.depositfiles.com/js/gold_offer.js
200 OK 9.9 kB URL GET HTTP/2 static.depositfiles.com/js/gold_offer.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type HTML document, ASCII text
Hash 041bdbbe3ac15bc57b14933e164b55f8
790f921426d0b602424fb3077ca900af94b5ad9e
a86d8d81e5c254822628c578c40d2d62956ab3060632d1884b5080093365b97b
GET /js/gold_offer.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-269f"
expires: Thu, 28 Dec 2023 19:55:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 9887
X-Firefox-Spdy: h2
GET static.depositfiles.com/js/download_utils.js
200 OK 13 kB URL GET HTTP/2 static.depositfiles.com/js/download_utils.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type ASCII text, with very long lines (2250)
Hash 90a706006bc709cdc974ff3e0e01b34f
89585d2c7cac44c9c03c118bbb38aefba1d8a1e4
16f1515b9938fc7de086c504fe214484d97e237647a5d7fa2cb742a93f00c1ea
GET /js/download_utils.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-3447"
expires: Thu, 28 Dec 2023 19:55:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 13383
X-Firefox-Spdy: h2
GET relationbeehive.com/22/4a/d4/224ad4a14b4b15c1726ff705ec672ea6.js
200 OK 16 kB URL GET HTTP/1.1 relationbeehive.com/22/4a/d4/224ad4a14b4b15c1726ff705ec672ea6.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectrelationbeehive.com
Fingerprint8F:A4:74:72:DF:C0:37:EB:1D:51:03:5E:2E:D7:FC:35:D1:D8:7F:3B
ValidityTue, 14 Nov 2023 16:07:25 GMT - Mon, 12 Feb 2024 16:07:24 GMT
File type ASCII text, with very long lines (43226), with no line terminators
Hash 9f305263db97a4d0b875695a4fd03029
98b963993ab2006badebb10d7c66e28bd94ff25f
627b8ac163bb84b8a5d28899f63439f541d81f04c48405d6ee8818520fd3bda2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /22/4a/d4/224ad4a14b4b15c1726ff705ec672ea6.js HTTP/1.1
Host: relationbeehive.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 28 Dec 2023 19:50:29 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 95d1e0d76998d1248dd48b7878c5fe67
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
GET static.depositfiles.com/images/yes.png
200 OK 3.3 kB URL GET HTTP/2 static.depositfiles.com/images/yes.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Hash 3055b8489aeb385fb40b27f0bf0a5ae7
4cfbe45a0ba393ab8ad535cc04af30debef0a1ab
b325d6cb153b02050e59230e2abfb01e05f4bda708ad54bd8f6d9693fa9c2dac
GET /images/yes.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-ccb"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 3275
X-Firefox-Spdy: h2
GET dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
200 OK 9.5 kB URL User Request GET HTTP/2 dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
IP
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
FingerprintCC:57:A8:99:82:65:9E:AE:6B:7C:68:C0:CE:7C:F7:6F:A8:6B:23:E0
ValiditySun, 05 Nov 2023 13:34:41 GMT - Sat, 03 Feb 2024 13:34:40 GMT
File type gzip compressed data, max speed, from Unix
Hash 56858033d87444cd8635e40d0a690c37
f0892efd4e5403da8aadbe03485ac137780816eb
c2bdc526e91974fba3da28550152b2773e34b818432865f0e130a1c2b6e70b1a
GET /files/qabuajtj6/COD-WAW_patch_and-PB.exe HTTP/1.1
Host: dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 28 Dec 2023 19:50:28 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
set-cookie: PHPSESSID=dc3dd919171e53f9d35d3e1177654d7e; path=/
last_file=qabuajtj6; path=/; domain=.dfiles.eu
lang_current=en; expires=Fri, 27-Dec-2024 19:50:28 GMT; Max-Age=31536000; path=/; domain=.dfiles.eu; secure
x-frame-options: SAMEORIGIN
X-Firefox-Spdy: h2
GET static.depositfiles.com/js/base2.js
200 OK 399 kB URL GET HTTP/2 static.depositfiles.com/js/base2.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type Unicode text, UTF-8 text, with very long lines (65481)
Size 399 kB (398927 bytes)
Hash 2fcae8126c3fd9a626370a701f0bd887
f3496fb7bbe122a9774d7dcfcd68da03a24dc285
d29ab86f64b4fcfbc45b9ef806c147f1e42e37e37d44a559147232288063badc
GET /js/base2.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-6164f"
expires: Thu, 28 Dec 2023 19:55:29 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 398927
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/logo.png
200 OK 3.6 kB URL GET HTTP/2 static.depositfiles.com/images/logo.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 176 x 43, 8-bit/color RGBA, non-interlaced
Hash c41fdd84b04e45a91cb17cfdeccb1b38
fec7fffe104c7e169aeb159032078c4b71ff2cdc
7f89eb8ab03684f4db282ca30eb231b1e254bca10c7b511950df5e0eab0a68a0
GET /images/logo.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-e27"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 3623
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/member_menu_bg.gif
200 OK 78 B URL GET HTTP/2 static.depositfiles.com/images/member_menu_bg.gif
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type GIF image data, version 89a, 1 x 48
Hash 20a24b56dcedf6a71a71ebec771e1f7d
d7bed493d5d4eeaed5dbbf7d30d45107840790a0
6f57f29224d8e9e51ed0839e329055426fba7dcd97ef31e93ed495f93a6063df
GET /images/member_menu_bg.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-4e"
expires: Tue, 02 Jan 2024 19:50:30 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 78
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/sprite.png
200 OK 37 kB URL GET HTTP/2 static.depositfiles.com/images/sprite.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 102 x 630, 8-bit/color RGBA, non-interlaced
Hash 2333675d7e431d5313c6dbb5230a14cd
93c4032e5b8b85793a9cda7167804445d950dd96
b287134a60667ce8e2c3fa1603e3a8f2ffa59c64e746d026d1a13ef19f3f38a0
GET /images/sprite.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-8fc2"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 36802
X-Firefox-Spdy: h2
GET www.google.com/recaptcha/api.js
200 OK 1.0 kB URL GET HTTP/2 www.google.com/recaptcha/api.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint50:3E:DA:12:EC:7F:39:A5:E9:4F:16:D7:D6:AA:BF:45:15:44:7F:E9
ValidityMon, 20 Nov 2023 08:09:47 GMT - Mon, 12 Feb 2024 08:09:46 GMT
Hash dba59e2f68f69b94a83aa87ce626fdbd
80625c384c8a3a27b569c9f33be4592ca7396ee5
6544f04b3894427490fbbc496796513996e6a28c68eb954232477287a6c13f71
GET /recaptcha/api.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Thu, 28 Dec 2023 19:50:29 GMT
date: Thu, 28 Dec 2023 19:50:29 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/sprite64.png
200 OK 29 kB URL GET HTTP/2 static.depositfiles.com/images/sprite64.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 64 x 1088, 8-bit/color RGBA, non-interlaced
Hash e50649ecf6a2094c25da755ea0ea7bd1
e1c3e229a62f049442fa16cf43ec07f384b27362
a9ed59ab3bbcfdf66224664aeb14fa0f0e8f034d8472a58dadcf65cfff17685d
GET /images/sprite64.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-704b"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 28747
X-Firefox-Spdy: h2
GET cdn.unblockia.com/h.js
200 OK 44 kB IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (65536), with no line terminators
Hash bc5af0220c4116294c4e9c72ae4e244c
f03f6753bcdfdedf4475b83022003b01a02fbde0
b7d2974070cf9f476d97e4401209a440e8fee787781d9084655cca366dad4d21
GET /h.js HTTP/1.1
Host: cdn.unblockia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript
date: Wed, 27 Dec 2023 20:31:53 GMT
