| cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js |  104.17.25.14 | 200 OK | 90 kB |
URL GET cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js IP104.17.25.14:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT
File typeJavaScript source, ASCII text, with very long lines (65451) Hashdc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 27958
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 93a16649ad410afa-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb09ed3-15d84"
last-modified: Mon, 04 May 2020 23:01:39 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 37806
expires: Thu, 23 Apr 2026 17:15:17 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h2ciKft4xt%2BWbQxho3kv4IhYJkhXWj2%2FeNAMmjHNVg7aNi3RmVt6%2FB1mEsw1TwUNtDADVCLmvyU4LX%2BdiMbzgk0%2FlcI5x%2Fo9cxkLg3WV2n7nivmfGEpNZyal7DGVbHxXDn1CHYP%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| wss://api.flashpost.app/ws?url=https://starsessions.forumgo.net/&limit=3 | 104.21.16.249 | 525 | 0 B |
URL GET wss://api.flashpost.app/ws?url=https://starsessions.forumgo.net/&limit=3 IP104.21.16.249:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subjectflashpost.app Fingerprint47:A2:8B:B4:29:4D:B7:3B:B0:87:61:38:42:AA:A7:09:CD:21:D7:95 ValidityThu, 06 Mar 2025 01:48:43 GMT - Wed, 04 Jun 2025 02:46:06 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ws?url=https://starsessions.forumgo.net/&limit=3 HTTP/1.1
Host: api.flashpost.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://starsessions.forumgo.net
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: J1EOrtrbaHa9Or/MLKqv9A==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 525
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 6890
Connection: keep-alive
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iwgngxZY3Nu%2FUIugRc6b1aIcfuS4DtqWneDVBKMvsD6oe1H4PW9gZY%2B%2F9QGCSKJ8DXMCprtSqEFy33RCCqXdxMJUmuBxDXwTpVPfoVT0joRxjZNEneAlAR5dO3aMSKwBuT8m6A%3D%3D"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: cloudflare
Cf-Ray: 93a1664b4bb256c0-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=475&min_rtt=438&rtt_var=151&sent=5&recv=8&lost=0&retrans=0&sent_bytes=3118&recv_bytes=1216&delivery_rate=7528596&cwnd=252&unsent_bytes=0&cid=6ac1839d9d08ab8a&ts=268&x=0"
|
|
| accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail |  74.125.131.84 | 302 Found | 0 B |
URL GET accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail IP74.125.131.84:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint52:D3:F7:7E:94:6F:70:55:50:A6:EA:38:4B:15:DF:91:54:96:59:82 ValidityMon, 31 Mar 2025 08:56:30 GMT - Mon, 23 Jun 2025 08:56:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:Oz6uZO5MofdLO5wHZpvEExzyesP8_w:-3B7x1JSKv6RjRxa; Expires=Mon, 03-May-2027 17:15:18 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 03 May 2025 17:15:18 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKV5MixpnKH16wyAcN6KlDYx1c1nN47a8hP0mTCrcXahiHZ6OaBRotRgBZ1kV5dVlzo1bSuYD4nzw
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-OmmATmehfmwZrS3HuCCOyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKV5Mj2xvEALCoFbLzhrJrpIYhG6fxz3ByI1_tNBPhAm8kK-dXIOlXn5BOvfYeZkkrtvf5OdXdIHA&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S135243737%3A1746292518507940 | 74.125.131.84 | 403 Forbidden | 0 B |