last-modified: Tue, 20 Jun 2023 10:06:46 GMT
etag: W/"bc5af0220c4116294c4e9c72ae4e244c"
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-content-sha256: 02f1ef29ead1d705cce351046cded37a79615ae12624547bfa0e8307765c8765
x-amz-version-id: m8vKRZ4OANVjVfMIKL3cKYiXKt6EM9QQ
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:987257285531:build/unblockia-loader-codebuild-project:4e52eb3f-761b-4c10-a85a-162fb4fa3980
x-amz-meta-codebuild-content-md5: fb4d4b7b1d35720e2d2481016ef4369b
server: AmazonS3
content-encoding: br
x-cache: Hit from cloudfront
via: 1.1 1ca0323262515c9240c58fe69a9ac826.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 8vqWxLFiQCXrZ37hS_Bs351Dh7nXudDbsHKE7HEhNyc5RY8b2MyxvQ==
age: 83917
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/flags/lang24.png
200 OK 9.2 kB URL GET HTTP/2 static.depositfiles.com/images/flags/lang24.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 24 x 552, 8-bit/color RGBA, non-interlaced
Hash efdcd1ca23d564ddd811f41152a2b83c
0b5aa064e7f8f241363c55fa17eb448f42a5f8df
ce23be242e34c5b420f8ba0390aef20fa50ffc69f700091029616eff524e8f9b
GET /images/flags/lang24.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-23d4"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 9172
X-Firefox-Spdy: h2
GET proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 8fff09c4bc27ab914a73f31163db7df7
3926612dfa468cb17f67b3ef0da14ca6774a5705
efd18e509567963927bcebe569dbe828be987763ae3c112b3ba91f430a35b5bc
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:30 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=17e5dc9f-70a9-4572-926c-cf8e2892a8b4:1:1; expires=Sun, 25 Dec 2033 19:50:30 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/sprite16.png
200 OK 28 kB URL GET HTTP/2 static.depositfiles.com/images/sprite16.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 32 x 1072, 8-bit/color RGBA, non-interlaced
Hash 2e86fe2d2c2650c5f4663f0fc135ebc1
ba86e14a9abcff0581eda84a307594ef1288b982
604187f8828381a47ae70249f55f21c78c53ab1401d20a5f2230a0d6c9ae50d1
GET /images/sprite16.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-6f55"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 28501
X-Firefox-Spdy: h2
GET loader.unblockia.com/c/dfiles.eu/config.json
200 OK 47 kB URL GET HTTP/2 loader.unblockia.com/c/dfiles.eu/config.json
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type ASCII text, with very long lines (46747), with no line terminators
Hash f365c1e4619a90bbadadacf55598fe90
1623c939b72aecd3831e1da35e4c0a5229383e91
23e2e4d868bb2652b97e9e13d36df1dfeeba338d4e9c4d1d737fba6b2b2b2d52
GET /c/dfiles.eu/config.json HTTP/1.1
Host: loader.unblockia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dfiles.eu/
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
content-length: 46747
date: Wed, 27 Dec 2023 20:38:22 GMT
last-modified: Fri, 09 Jun 2023 09:20:17 GMT
etag: "f365c1e4619a90bbadadacf55598fe90"
x-amz-server-side-encryption: AES256
x-amz-version-id: trENJHq0I9QxpCJnwtrkDFWJYsxIhjKV
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: G1ldUVun0nWumrCTPGHZFmegwFuyl5ypb5heApFV1fThO0O1lAs_rw==
age: 83529
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2
GET static.depositfiles.com/css/main.css
200 OK 133 kB URL GET HTTP/2 static.depositfiles.com/css/main.css
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type gzip compressed data, max speed, from Unix
Size 133 kB (132819 bytes)
Hash 7581a05632325e3b9f9915af9c8488cf
bd0765945bf8b0b7346a6fdacec37ca1cfcfb197
14ec08f0012f228f17d05d294dcdc088b3ae63f56edd165b996b046e07e5bdc1
GET /css/main.css HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: max-age=300
content-encoding: gzip
content-type: text/css
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: W/"6545effd-2f784"
expires: Thu, 28 Dec 2023 19:55:29 GMT
last-modified: Sat, 04 Nov 2023 07:17:17 GMT
server: nginx
X-Firefox-Spdy: h2
85 kB URL adsbb.dfiles.eu/static/js/jquery-1.5.1.min.js
IP
File type Unicode text, UTF-8 text, with very long lines (65168)
Hash b04a3bccd23ddeb7982143707a63ccf9
4a5dc1389aad050a44ee5e81408238a317ab3413
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
GET /static/js/jquery-1.5.1.min.js HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025; _nf56=1; _nf58=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: no-cache, private, no-cache, no-store, must-revalidate
content-type: application/javascript
date: Thu, 28 Dec 2023 19:50:31 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache
server: nginx
content-length: 85260
X-Firefox-Spdy: h2
GET adsbb.dfiles.eu//ad.php?z=58&c=NO&g=gateway
303 See Other 579 B URL GET HTTP/2 adsbb.dfiles.eu//ad.php?z=58&c=NO&g=gateway
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
FingerprintCC:57:A8:99:82:65:9E:AE:6B:7C:68:C0:CE:7C:F7:6F:A8:6B:23:E0
ValiditySun, 05 Nov 2023 13:34:41 GMT - Sat, 03 Feb 2024 13:34:40 GMT
Hash 0bb9c6e874901156bf0a0dbcf7f36553
836c18d0d2422f34857133d976d3a5001b0c5f65
761dd4e9b4acfa5254039af128e2581badd9568fc8a2558ade0ca36893c602fd
GET //ad.php?z=58&c=NO&g=gateway HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 303 See Other
content-security-policy: frame-ancestors depositfiles.com depositfiles.org dfiles.eu dfiles.com web-301.dfiles.eu web-302.dfiles.eu web-303.dfiles.eu web-304.dfiles.eu
content-type: text/html; charset=UTF-8
date: Thu, 28 Dec 2023 19:50:30 GMT
location: /upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
server: nginx
set-cookie: _nf58=1; expires=Fri, 29-Dec-2023 19:50:30 GMT; Max-Age=86400
x-powered-by: PHP/5.6.40
X-Firefox-Spdy: h2
43 B URL adsbb.dfiles.eu/view.gif?c=2685&z=56&b=2758&u=658dd16922f375327338222897054
IP
File type GIF image data, version 89a, 1 x 1
Hash 6d22e4f2d2057c6e8d6fab098e76e80f
b80b11203d97fe01c5597ca3be70406ea48f5709
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
GET /view.gif?c=2685&z=56&b=2758&u=658dd16922f375327338222897054 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025; _nf56=1; _nf58=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: no-cache, private, no-cache, no-store, must-revalidate
content-type: image/gif
date: Thu, 28 Dec 2023 19:50:31 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache
server: nginx
content-length: 43
X-Firefox-Spdy: h2
43 B URL adsbb.dfiles.eu/view.gif?c=2973&z=58&b=2775&u=658dd169ca90a9540154435237673
IP
File type GIF image data, version 89a, 1 x 1
Hash 6d22e4f2d2057c6e8d6fab098e76e80f
b80b11203d97fe01c5597ca3be70406ea48f5709
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
GET /view.gif?c=2973&z=58&b=2775&u=658dd169ca90a9540154435237673 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025; _nf56=1; _nf58=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: no-cache, private, no-cache, no-store, must-revalidate
content-type: image/gif
date: Thu, 28 Dec 2023 19:50:31 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache
server: nginx
content-length: 43
X-Firefox-Spdy: h2
GET friendshipmale.com/sfp.js
200 OK 27 kB URL GET HTTP/3 friendshipmale.com/sfp.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Hash 924e967bca1d599992556a8d139b1c5a
222b09dbf164ddc03d39100fd0524a22018d28b2
ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:30 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 364fd355005ffebbbe8c39330c3c37bc
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Thu, 28 Dec 2023 19:50:30 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eYhvaCBWbV2vfncreKxuCOLzqllv4RdXQgpmEqpQ%2FUASauthL054TuvdIjvT49xbBbhypySKui11ca5gZ%2FmsTAz%2FPwcdVobasc2HzRNICz1RQtXW0EaoQyx1rXtRaKFhGKiueDM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83cc552a290b0639-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
43 B URL c.mgid.com/pv/?lu=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fqabuajtj6%2FCOD-WAW_patch_and-PB.exe&cbuster=1703793026923580049123&pvid=18cb1fa676a9f6ea84c&implVersion=11&cxurl=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fqabuajtj6%2FCOD-WAW_patch_and-PB.exe&site=437&i=1
IP
File type GIF image data, version 89a, 1 x 1
Hash 57f187c7a868faeac558007a8eb6cb2e
11ab10ab109fdb53d91d444ac781101f5a6360c6
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
GET /pv/?lu=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fqabuajtj6%2FCOD-WAW_patch_and-PB.exe&cbuster=1703793026923580049123&pvid=18cb1fa676a9f6ea84c&implVersion=11&cxurl=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fqabuajtj6%2FCOD-WAW_patch_and-PB.exe&site=437&i=1 HTTP/1.1
Host: c.mgid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adsbb.dfiles.eu/
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=NHgZvBApgK0flS44z.0vaiCZtJjsZBRfZcgK9OVzlPM-1703793031-1-AcztD6XHo/WpxxUiCn4QODAFhO4Wap8NRB7Uk7c/9tHI4f3pC8hKAm+XY0R+64107N/yMxSInJNg9Y5yFgrHPpw=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Dec 2023 19:50:31 GMT
content-type: image/gif
content-length: 43
cf-cache-status: DYNAMIC
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
cf-ray: 83cc552e8af156af-OSL
alt-svc: h3=":443"; ma=86400
GET eventuallypropagandametal.com/c2/2d/c5/c22dc50dc2bbe4422c7f68d26ab95eb9.js
200 OK 25 kB URL GET HTTP/1.1 eventuallypropagandametal.com/c2/2d/c5/c22dc50dc2bbe4422c7f68d26ab95eb9.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
File type ASCII text, with very long lines (62716), with no line terminators
Hash b8ccd3c54c78a4dd2a64628f6863c3c1
26fb9f788acbf3a7d27c146ca06b9f29eef32f08
6317528fea4a137a9fa6fbf3d6d6d014488b7fbb960190cd9916b9c924b7d5a1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /c2/2d/c5/c22dc50dc2bbe4422c7f68d26ab95eb9.js HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:31 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: 4b4e7ab587d59b22ad7bcd2439afc363_FEATURES-1671-new=1; expires=Fri, 12 Jan 2024 19:50:31 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 352d840f5d0a9e25fb4ebdfed3033767
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
GET proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 8fff09c4bc27ab914a73f31163db7df7
3926612dfa468cb17f67b3ef0da14ca6774a5705
efd18e509567963927bcebe569dbe828be987763ae3c112b3ba91f430a35b5bc
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uid_id2=17e5dc9f-70a9-4572-926c-cf8e2892a8b4:1:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:31 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
GET eventuallypropagandametal.com/sbar.json?key=224ad4a14b4b15c1726ff705ec672ea6
200 OK 4.0 kB URL GET HTTP/1.1 eventuallypropagandametal.com/sbar.json?key=224ad4a14b4b15c1726ff705ec672ea6
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
Hash 970af81afeb4941107e8e074dcc4bb49
5883e0f8a0dbdb1c2b7e1968c3bd9a2779a6637a
352ea139772c2b45089a2611e1d84d380296bf49353700707bc3bf2a300908c1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=224ad4a14b4b15c1726ff705ec672ea6 HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:31 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://dfiles.eu
Access-Control-Allow-Origin: https://dfiles.eu
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=16004719; expires=Fri, 29 Dec 2023 19:50:31 GMT; secure; SameSite=None
pdhtkv=true; expires=Fri, 29 Dec 2023 19:50:31 GMT; secure; SameSite=None
uncs=1; expires=Fri, 29 Dec 2023 19:50:31 GMT; secure; SameSite=None
pdhtkv29=true; expires=Fri, 29 Dec 2023 19:50:31 GMT; secure; SameSite=None
uncs29=1; expires=Fri, 29 Dec 2023 19:50:31 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ba40477f1a1606f4c5cd5823b919cc79
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
GET static.depositfiles.com/images/favicon.ico
200 OK 318 B URL GET HTTP/2 static.depositfiles.com/images/favicon.ico
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type MS Windows icon resource - 1 icon, 16x16, 16 colors, 4 bits/pixel
Hash 0f0b975ee529197ec75780ebc2de5907
59688c6aafca5606e388ba9a44fc9dc25fc32cd3
28a0b52229f05b66354ca38b6b813d2281af3efb7e8b0a424ef8b4c68b9e583c
GET /images/favicon.ico HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/x-icon
date: Thu, 28 Dec 2023 19:50:31 GMT
etag: "651c240d-13e"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 318
X-Firefox-Spdy: h2
GET proudlyconvict.com/pixel/purst?dl=0&th=0&sc=0&rs=2764&rd=2764&fd=838&bv=23.12.v.9&tmpl=136
200 OK 0 B URL GET HTTP/1.1 proudlyconvict.com/pixel/purst?dl=0&th=0&sc=0&rs=2764&rd=2764&fd=838&bv=23.12.v.9&tmpl=136
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectproudlyconvict.com
FingerprintA9:5E:17:D2:58:39:42:BA:25:97:D3:B0:F1:DC:0C:57:E7:F9:A7:9B
ValidityFri, 15 Dec 2023 10:18:00 GMT - Thu, 14 Mar 2024 10:17:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=2764&rd=2764&fd=838&bv=23.12.v.9&tmpl=136 HTTP/1.1
Host: proudlyconvict.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:31 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
GET www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js
200 OK 206 kB URL GET HTTP/2 www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type ASCII text, with very long lines (647)
Size 206 kB (205927 bytes)
Hash 37c6af40dd48a63fcc1be84eaaf44f05
1d708ace806d9e78a21f2a5f89424372e249f718
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24
GET /recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 205927
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 27 Dec 2023 19:43:04 GMT
expires: Thu, 26 Dec 2024 19:43:04 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 11 Dec 2023 05:01:12 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 86847
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
96 kB URL jsc.mgid.com/d/e/depositfiles.com.7998.es6.js
IP
File type HTML document, ASCII text, with very long lines (50989)
Hash b7b93b7d1b20eedb4555c99c2e0300e5
688946b89408c856fca93024d446be5b455a4401
0fc611399ef043d18872084f62dfba418438382ec82f1621747d6307b97efafa
GET /d/e/depositfiles.com.7998.es6.js HTTP/1.1
Host: jsc.mgid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://adsbb.dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Dec 2023 19:50:31 GMT
content-type: text/javascript
cf-bgj: minify
cf-polished: origSize=321475
etag: W/"ae5deafb4ffc2eca3ce17b637f2f9ed5"
last-modified: Tue, 19 Dec 2023 11:18:23 GMT
x-amz-id-2: MZ8Zih58NgEQlrM8DQ5v4dTHqzsOaeE5HFAL0IKRHcvFvT3vmlOrIQytkSp2JXlwS9xfeurUCLEBAnZvBLvXuRJpUIareaJN0CtGY/hE3PI=
x-amz-request-id: NCE1N3WMHSMC0B0D
x-amz-server-side-encryption: AES256