URL GET accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKV5Mj2xvEALCoFbLzhrJrpIYhG6fxz3ByI1_tNBPhAm8kK-dXIOlXn5BOvfYeZkkrtvf5OdXdIHA&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S135243737%3A1746292518507940 IP74.125.131.84:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint52:D3:F7:7E:94:6F:70:55:50:A6:EA:38:4B:15:DF:91:54:96:59:82 ValidityMon, 31 Mar 2025 08:56:30 GMT - Mon, 23 Jun 2025 08:56:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKV5Mj2xvEALCoFbLzhrJrpIYhG6fxz3ByI1_tNBPhAm8kK-dXIOlXn5BOvfYeZkkrtvf5OdXdIHA&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S135243737%3A1746292518507940 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 03 May 2025 17:15:18 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce--gBZdMtxtA8sQ8RRVHu0VQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://translate.google.com/translate_a/element.js https://www.google.com/recaptcha/api.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.E_-11t052Go.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/videojs-hotkeys/0.2.28/videojs.hotkeys.min.js | 104.17.25.14 | 200 OK | 4.6 kB |
URL GET cdnjs.cloudflare.com/ajax/libs/videojs-hotkeys/0.2.28/videojs.hotkeys.min.js IP104.17.25.14:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT
File typeJavaScript source, ASCII text, with very long lines (4505) Hashf2ecb2bd8a424c8e8cf507ce8bd933c2 3cbc08ca052ea25c3b0834b9291a3ca1e9122e26 4c0745052abbb26087a707bb0a043b43c393674055ba2d4452ac89e6923eb099
GET /ajax/libs/videojs-hotkeys/0.2.28/videojs.hotkeys.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 1571
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 93a166498d060afa-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "630ad3e5-623"
last-modified: Sun, 28 Aug 2022 02:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 137558
expires: Thu, 23 Apr 2026 17:15:17 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kbn4aFl9uxROyHhIEwIVTE9ByymC3udm4ZwU8x%2Flj60V84alViO5jrJh44NCbBN9K41VeJCB3LSzQB38t3I6ZVSV44CpODeoY3gKf7P4L7%2FyY4TsfmcdBKyx3LhB%2BkytZjqrCuFu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| faqirsgoliard.top/gHzOaAdOhbZ/71405 |  212.117.186.244 | 200 OK | 6 B |
URL GET faqirsgoliard.top/gHzOaAdOhbZ/71405 IP212.117.186.244:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerZeroSSL Subjectfaqirsgoliard.top FingerprintB0:1A:95:1C:A4:EC:21:32:46:5F:3B:18:FB:97:AB:03:1C:C0:54:05 ValidityThu, 27 Feb 2025 00:00:00 GMT - Wed, 28 May 2025 23:59:59 GMT
File typeASCII text, with no line terminators Hash4fc71bf68a1d477bd1523733e34d1e90 15119105cffbe108b6cf290146ab02c9aa8517ba 74c1971a5c7f3f1cfb81b7a0a8717cee5a45841844104566e00bbfca271943ce
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gHzOaAdOhbZ/71405 HTTP/1.1
Host: faqirsgoliard.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://do7go.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Sun, 04-May-2025 17:15:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Sun, 04-May-2025 17:15:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| www.psajushuphu.pro/ecc874/711cee5662df.js | 45.133.44.1 | 200 OK | 70 kB |
URL GET www.psajushuphu.pro/ecc874/711cee5662df.js IP45.133.44.1:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subjectwww.psajushuphu.pro Fingerprint51:48:74:3D:A8:C2:92:68:DA:D0:F2:19:AC:84:D2:28:7F:A2:9B:9C ValidityMon, 28 Apr 2025 07:07:33 GMT - Sun, 27 Jul 2025 07:07:32 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashe57dc6337c9f8a5f45e4d92e44f0a1d8 37759c545645d4607aa90cda8df568c4ef623e1f 77fe761b086ddada890cfb11c9e810cb5d9e60c138a921d066158259aab43157