x-amz-version-id: 5XzMN9s5MWk.50L_a80OSRQFTYusZF6i
cf-cache-status: HIT
age: 1821
expires: Thu, 28 Dec 2023 22:50:31 GMT
cache-control: public, max-age=10800
set-cookie: __cf_bm=BsojRhMWEVgW4rju7aMYiHL4m7QS3pwU5Pe4kUFu5oo-1703793031-1-AV/Gjv8/AD8lEEMsdjztfoyj4uRNzvnv9X0VQ6F4NrVfdqeDZzI9ke9dKBk1BOYsLFlyCzzgEjPIyeYlbaqX63c=; path=/; expires=Thu, 28-Dec-23 20:20:31 GMT; domain=.mgid.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
server: cloudflare
cf-ray: 83cc552ddd0b7130-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET proftrafficcounter.com/stats
200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 8fff09c4bc27ab914a73f31163db7df7
3926612dfa468cb17f67b3ef0da14ca6774a5705
efd18e509567963927bcebe569dbe828be987763ae3c112b3ba91f430a35b5bc
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uid_id2=17e5dc9f-70a9-4572-926c-cf8e2892a8b4:1:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
GET cdn.unblockia.com/autopromos/unicef2.jpg?unblockia=true
200 OK 37 kB URL GET HTTP/2 cdn.unblockia.com/autopromos/unicef2.jpg?unblockia=true
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 728x90, components 3
Hash 58fbb6ffe72ac0c1aa468de39ee18e13
d25230f1ef89aecc6048b0ceb09dd0af609ee7b6
e8ff7f3a8926e5b5497d2ab7a1bf47c5655e287a51045f11846f426ac6c7d180
GET /autopromos/unicef2.jpg?unblockia=true HTTP/1.1
Host: cdn.unblockia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 36773
date: Wed, 27 Dec 2023 20:31:54 GMT
last-modified: Tue, 12 Apr 2022 08:41:28 GMT
etag: "58fbb6ffe72ac0c1aa468de39ee18e13"
x-amz-version-id: xUurxjfnscsyJn430NFsrgfbabIFowSl
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 1ca0323262515c9240c58fe69a9ac826.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: b8VqFt2o2U1uYC-07dudhlgwuSqyQRZLsmJL5AvG9XyCZWH4Mju2nQ==
age: 83919
vary: Origin
X-Firefox-Spdy: h2
GET cdn.unblockia.com/autopromos/unicef3.jpg?unblockia=true
200 OK 54 kB URL GET HTTP/2 cdn.unblockia.com/autopromos/unicef3.jpg?unblockia=true
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 160x600, components 3
Hash 5dcf47442fc7fbb8d0263bbf4869537e
2c8232ac93448bbc06b5464f1839a5cdb2ed3e07
81804a1b2b20350ec009ba6429a4f58124c16ca30683af0af255544cd98c8fa6
GET /autopromos/unicef3.jpg?unblockia=true HTTP/1.1
Host: cdn.unblockia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 54292
date: Wed, 27 Dec 2023 20:32:22 GMT
last-modified: Tue, 12 Apr 2022 08:41:27 GMT
etag: "5dcf47442fc7fbb8d0263bbf4869537e"
x-amz-version-id: iA22.ytP0i4dmuIhnc0eyNVgJlt2K4fl
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 1ca0323262515c9240c58fe69a9ac826.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: nL5qkulkjKLxbF92APdCxiqI23Vv5PXrko3bQZzbYYOezWx7fWUBiQ==
age: 83891
vary: Origin
X-Firefox-Spdy: h2
GET eventuallypropagandametal.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skxR%2Bt3u9%2B96KXVS%2BCyhwVdNLd0zOTcQ9iXCPBmMT9QfBYv3pSprqrqeqenuQUXNC9COOePHbeJBvURXb%2FAEE6XmRByOxBgph%2FQtmzzGRg9APdn%2Fc%2Brw7vfaq%2BPCwuSICCnm99YvaV1nSp3fQbb26rVJjSNTbuNAK%2F6d9obKu0E91oDKc%2FO3g38NtN%2F63GR5LvmqXQD3w%2F8IPGqrIyNsOlmQqVPeoFzZ7fjMJm0I4wtP%2FlrvDgqAcxuCAvQYnJ%2F3d%2BfQLFa6TJ45vS7eYme%2FvDpNA0NxYDcXI33U1NmSJZwNh6iNOT%2BWkYNyHk2ysw6ck8AczgaJoATE2I93sAlp7MbYINji%2BdMg2ZgokXUA5qSF1D0Rrc3IMSZwTgAhubSJOHG8aWdO9SpVN1Qq4%2B%2FwuqnJCrf76CNPlxRath47bRRa5M6jCMK6hhDdWvkRWnyPc9qPIUPP8CSvxGlp6vI02ONp02UKKapVeqhopraDkCdR6K6ac8FLGHIvOQiPMGbfdi3%2B%2FGLG61liPOeavFeXu5I9qiFS3HPgo%2BtTdCno3A9QjcHiCzB9hVI9jiZ7idCk54cPmEeJ8eYCAqlJKgdAQlJSgVQZkTlIPqWGgXuuqh0K5gwbyH896qxibvH9Jjk%2FdlSkDt6DC7INdnu%2Fm7Y7ArzxthGFER0SBiEQvaPOiGnTju%2Bm3JO91Q0g6cqqDclVncfXX2coZMnb34Ghg9hdOn4Oo6aPE6aDnuhj7ozjha9rGfPhYyM07lsdLSNblJIEyFLL%2BKfM871Bfk1ZmP3rMHkPwpmRe4rZDZCp%2BrXwj6%2Bv74linJ0S1TOvJkM8tVovbp9P5u5zSX177%2FWO6Vxoq1m2703ft8KkzhozvS5es0FSrtO%2FLDihJC2lVjuSQ%2FrbltybYKt7NS2LTI1rc%2BWF1LMiudUyatQdXZZw%2FA1YRco3dnL%2FONP96BsjVsUSEpFk6VqcGzA7hsMXOGwOoFZ5mHsqjGNmSLoVYEWi44ZRXcvzhb4EN3H33rgeb3kCYVBrbCQFegegRX%2FG%2BcZ%2Fbpe89aswLT3php6x0xbfU3l6t16rwh27EfSz%2BULO6xuEt90YujHqO9QHZZmwbI3UR%2BffbVPwAAAP%2F%2FAQAA%2F%2F87UDDAcQQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 eventuallypropagandametal.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skxR%2Bt3u9%2B96KXVS%2BCyhwVdNLd0zOTcQ9iXCPBmMT9QfBYv3pSprqrqeqenuQUXNC9COOePHbeJBvURXb%2FAEE6XmRByOxBgph%2FQtmzzGRg9APdn%2Fc%2Brw7vfaq%2BPCwuSICCnm99YvaV1nSp3fQbb26rVJjSNTbuNAK%2F6d9obKu0E91oDKc%2FO3g38NtN%2F63GR5LvmqXQD3w%2F8IPGqrIyNsOlmQqVPeoFzZ7fjMJm0I4wtP%2FlrvDgqAcxuCAvQYnJ%2F3d%2BfQLFa6TJ45vS7eYme%2FvDpNA0NxYDcXI33U1NmSJZwNh6iNOT%2BWkYNyHk2ysw6ck8AczgaJoATE2I93sAlp7MbYINji%2BdMg2ZgokXUA5qSF1D0Rrc3IMSZwTgAhubSJOHG8aWdO9SpVN1Qq4%2B%2FwuqnJCrf76CNPlxRath47bRRa5M6jCMK6hhDdWvkRWnyPc9qPIUPP8CSvxGlp6vI02ONp02UKKapVeqhopraDkCdR6K6ac8FLGHIvOQiPMGbfdi3%2B%2FGLG61liPOeavFeXu5I9qiFS3HPgo%2BtTdCno3A9QjcHiCzB9hVI9jiZ7idCk54cPmEeJ8eYCAqlJKgdAQlJSgVQZkTlIPqWGgXuuqh0K5gwbyH896qxibvH9Jjk%2FdlSkDt6DC7INdnu%2Fm7Y7ArzxthGFER0SBiEQvaPOiGnTju%2Bm3JO91Q0g6cqqDclVncfXX2coZMnb34Ghg9hdOn4Oo6aPE6aDnuhj7ozjha9rGfPhYyM07lsdLSNblJIEyFLL%2BKfM871Bfk1ZmP3rMHkPwpmRe4rZDZCp%2BrXwj6%2Bv74linJ0S1TOvJkM8tVovbp9P5u5zSX177%2FWO6Vxoq1m2703ft8KkzhozvS5es0FSrtO%2FLDihJC2lVjuSQ%2FrbltybYKt7NS2LTI1rc%2BWF1LMiudUyatQdXZZw%2FA1YRco3dnL%2FONP96BsjVsUSEpFk6VqcGzA7hsMXOGwOoFZ5mHsqjGNmSLoVYEWi44ZRXcvzhb4EN3H33rgeb3kCYVBrbCQFegegRX%2FG%2BcZ%2Fbpe89aswLT3php6x0xbfU3l6t16rwh27EfSz%2BULO6xuEt90YujHqO9QHZZmwbI3UR%2BffbVPwAAAP%2F%2FAQAA%2F%2F87UDDAcQQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skxR%2Bt3u9%2B96KXVS%2BCyhwVdNLd0zOTcQ9iXCPBmMT9QfBYv3pSprqrqeqenuQUXNC9COOePHbeJBvURXb%2FAEE6XmRByOxBgph%2FQtmzzGRg9APdn%2Fc%2Brw7vfaq%2BPCwuSICCnm99YvaV1nSp3fQbb26rVJjSNTbuNAK%2F6d9obKu0E91oDKc%2FO3g38NtN%2F63GR5LvmqXQD3w%2F8IPGqrIyNsOlmQqVPeoFzZ7fjMJm0I4wtP%2FlrvDgqAcxuCAvQYnJ%2F3d%2BfQLFa6TJ45vS7eYme%2FvDpNA0NxYDcXI33U1NmSJZwNh6iNOT%2BWkYNyHk2ysw6ck8AczgaJoATE2I93sAlp7MbYINji%2BdMg2ZgokXUA5qSF1D0Rrc3IMSZwTgAhubSJOHG8aWdO9SpVN1Qq4%2B%2FwuqnJCrf76CNPlxRath47bRRa5M6jCMK6hhDdWvkRWnyPc9qPIUPP8CSvxGlp6vI02ONp02UKKapVeqhopraDkCdR6K6ac8FLGHIvOQiPMGbfdi3%2B%2FGLG61liPOeavFeXu5I9qiFS3HPgo%2BtTdCno3A9QjcHiCzB9hVI9jiZ7idCk54cPmEeJ8eYCAqlJKgdAQlJSgVQZkTlIPqWGgXuuqh0K5gwbyH896qxibvH9Jjk%2FdlSkDt6DC7INdnu%2Fm7Y7ArzxthGFER0SBiEQvaPOiGnTju%2Bm3JO91Q0g6cqqDclVncfXX2coZMnb34Ghg9hdOn4Oo6aPE6aDnuhj7ozjha9rGfPhYyM07lsdLSNblJIEyFLL%2BKfM871Bfk1ZmP3rMHkPwpmRe4rZDZCp%2BrXwj6%2Bv74linJ0S1TOvJkM8tVovbp9P5u5zSX177%2FWO6Vxoq1m2703ft8KkzhozvS5es0FSrtO%2FLDihJC2lVjuSQ%2FrbltybYKt7NS2LTI1rc%2BWF1LMiudUyatQdXZZw%2FA1YRco3dnL%2FONP96BsjVsUSEpFk6VqcGzA7hsMXOGwOoFZ5mHsqjGNmSLoVYEWi44ZRXcvzhb4EN3H33rgeb3kCYVBrbCQFegegRX%2FG%2BcZ%2Fbpe89aswLT3php6x0xbfU3l6t16rwh27EfSz%2BULO6xuEt90YujHqO9QHZZmwbI3UR%2BffbVPwAAAP%2F%2FAQAA%2F%2F87UDDAcQQAAA%3D%3D HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:32 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 91bb8157fec3769301a2d8f7b04d0150
Strict-Transport-Security: max-age=0; includeSubdomains
POST t.unblockia.com/?sid=140&o=1&b=2&p=1&t=1
200 OK 0 B URL POST HTTP/2 t.unblockia.com/?sid=140&o=1&b=2&p=1&t=1
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /?sid=140&o=1&b=2&p=1&t=1 HTTP/1.1
Host: t.unblockia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
content-type: application/json
content-length: 0
server: nginx/1.20.0
date: Thu, 28 Dec 2023 19:50:32 GMT
x-cache: Miss from cloudfront
via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: gqCW0ovE5UkJVVa0rInCig9XOjU9p3lsS9eB6SV1niXSz6S4ScfOlw==
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2
GET cdn.barscreative1.com/sb/notifications/utility/default/us/celeb/banner/12/index.html
200 OK 808 B URL GET HTTP/2 cdn.barscreative1.com/sb/notifications/utility/default/us/celeb/banner/12/index.html
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
Fingerprint55:06:B7:F1:EF:E9:55:FB:7C:8C:4F:5D:DB:05:C9:15:19:90:9B:2F
ValiditySat, 11 Nov 2023 03:00:51 GMT - Fri, 09 Feb 2024 03:00:50 GMT
File type HTML document, ASCII text
Hash 479631bbf13737ea16bec96fedd8030c
6831f74b1e17305d8afbb2749bf1e8dd68cbdda5
4b69e3b2b813ba96427ade4bc7c4e63826e0151028339925b958e56f83a7db23
GET /sb/notifications/utility/default/us/celeb/banner/12/index.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: text/html; charset=utf-8
content-length: 808
server: nginx/1.21.6
last-modified: Fri, 19 Mar 2021 12:47:30 GMT
etag: "60549d62-328"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
expires: Thu, 28 Dec 2023 20:50:32 GMT
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
POST fp.metricswpsh.com/fp?tag_id=46445
200 OK 0 B URL POST HTTP/1.1 fp.metricswpsh.com/fp?tag_id=46445
IP
ASN #24940 Hetzner Online GmbH
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectnotification.tubecup.net
FingerprintE7:2D:CB:0A:CB:E2:2E:6F:4D:85:28:A3:20:67:7E:03:17:69:CA:5F
ValidityTue, 19 Dec 2023 09:11:26 GMT - Mon, 18 Mar 2024 09:11:25 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /fp?tag_id=46445 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://dfiles.eu/
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx/1.20.1
Date: Thu, 28 Dec 2023 19:50:32 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: https://dfiles.eu
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Findex.html&l=808&fd=216
200 OK 0 B URL GET HTTP/1.1 eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Findex.html&l=808&fd=216
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Findex.html&l=808&fd=216 HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:32 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
POST fp.metricswpsh.com/fp?tag_id=46445
200 OK 58 B URL POST HTTP/1.1 fp.metricswpsh.com/fp?tag_id=46445
IP
ASN #24940 Hetzner Online GmbH
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectnotification.tubecup.net
FingerprintE7:2D:CB:0A:CB:E2:2E:6F:4D:85:28:A3:20:67:7E:03:17:69:CA:5F
ValidityTue, 19 Dec 2023 09:11:26 GMT - Mon, 18 Mar 2024 09:11:25 GMT
Hash 49cb75c0da6be8cc97daea0ae2498649
1dd230c3f22a2308b9c091fe1e952b5e8d44bc88
3f61f6927c8c29196e623750a164dcd6895cc2dc3a592ccc5d755b3d4d407841
POST /fp?tag_id=46445 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 1774
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Thu, 28 Dec 2023 19:50:32 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://dfiles.eu
Set-Cookie: id=15147899055201855816; Expires=Fri, 27 Dec 2024 19:50:32 GMT; Secure; SameSite=None
Vary: Origin
GET cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/img/bg.jpg
200 OK 19 kB URL GET HTTP/3 cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/img/bg.jpg
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint49:C8:A4:CE:31:56:FC:06:71:93:06:7A:69:DD:ED:B2:EF:C9:41:97
ValidityTue, 19 Dec 2023 15:02:46 GMT - Mon, 18 Mar 2024 15:02:45 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x240, components 3
Hash cf88b9ba71fc316afb93ce75ca7cef63
468dbf529fa0ee172338b39f31ab09281bd0e527
d41f951fd3f93edc06d5601d42de46896b3702e455661880ca001c2027535ae3
GET /sb/notifications/utility/default/us/celeb/banner/12/img/bg.jpg HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: image/jpeg
content-length: 19108
last-modified: Mon, 01 Aug 2022 08:01:16 GMT
etag: "62e7884c-4aa4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2096726
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aeKjWUn%2FPKWpEz9NNrAeTADJ5P9DTlU%2F93gga7l9%2FZZEz4JIXEQ6UAJNEZyfvrKEC2528W5TuOoaGtG89MRJf6Qk3CjrR%2BSKmwAc0On%2FLivOjMaNjbrma%2FziE4QbfQt0ED4LGuJ3fJbs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83cc553658d477b1-LHR
alt-svc: h3=":443"; ma=86400
GET cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/img/close.png
200 OK 12 kB URL GET HTTP/3 cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/img/close.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint49:C8:A4:CE:31:56:FC:06:71:93:06:7A:69:DD:ED:B2:EF:C9:41:97
ValidityTue, 19 Dec 2023 15:02:46 GMT - Mon, 18 Mar 2024 15:02:45 GMT
File type PNG image data, 497 x 496, 8-bit/color RGBA, non-interlaced
Hash a49f999d6a97f16d87d1244c79bf9063
2b4b33bdbc5e17284d2440b3ea0d9178da2c7993
58cdd3cc1b49f0e4ea0a650097aee4a75a1f6caf6cf6929f78abdffb29d9ecd4
GET /sb/notifications/utility/default/us/celeb/banner/12/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: image/png
content-length: 12531
last-modified: Fri, 19 Mar 2021 12:47:33 GMT
etag: "60549d65-30f3"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2096726
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vBNj02uFngCNIMSxZnQNR9wCtmDm4oyRKTDEVXWrdNq3GrjFc0e2R8h5wIQKhmDZWRpj0Ztwu0Uq8zLpeX%2BXaTq0JRf6rfWED3CQBXFNSm0UZYDRwQstyYBMZ%2BIcUbmFDs2aenonieVU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83cc553658d877b1-LHR
alt-svc: h3=":443"; ma=86400
GET eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fjs%2Fscript.js&l=385&fd=90
200 OK 0 B URL GET HTTP/1.1 eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fjs%2Fscript.js&l=385&fd=90
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fjs%2Fscript.js&l=385&fd=90 HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:32 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
GET eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fcss%2Fanimate.css&l=79249&fd=107
200 OK 0 B URL GET HTTP/1.1 eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fcss%2Fanimate.css&l=79249&fd=107
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fcss%2Fanimate.css&l=79249&fd=107 HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:32 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
GET eventuallypropagandametal.com/pixel/sbs?c=1
200 OK 0 B URL GET HTTP/1.1 eventuallypropagandametal.com/pixel/sbs?c=1
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:33 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