GET /ecc874/711cee5662df.js HTTP/1.1
Host: www.psajushuphu.pro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: text/plain
Origin: https://starsessions.forumgo.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
server: nginx
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: Content-Type
cache-control: max-age=172800
content-encoding: gzip
expires: Mon, 05 May 2025 17:15:17 GMT
x-cdn-host-id: ah0543
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| efullofeedshen.com/aWRGNXdGWyVGSjMeFEwmPy4gdCIjHBxjFC01HmcFPxM+cRQuIWBBHg1ZdwVHXVRxAVEZDSIIRlFCNUEWHRE1CEZPDShTGFRCMAhGR1RoB1lcQjMIRk8QNlQQVFVgRQMdCHsEQF1SdAxFXFVxDEVY | 172.67.158.191 | 204 No Content | 0 B |
URL GET efullofeedshen.com/aWRGNXdGWyVGSjMeFEwmPy4gdCIjHBxjFC01HmcFPxM+cRQuIWBBHg1ZdwVHXVRxAVEZDSIIRlFCNUEWHRE1CEZPDShTGFRCMAhGR1RoB1lcQjMIRk8QNlQQVFVgRQMdCHsEQF1SdAxFXFVxDEVY IP172.67.158.191:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectefullofeedshen.com Fingerprint0C:E4:11:07:1D:40:1B:2C:6E:69:17:1B:05:1A:0B:F5:C8:8D:17:D2 ValidityThu, 03 Apr 2025 11:44:01 GMT - Wed, 02 Jul 2025 12:42:34 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /aWRGNXdGWyVGSjMeFEwmPy4gdCIjHBxjFC01HmcFPxM+cRQuIWBBHg1ZdwVHXVRxAVEZDSIIRlFCNUEWHRE1CEZPDShTGFRCMAhGR1RoB1lcQjMIRk8QNlQQVFVgRQMdCHsEQF1SdAxFXFVxDEVY HTTP/1.1
Host: efullofeedshen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sat, 03 May 2025 17:15:18 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 93a1664dbe607127-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| starsessions.forumgo.net/favicon.ico | 188.114.97.1 | 404 Not Found | 2 B |
URL GET starsessions.forumgo.net/favicon.ico IP188.114.97.1:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subjectforumgo.net FingerprintE0:D9:83:3B:4E:10:5A:CF:57:A5:10:1B:A9:1A:A1:8A:47:70:5B:51 ValidityWed, 12 Mar 2025 05:56:01 GMT - Tue, 10 Jun 2025 06:53:51 GMT
Hash99914b932bd37a50b983c5e7c90ae93b bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
GET /favicon.ico HTTP/1.1
Host: starsessions.forumgo.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://starsessions.forumgo.net/
DNT: 1
Connection: keep-alive
Cookie: auth.strategy=local; auth.X-Host=starsessions.forumgo.net
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Sat, 03 May 2025 17:15:16 GMT
content-type: application/json; charset=utf-8
strict-transport-security: max-age=15724800; includeSubDomains
cache-control: max-age=14400
cf-cache-status: HIT
priority: u=6,i=?0
content-encoding: br
server: cloudflare
cf-ray: 93a16643cd691c0e-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| img.doodcdn.io/splash/c42gi1bbwdwe8320.jpg | 104.26.15.102 | 200 OK | 55 kB |
URL GET img.doodcdn.io/splash/c42gi1bbwdwe8320.jpg IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1264x715, components 3 Hash783b03132e055eb7ca80ea5b5ddfa7e6 7e3c5fb9a550a76c6169cd553ee8d34494268098 a936f3677f6e9cddc2955e5b548ef6cb5269c7f9dee8744e63c3d87cc88d75ea
GET /splash/c42gi1bbwdwe8320.jpg HTTP/1.1
Host: img.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: image/jpeg
content-length: 54559
access-control-allow-origin: *
cache-control: max-age=1209600
cf-bgj: imgq:100,h2pri
cf-polished: origSize=57363
etag: "68153ea8-e013"
expires: Sat, 17 May 2025 06:25:06 GMT
last-modified: Fri, 02 May 2025 21:52:40 GMT
cf-cache-status: HIT
age: 33510
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s1FRedntADW%2FXvmQWNgEo1HjQAMLly8dnm0izzGv0ulj3UZhglo%2Bz%2BieJZwaZGU7hK%2BpnXz8gVu4TT73otqLPqGWqGqcSFJeCKy4v8wSZl53tQDKTy9JIP6Mv2Grdpdx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664ced5f56b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3604&min_rtt=1362&rtt_var=2354&sent=33&recv=9&lost=0&retrans=0&sent_bytes=29269&recv_bytes=1513&delivery_rate=3596521&cwnd=24000&unsent_bytes=0&cid=a454cfaa24beaa00&ts=116&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| segarkojiri.top/cuid/?f=https%3A%2F%2Fdo7go.com |  23.109.170.11 | 200 OK | 0 B |
URL OPTIONS segarkojiri.top/cuid/?f=https%3A%2F%2Fdo7go.com IP23.109.170.11:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerZeroSSL Subjectsegarkojiri.top FingerprintB1:D1:99:D4:6E:8F:E8:95:E2:D6:F3:32:5C:83:EB:8C:7C:23:2A:D7 ValidityTue, 22 Apr 2025 00:00:00 GMT - Mon, 21 Jul 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
OPTIONS /cuid/?f=https%3A%2F%2Fdo7go.com HTTP/1.1
Host: segarkojiri.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://do7go.com/
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:18 GMT
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://do7go.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| segarkojiri.top/cuid/?f=https%3A%2F%2Fdo7go.com | 23.109.170.11 | 200 OK | 32 B |
URL POST segarkojiri.top/cuid/?f=https%3A%2F%2Fdo7go.com IP23.109.170.11:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerZeroSSL Subjectsegarkojiri.top FingerprintB1:D1:99:D4:6E:8F:E8:95:E2:D6:F3:32:5C:83:EB:8C:7C:23:2A:D7 ValidityTue, 22 Apr 2025 00:00:00 GMT - Mon, 21 Jul 2025 23:59:59 GMT
Hash91614b9eba53231c7ccf7e98ee388943 bd49452401cb5e5d0c19e301b01d82d28f23be03 af45a53bdd73067e8951d1da94eca09fea8bbc2d175a7756b1f7d7ab05858133
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cuid/?f=https%3A%2F%2Fdo7go.com HTTP/1.1
Host: segarkojiri.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
Content-Type: application/json
Content-Length: 10
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:18 GMT
Content-Type: application/json
Content-Length: 32
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://do7go.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: a97fa794a0f9=6712ed90de242649e3d8e3; expires=Sun, 08 Sep 2052 11:24:11 GMT; domain=segarkojiri.top; path=/; secure; SameSite=None
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/css/87b7056.css | 162.159.140.237 | 200 OK | 422 kB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/css/87b7056.css IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeASCII text, with very long lines (64484) Size422 kB (421459 bytes) Hash9a64b88f6e9659864b1849b946700858 6b6c4fd8e5c0e6f835b581047f63db8e36677b7a 4bfe5918e4988a0d250b5de6aa153d6a5a5bfd769d1343e3cb203053ac448f47
GET /assets/0.3/css/87b7056.css HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:15 GMT
Content-Type: text/css
Content-Length: 421459
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "9a64b88f6e9659864b1849b946700858"
Last-Modified: Wed, 26 Feb 2025 06:07:20 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663c788156cb-OSL
|
|
| i.doodcdn.io/ads/ad.js | 104.26.15.102 | 200 OK | 20 B |
IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeASCII text, with no line terminators Hash69a305bcdc8e061bbd43294a477a3678 506582a1d912d546f5942d95ffae95ec7f4c37ce 8964d85afd6d5d84b97872464646809c952ab900cdf5c5d7c3b7b4bdb74202fa