GET eventuallypropagandametal.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRitXuNe9LLqRVDpo4JOunt6frkHMa6RYEzi%2FiB4rK6qnpSp7mqquqcnOQUXdC%2FCuCePnTfJBnWR3T9AkI4XWRAye5Ag5p9Q9iwzGRj3g%2B7vve%2FV4b2v6uvD4oL4KOj51md6XypFl1sNz317W6Zcl9bduO36XsO77m7LtB1ed4fTnxm873uthveO%2B4lgu3o58HzP8z3fXZVGxHq4PFMhs4c9v9HzGmHQ8FshhuZ5bgsHljrggwvyCiSfvLjz%2B2NIViNNHt0QdjfX2bsfJ4WiuTYY8JM76W6qyxTJAsbGQZyezE9D2wkh31%2BBTk%2FmCaAHR9MEiOSEOH%2F6iNKTuU1Eg%2BNLp5GCSBHxl1AOaghVQ9IaTN%2BF5GcEYBwbm0iTBxvalHTvUqVTdUKWnv0DWU7I0t%2BvIU1%2BXlFy6N7SqsilTi2GcQU5rCH7NbLiFPm%2BA1meguVfQfI%2FyPKzdaTJ0aZVGpJXs%2FRS1pBxDSVGoNZBMf2kgyJ2UGQOEn7u0lYv9rxOHMXNZjdkjDWbjLW6bd7izbAbeyjY1N4IeTYCUyMwc4DMHGBXjmCKX2F3KljuwOYT4nx%2BgAGvUAqC0hKUlKCUBGVOUA6qY65sYKsHXNki8uc9mPdmNdZ5%2F5Ae67wvUgJqRofZBbk2282%2FbY1dce4GQUh5SP0wCiO%2FxfxO0I7jjtcSrN0JBG3DygrSXpnF3Zdnr2bI5NnLbyCip7DqFExeAy3eBC3HncAD3RmHXQ%2F76SMuMm1lHkslbIPpBFxXyPIl5HvOobogr8989J7eh2BPyLzATIXMVPhS%2FkbQV%2FfGN3VJjm7q0pLHm1kuE7lPp%2Fd3K6e5uPrjp2Kv1Iav3bCjHz5kU2EKH94WNl%2BnKZdp35KfViTnwqxqwwT5Zc1ui2irsDsrhUmLbH3ro9W1JDPCWqnTGlSefXEfTE7IVXpn9jLf%2Bus9SFPDFBWSYuFU6hosO4DNFjOrCYxa8ChzUBbV2ATRYqgkgRILTqMK9n88WuBDew9944Dmd5EmFQamwkBVoGoEW7wwzjPz5IOnzVkhUs44UsY5ipRR312u1spzt%2BWHoht1O4zzSDDud4Jmt%2Bl5Aedhpyf8HnI7Ed%2BeffMfAAAA%2F%2F8BAAD%2F%2Fy9YviZxBAAA
200 OK 7 B URL GET HTTP/1.1 eventuallypropagandametal.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRitXuNe9LLqRVDpo4JOunt6frkHMa6RYEzi%2FiB4rK6qnpSp7mqquqcnOQUXdC%2FCuCePnTfJBnWR3T9AkI4XWRAye5Ag5p9Q9iwzGRj3g%2B7vve%2FV4b2v6uvD4oL4KOj51md6XypFl1sNz317W6Zcl9bduO36XsO77m7LtB1ed4fTnxm873uthveO%2B4lgu3o58HzP8z3fXZVGxHq4PFMhs4c9v9HzGmHQ8FshhuZ5bgsHljrggwvyCiSfvLjz%2B2NIViNNHt0QdjfX2bsfJ4WiuTYY8JM76W6qyxTJAsbGQZyezE9D2wkh31%2BBTk%2FmCaAHR9MEiOSEOH%2F6iNKTuU1Eg%2BNLp5GCSBHxl1AOaghVQ9IaTN%2BF5GcEYBwbm0iTBxvalHTvUqVTdUKWnv0DWU7I0t%2BvIU1%2BXlFy6N7SqsilTi2GcQU5rCH7NbLiFPm%2BA1meguVfQfI%2FyPKzdaTJ0aZVGpJXs%2FRS1pBxDSVGoNZBMf2kgyJ2UGQOEn7u0lYv9rxOHMXNZjdkjDWbjLW6bd7izbAbeyjY1N4IeTYCUyMwc4DMHGBXjmCKX2F3KljuwOYT4nx%2BgAGvUAqC0hKUlKCUBGVOUA6qY65sYKsHXNki8uc9mPdmNdZ5%2F5Ae67wvUgJqRofZBbk2282%2FbY1dce4GQUh5SP0wCiO%2FxfxO0I7jjtcSrN0JBG3DygrSXpnF3Zdnr2bI5NnLbyCip7DqFExeAy3eBC3HncAD3RmHXQ%2F76SMuMm1lHkslbIPpBFxXyPIl5HvOobogr8989J7eh2BPyLzATIXMVPhS%2FkbQV%2FfGN3VJjm7q0pLHm1kuE7lPp%2Fd3K6e5uPrjp2Kv1Iav3bCjHz5kU2EKH94WNl%2BnKZdp35KfViTnwqxqwwT5Zc1ui2irsDsrhUmLbH3ro9W1JDPCWqnTGlSefXEfTE7IVXpn9jLf%2Bus9SFPDFBWSYuFU6hosO4DNFjOrCYxa8ChzUBbV2ATRYqgkgRILTqMK9n88WuBDew9944Dmd5EmFQamwkBVoGoEW7wwzjPz5IOnzVkhUs44UsY5ipRR312u1spzt%2BWHoht1O4zzSDDud4Jmt%2Bl5Aedhpyf8HnI7Ed%2BeffMfAAAA%2F%2F8BAAD%2F%2Fy9YviZxBAAA
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRitXuNe9LLqRVDpo4JOunt6frkHMa6RYEzi%2FiB4rK6qnpSp7mqquqcnOQUXdC%2FCuCePnTfJBnWR3T9AkI4XWRAye5Ag5p9Q9iwzGRj3g%2B7vve%2FV4b2v6uvD4oL4KOj51md6XypFl1sNz317W6Zcl9bduO36XsO77m7LtB1ed4fTnxm873uthveO%2B4lgu3o58HzP8z3fXZVGxHq4PFMhs4c9v9HzGmHQ8FshhuZ5bgsHljrggwvyCiSfvLjz%2B2NIViNNHt0QdjfX2bsfJ4WiuTYY8JM76W6qyxTJAsbGQZyezE9D2wkh31%2BBTk%2FmCaAHR9MEiOSEOH%2F6iNKTuU1Eg%2BNLp5GCSBHxl1AOaghVQ9IaTN%2BF5GcEYBwbm0iTBxvalHTvUqVTdUKWnv0DWU7I0t%2BvIU1%2BXlFy6N7SqsilTi2GcQU5rCH7NbLiFPm%2BA1meguVfQfI%2FyPKzdaTJ0aZVGpJXs%2FRS1pBxDSVGoNZBMf2kgyJ2UGQOEn7u0lYv9rxOHMXNZjdkjDWbjLW6bd7izbAbeyjY1N4IeTYCUyMwc4DMHGBXjmCKX2F3KljuwOYT4nx%2BgAGvUAqC0hKUlKCUBGVOUA6qY65sYKsHXNki8uc9mPdmNdZ5%2F5Ae67wvUgJqRofZBbk2282%2FbY1dce4GQUh5SP0wCiO%2FxfxO0I7jjtcSrN0JBG3DygrSXpnF3Zdnr2bI5NnLbyCip7DqFExeAy3eBC3HncAD3RmHXQ%2F76SMuMm1lHkslbIPpBFxXyPIl5HvOobogr8989J7eh2BPyLzATIXMVPhS%2FkbQV%2FfGN3VJjm7q0pLHm1kuE7lPp%2Fd3K6e5uPrjp2Kv1Iav3bCjHz5kU2EKH94WNl%2BnKZdp35KfViTnwqxqwwT5Zc1ui2irsDsrhUmLbH3ro9W1JDPCWqnTGlSefXEfTE7IVXpn9jLf%2Bus9SFPDFBWSYuFU6hosO4DNFjOrCYxa8ChzUBbV2ATRYqgkgRILTqMK9n88WuBDew9944Dmd5EmFQamwkBVoGoEW7wwzjPz5IOnzVkhUs44UsY5ipRR312u1spzt%2BWHoht1O4zzSDDud4Jmt%2Bl5Aedhpyf8HnI7Ed%2BeffMfAAAA%2F%2F8BAAD%2F%2Fy9YviZxBAAA HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:33 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0bed4c6a0e34f204e54f92de694e3e68
Strict-Transport-Security: max-age=0; includeSubdomains
GET 021f9bc640.6a34d15d38.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNzk5OTEwNDIyMzQzOTgxOTAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIzLjk4LjEiLCJ0YWdfaWQiOjQ2NDQ1LCJzY3JlZW5fcmVzb2x1dGlvbiI6IjEyODB4MTAyNCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiVVRDIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjEuMjEsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IkRlcG9zaXRGaWxlcyUyQ0RlcG9zaXRGaWxlcyUyQ3Byb3ZpZGVzJTJDeW91JTJDd2l0aCUyQ2ElMkNsZWdpdGltYXRlJTJDdGVjaG5pY2FsJTJDc29sdXRpb24lMkN3aGljaCUyQ2VuYWJsZXMlMkN5b3UlMkN0byUyQ3VwbG9hZCUyQ3N0b3JlJTJDYWNjZXNzJTJDYW5kJTJDZG93bmxvYWQlMkN0ZXh0JTJDc29mdHdhcmUlMkMlMkNzY3JpcHRzJTJDaW1hZ2VzJTJDc291bmRzJTJDdmlkZW9zJTJDYW5pbWF0aW9ucyUyQ2FuZCUyQ2FueSUyQ290aGVyJTJDbWF0ZXJpYWxzJTJDaW4lMkNmb3JtJTJDb2YlMkNvbmUlMkNvciUyQ3NldmVyYWwlMkNlbGVjdHJvbmljJTJDZmlsZXMuIn0=
200 OK 0 B URL GET HTTP/2 021f9bc640.6a34d15d38.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNzk5OTEwNDIyMzQzOTgxOTAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIzLjk4LjEiLCJ0YWdfaWQiOjQ2NDQ1LCJzY3JlZW5fcmVzb2x1dGlvbiI6IjEyODB4MTAyNCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiVVRDIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjEuMjEsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IkRlcG9zaXRGaWxlcyUyQ0RlcG9zaXRGaWxlcyUyQ3Byb3ZpZGVzJTJDeW91JTJDd2l0aCUyQ2ElMkNsZWdpdGltYXRlJTJDdGVjaG5pY2FsJTJDc29sdXRpb24lMkN3aGljaCUyQ2VuYWJsZXMlMkN5b3UlMkN0byUyQ3VwbG9hZCUyQ3N0b3JlJTJDYWNjZXNzJTJDYW5kJTJDZG93bmxvYWQlMkN0ZXh0JTJDc29mdHdhcmUlMkMlMkNzY3JpcHRzJTJDaW1hZ2VzJTJDc291bmRzJTJDdmlkZW9zJTJDYW5pbWF0aW9ucyUyQ2FuZCUyQ2FueSUyQ290aGVyJTJDbWF0ZXJpYWxzJTJDaW4lMkNmb3JtJTJDb2YlMkNvbmUlMkNvciUyQ3NldmVyYWwlMkNlbGVjdHJvbmljJTJDZmlsZXMuIn0=
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subject021f9bc640.6a34d15d38.com
Fingerprint1D:E5:5D:87:0A:CA:6A:73:CC:25:2E:3E:10:6F:BE:17:65:50:58:01
ValidityMon, 25 Dec 2023 02:50:19 GMT - Sun, 24 Mar 2024 02:50:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNzk5OTEwNDIyMzQzOTgxOTAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIzLjk4LjEiLCJ0YWdfaWQiOjQ2NDQ1LCJzY3JlZW5fcmVzb2x1dGlvbiI6IjEyODB4MTAyNCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiVVRDIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjEuMjEsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IkRlcG9zaXRGaWxlcyUyQ0RlcG9zaXRGaWxlcyUyQ3Byb3ZpZGVzJTJDeW91JTJDd2l0aCUyQ2ElMkNsZWdpdGltYXRlJTJDdGVjaG5pY2FsJTJDc29sdXRpb24lMkN3aGljaCUyQ2VuYWJsZXMlMkN5b3UlMkN0byUyQ3VwbG9hZCUyQ3N0b3JlJTJDYWNjZXNzJTJDYW5kJTJDZG93bmxvYWQlMkN0ZXh0JTJDc29mdHdhcmUlMkMlMkNzY3JpcHRzJTJDaW1hZ2VzJTJDc291bmRzJTJDdmlkZW9zJTJDYW5pbWF0aW9ucyUyQ2FuZCUyQ2FueSUyQ290aGVyJTJDbWF0ZXJpYWxzJTJDaW4lMkNmb3JtJTJDb2YlMkNvbmUlMkNvciUyQ3NldmVyYWwlMkNlbGVjdHJvbmljJTJDZmlsZXMuIn0= HTTP/1.1
Host: 021f9bc640.6a34d15d38.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:33 GMT
content-length: 0
server: nginx/1.18.0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
GET eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fcss%2Fstyle.css&l=2286&fd=108
200 OK 0 B URL GET HTTP/1.1 eventuallypropagandametal.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fcss%2Fstyle.css&l=2286&fd=108
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjecteventuallypropagandametal.com
Fingerprint6A:A7:B9:93:7F:92:F8:20:45:A1:7F:D1:B2:06:23:2C:A0:5C:0B:4D
ValidityMon, 11 Dec 2023 08:11:03 GMT - Sun, 10 Mar 2024 08:11:02 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fceleb%2Fbanner%2F12%2Fcss%2Fstyle.css&l=2286&fd=108 HTTP/1.1
Host: eventuallypropagandametal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Thu, 28 Dec 2023 19:50:33 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
GET unseenreport.com/pxf.gif?uuid=17e5dc9f-70a9-4572-926c-cf8e2892a8b4&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=c22dc50dc2bbe4422c7f68d26ab95eb9&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=19
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=17e5dc9f-70a9-4572-926c-cf8e2892a8b4&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=c22dc50dc2bbe4422c7f68d26ab95eb9&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=19
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=17e5dc9f-70a9-4572-926c-cf8e2892a8b4&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=c22dc50dc2bbe4422c7f68d26ab95eb9&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=19 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 28 Dec 2023 19:50:33 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a6a0db9773e549dcc107fdbbdaa306b3
Strict-Transport-Security: max-age=0; includeSubdomains
GET unseenreport.com/pxf.gif?uuid=17e5dc9f-70a9-4572-926c-cf8e2892a8b4&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=224ad4a14b4b15c1726ff705ec672ea6&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=19
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=17e5dc9f-70a9-4572-926c-cf8e2892a8b4&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=224ad4a14b4b15c1726ff705ec672ea6&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=19
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=17e5dc9f-70a9-4572-926c-cf8e2892a8b4&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=224ad4a14b4b15c1726ff705ec672ea6&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=19 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 28 Dec 2023 19:50:33 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6910f263957fd693dca62c97f15e872f
Strict-Transport-Security: max-age=0; includeSubdomains
GET js.wpadmngr.com/static/adManager.js
200 OK 1.7 kB URL GET HTTP/2 js.wpadmngr.com/static/adManager.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectjs.wpadmngr.com
FingerprintAC:C2:DC:B6:95:8A:52:42:68:CB:0F:19:3F:56:A9:E9:1F:E6:04:8C
ValiditySun, 12 Nov 2023 03:01:15 GMT - Sat, 10 Feb 2024 03:01:14 GMT
File type ASCII text, with very long lines (1832), with no line terminators
Hash 01f1b237a4874f6d6f6fa200e1704f9e
a8403295aab014731d0c8c0a8ee09e425763a876
06cd8edff045b7d9515a36d86da6aaaec2de2592cf7b12e2b97500d40e3825cf
GET /static/adManager.js HTTP/1.1
Host: js.wpadmngr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:29 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Wed, 27 Dec 2023 08:13:47 GMT
etag: W/"658bdcbb-698"
content-encoding: gzip
expires: Thu, 28 Dec 2023 19:55:29 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
GET cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/css/animate.css
200 OK 79 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/css/animate.css
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint49:C8:A4:CE:31:56:FC:06:71:93:06:7A:69:DD:ED:B2:EF:C9:41:97
ValidityTue, 19 Dec 2023 15:02:46 GMT - Mon, 18 Mar 2024 15:02:45 GMT
Hash e1d8acd5ee9d1a90ea09313cbd8f2b02
8a8327b115d1356715e63270d1ce6d46124c7b1a
3028c87fc798ac3741f02079034e6c23462afc0c5e6c8d321188ce3716c8472a
GET /sb/notifications/utility/default/us/celeb/banner/12/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: text/css
last-modified: Fri, 19 Mar 2021 12:47:31 GMT
etag: W/"60549d63-13591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1033309
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i42SQqN9bAQ52yELNtDgLpp%2Fxl%2F8YyvTc4G%2FonxjhN%2BRjnVrUoATETd9iRmvFb689nPkNT0cm18QdIwMmxduUsT3Dg1%2BWDvrI66ec1d5im1kUHnlCrGs6W4j2S2eAQ6eik2bYw5RL46b"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83cc5535384b63b4-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/css/style.css
200 OK 2.3 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/css/style.css
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint49:C8:A4:CE:31:56:FC:06:71:93:06:7A:69:DD:ED:B2:EF:C9:41:97
ValidityTue, 19 Dec 2023 15:02:46 GMT - Mon, 18 Mar 2024 15:02:45 GMT
File type ASCII text, with very long lines (2434), with no line terminators
Hash 4e126164302c5c7462d4fc88ff0e7590
cf8ca720ba34ee35e1d6e4d2e84d0e952c7a0c49
a09c351b16020d0339ee3da2ba88dfea6bf373600d64440ccb5dee5c901c2848
GET /sb/notifications/utility/default/us/celeb/banner/12/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: text/css
last-modified: Fri, 19 Mar 2021 12:47:31 GMT
etag: W/"60549d63-8ee"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2090035
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oGnPfFkWbQAvYdfx%2BCdXBaJ3tc4cwTo8DkFwupYUhaDS%2FgJsy7NEctZwYM9vwmpRl6z4TXDkZdsAGxcUbK3FHUF%2B79u6aBU1R%2B6tNiixFKH8AUQBBR5hV9a%2FDMm%2FSf3rV64k8xt11exZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83cc5535486163b4-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/no.png
200 OK 3.1 kB URL GET HTTP/2 static.depositfiles.com/images/no.png
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Hash 1724ae7b4437c460dafe40dfe9f96d41
8dc80d5b802f180254a8ee1bf1edf0b843205f1e
9b95b8f24b2b0808d611f4fd9bf5f3c548b352ae6100ab7b298b99a86905db79
GET /images/no.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Thu, 28 Dec 2023 19:50:29 GMT
etag: "651c240d-c4a"
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 3146
X-Firefox-Spdy: h2
GET js.wpadmngr.com/static/adManager.m.js
200 OK 104 kB URL GET HTTP/2 js.wpadmngr.com/static/adManager.m.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectjs.wpadmngr.com
FingerprintAC:C2:DC:B6:95:8A:52:42:68:CB:0F:19:3F:56:A9:E9:1F:E6:04:8C
ValiditySun, 12 Nov 2023 03:01:15 GMT - Sat, 10 Feb 2024 03:01:14 GMT
Size 104 kB (104255 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /static/adManager.m.js HTTP/1.1
Host: js.wpadmngr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:30 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Wed, 27 Dec 2023 08:13:52 GMT
etag: W/"658bdcc0-1973f"
content-encoding: gzip
expires: Thu, 28 Dec 2023 19:55:30 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
GET adsbb.dfiles.eu//ad.php?z=56&c=NO
303 See Other 1.5 kB URL GET HTTP/2 adsbb.dfiles.eu//ad.php?z=56&c=NO
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
FingerprintCC:57:A8:99:82:65:9E:AE:6B:7C:68:C0:CE:7C:F7:6F:A8:6B:23:E0
ValiditySun, 05 Nov 2023 13:34:41 GMT - Sat, 03 Feb 2024 13:34:40 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET //ad.php?z=56&c=NO HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 303 See Other
content-security-policy: frame-ancestors depositfiles.com depositfiles.org dfiles.eu dfiles.com
content-type: text/html; charset=UTF-8
date: Thu, 28 Dec 2023 19:50:30 GMT
location: /upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
server: nginx
set-cookie: _nf56=1; expires=Fri, 29-Dec-2023 19:50:30 GMT; Max-Age=86400
x-powered-by: PHP/5.6.30-0+deb8u1
X-Firefox-Spdy: h2
GET storage.multstorage.com/log/count.html
200 OK 882 B URL GET HTTP/2 storage.multstorage.com/log/count.html
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectmultstorage.com
Fingerprint1F:90:8C:BB:6B:B0:99:41:3A:23:DF:A4:57:1A:25:0F:88:BA:C6:DE
ValidityMon, 20 Nov 2023 10:07:51 GMT - Sun, 18 Feb 2024 10:07:50 GMT
File type HTML document, ASCII text, with very long lines (919), with no line terminators
Hash 053b1fe641da8057571d40ebaf1624ab
09b2648b7d08c84621298f0b939cea5170a65022
6606334874a3edb8295831f41d3684433e4553ffe0a72e58c90926e00f39c6a4
GET /log/count.html HTTP/1.1
Host: storage.multstorage.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: text/html
last-modified: Mon, 18 Sep 2023 14:39:06 GMT
vary: Accept-Encoding
x-request-id: 84711fd2f729072fdaac51aaf248f705
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vQT1tdA4PPgqPFl4SfUp%2FQpxbLz5kmWT78pspBRPQfgRnpdNnLYAVx%2BoVG%2FveRBKcWB8FLtKwaybxfIZ%2FrB2Ygl4K5AGMhzAJPU2Y0rWdNdjxjrBBl2uQDBcP78HyK3AFPW7hcDXUKcnPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 83cc55340b7f5699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
200 OK 1.5 kB URL GET HTTP/2 adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
FingerprintCC:57:A8:99:82:65:9E:AE:6B:7C:68:C0:CE:7C:F7:6F:A8:6B:23:E0
ValiditySun, 05 Nov 2023 13:34:41 GMT - Sat, 03 Feb 2024 13:34:40 GMT
File type HTML document, ASCII text, with very long lines (1549), with no line terminators
Hash 97e696fa3f27da3f901824efd53ba048
431d0c1822db04ebeb1c0bf00e86babb4bc01977
23556858aec0e79796c4a5706dc0995a5d49ed5198efa08f451aec069df8d768
GET /upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dfiles.eu/
DNT: 1
Connection: keep-alive
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025; _nf56=1; _nf58=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-encoding: gzip
content-security-policy: frame-ancestors depositfiles.com depositfiles.org dfiles.eu dfiles.com
content-type: text/html
date: Thu, 28 Dec 2023 19:50:30 GMT
last-modified: Thu, 28 Dec 2023 19:50:01 GMT
server: nginx
X-Firefox-Spdy: h2
GET js.wpshsdk.com/npc/sdk/push.m.js?v=1
200 OK 35 kB URL GET HTTP/2 js.wpshsdk.com/npc/sdk/push.m.js?v=1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectjs.wpshsdk.com
Fingerprint07:CF:9F:F6:6F:EC:12:8A:E5:15:45:BE:7A:31:00:17:EB:A4:EC:D8
ValidityTue, 21 Nov 2023 14:00:56 GMT - Mon, 19 Feb 2024 14:00:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /npc/sdk/push.m.js?v=1 HTTP/1.1
Host: js.wpshsdk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Wed, 27 Dec 2023 12:29:11 GMT
etag: W/"658c1897-878d"
content-encoding: gzip
expires: Thu, 28 Dec 2023 19:55:32 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
GET static.depositfiles.com/images/upload_btn_bg.gif
200 OK 9.0 kB URL GET HTTP/2 static.depositfiles.com/images/upload_btn_bg.gif
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
FingerprintCC:58:6C:73:8E:64:B8:52:23:86:28:DD:7F:A1:B4:56:B5:95:D2:EF
ValiditySun, 05 Nov 2023 13:35:24 GMT - Sat, 03 Feb 2024 13:35:23 GMT
File type GIF image data, version 89a, 209 x 75
Hash 6f312f0f4ff138758bae76420f6efd78
b40a28f162140fedff9ee5ce0d687868b1f73d17
c667d75c7f916bf8b140b0e1f7ab0c996f76d4642faed85bd9fef3c738f0912b
GET /images/upload_btn_bg.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Thu, 28 Dec 2023 19:50:30 GMT
etag: "651c240d-2332"
expires: Tue, 02 Jan 2024 19:50:30 GMT
last-modified: Tue, 03 Oct 2023 14:24:13 GMT
server: nginx
content-length: 9010
X-Firefox-Spdy: h2
GET js.capndr.com/advertising.js
200 OK 0 B URL GET HTTP/2 js.capndr.com/advertising.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectjs.capndr.com
FingerprintF0:24:A5:0C:06:85:29:08:4A:D1:00:E7:0E:6D:7E:FA:78:A7:98:84
ValiditySat, 23 Dec 2023 03:00:16 GMT - Fri, 22 Mar 2024 03:00:15 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /advertising.js HTTP/1.1
Host: js.capndr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:31 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
server: nginx/1.18.0
last-modified: Fri, 14 Jul 2023 08:23:25 GMT
etag: "64b105fd-0"
expires: Thu, 28 Dec 2023 19:55:31 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
GET cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/js/script.js
200 OK 385 B URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/utility/default/us/celeb/banner/12/js/script.js
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint49:C8:A4:CE:31:56:FC:06:71:93:06:7A:69:DD:ED:B2:EF:C9:41:97
ValidityTue, 19 Dec 2023 15:02:46 GMT - Mon, 18 Mar 2024 15:02:45 GMT
File type ASCII text, with very long lines (399), with no line terminators
Hash 1cefc33777b8bee6b7fcc27b0ecbd6f8
019bb2f304ef537ce1764a91d5cf3aae361b1f08
a7daa6a82a2edc4563c1e9b8962007248d693996475caca0fa546266adf0ae9b
GET /sb/notifications/utility/default/us/celeb/banner/12/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:32 GMT
content-type: application/javascript
last-modified: Fri, 19 Mar 2021 12:47:36 GMT
etag: W/"60549d68-181"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 2090035
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t57KOkasUYaKEmU6mRAwCRAcRaZ8M3ZQ07fwfd7kbN5qU0W%2FhboXTUT4Xtec6fcr0XW5BtXZ5oRNjXWiF3Z%2BVXRm9d45HM9y8WeZw4t5PhhbvgeWihMCTviR%2B%2BO7WpU4vFZvA3FIyENX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83cc5535384663b4-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET adsbb.dfiles.eu/upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
200 OK 1.5 kB URL GET HTTP/2 adsbb.dfiles.eu/upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
IP
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
FingerprintCC:57:A8:99:82:65:9E:AE:6B:7C:68:C0:CE:7C:F7:6F:A8:6B:23:E0
ValiditySun, 05 Nov 2023 13:34:41 GMT - Sat, 03 Feb 2024 13:34:40 GMT
File type HTML document, ASCII text, with very long lines (1534), with no line terminators
Hash 8021b9ed7e61ccf6000f6824518f5016
7a159d692a8440a4d81f1f47d19de62f0caf087c
296c43ab364f79600e6ed5c2ceb90e112a8dc18efdcac3598a033893342e67eb
GET /upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dfiles.eu/
DNT: 1
Connection: keep-alive
Cookie: last_file=qabuajtj6; lang_current=en; _ga_BL9163LYG1=GS1.1.1703793025.1.0.1703793025.0.0.0; _ga=GA1.1.117715871.1703793025; _nf56=1; _nf58=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-encoding: gzip
content-security-policy: frame-ancestors depositfiles.com depositfiles.org dfiles.eu dfiles.com
content-type: text/html
date: Thu, 28 Dec 2023 19:50:30 GMT
last-modified: Thu, 28 Dec 2023 19:50:01 GMT
server: nginx
X-Firefox-Spdy: h2
GET na.nawpush.com/tags/46445?version_name=c
200 OK 579 B URL GET HTTP/2 na.nawpush.com/tags/46445?version_name=c
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/qabuajtj6/COD-WAW_patch_and-PB.exe
Certificate IssuerLet's Encrypt
Subjectna.nawpush.com
Fingerprint73:8E:D9:E1:D0:7F:5B:63:BD:6A:8D:47:8E:04:38:3F:5F:49:91:2B
ValidityWed, 29 Nov 2023 03:00:42 GMT - Tue, 27 Feb 2024 03:00:41 GMT
File type troff or preprocessor input, ASCII text, with very long lines (656), with no line terminators
Hash 0243e0da104f07016e8f1413e1d042e1
906fd35bb0c7a85263803208deb3aa8c7b5a0bca
882adada4bd64aaff6ee6f3841d37293a55ed32a307d801ab8fe89c673a99d65
GET /tags/46445?version_name=c HTTP/1.1
Host: na.nawpush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Dec 2023 19:50:31 GMT
content-type: application/json
content-length: 579
server: nginx/1.18.0
cache-control: max-age=300, public
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
91.226.124.104
104.19.133.76
45.133.44.53
157.90.84.242