GET /ads/ad.js HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript
content-length: 20
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
cache-control: public, max-age=2592000
expires: Sat, 02 May 2026 23:56:22 GMT
vary: User-Agent,Accept-Encoding
access-control-allow-origin: *
cf-cache-status: HIT
age: 47557
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2BaTpXq%2F89CJbqM9tL4kpEVew2B3GSjmUMNoxtoWxdnMfFQupPD7aEODxXvu%2F5Mz7GQ%2Bdd%2FBhoI03j99tB2qwsU8kFtNlJC84%2BHbvZNQXG9%2FDn1H1vr08%2Fw6cr4giA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a166495efa0b31-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1214&min_rtt=409&rtt_var=1600&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3270&recv_bytes=1291&delivery_rate=7883847&cwnd=254&unsent_bytes=0&cid=7f09d69b8c06f0c1&ts=85&x=0"
X-Firefox-Spdy: h2
|
|
| i.doodcdn.io/css/embed.css | 104.26.15.102 | 200 OK | 80 kB |
URL GET i.doodcdn.io/css/embed.css IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeUnicode text, UTF-8 text, with very long lines (40048) Hashc4907b4a84bd80e4ccec940bf9d7f1ec d36c11083cb2f86b99e2380d8c22cf13e74dbb29 f9535c07a6c50f5094b5a0caf5475823b3b32e9998a72cf6ad6d811dc7985d3d
GET /css/embed.css HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: text/css
last-modified: Wed, 05 Mar 2025 20:32:19 GMT
vary: Accept-Encoding
etag: W/"67c8b4d3-13811"
expires: Sun, 01 Jun 2025 07:38:13 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
content-encoding: gzip
cf-cache-status: HIT
age: 51288
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3e8mu3L5l8OlgfuPI%2B6ZNuJAJJC8sq7fhvA57%2FrTdl93sz4wWXj64Znw6PVYeQ7j%2BF1%2Fw2xnXNTUYyJs5xV87N5IFh1zCnrdLAZbIpbnxtPNluqoC74Yz4OuafskHg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a166498f390b31-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=409&rtt_var=1480&sent=16&recv=15&lost=0&retrans=0&sent_bytes=7518&recv_bytes=1389&delivery_rate=7883847&cwnd=257&unsent_bytes=0&cid=7f09d69b8c06f0c1&ts=118&x=0"
X-Firefox-Spdy: h2
|
|
| divisiondrearilyunfiled.com/aas/r45d/vki/1941940/4d81a660.js | 94.242.247.24 | 200 OK | 150 kB |
URL GET divisiondrearilyunfiled.com/aas/r45d/vki/1941940/4d81a660.js IP94.242.247.24:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerBuypass AS-983163327 Subject FingerprintCF:34:D4:54:A1:7A:18:F4:1A:75:2E:BB:C8:B3:74:87:96:B5:A3:6C ValidityMon, 03 Mar 2025 23:54:00 GMT - Sat, 30 Aug 2025 21:59:00 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size150 kB (150126 bytes) Hashdeb4b2c662f1dc0664c5cde30597d0af 742f931ed71cda8284eb32ed9d47bbeaee0db827 affe022ab338cc093196cf28980bee3e6ba27288a8a1734d3a0ffb31f9a903b7
GET /aas/r45d/vki/1941940/4d81a660.js HTTP/1.1
Host: divisiondrearilyunfiled.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Apr 2025 08:42:15 GMT
vary: Accept-Encoding
etag: W/"680f3f67-24b12"
x-js-ab2: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKV5MgtzxHkLgQV5JH7onP4Dxog9TxHK3gOaIP6VdQyCifW4PnwQ7GAPRbWNyYBUli9b8rgQtahXw | 74.125.131.84 | 302 Found | 0 B |
URL GET accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKV5MgtzxHkLgQV5JH7onP4Dxog9TxHK3gOaIP6VdQyCifW4PnwQ7GAPRbWNyYBUli9b8rgQtahXw IP74.125.131.84:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint52:D3:F7:7E:94:6F:70:55:50:A6:EA:38:4B:15:DF:91:54:96:59:82 ValidityMon, 31 Mar 2025 08:56:30 GMT - Mon, 23 Jun 2025 08:56:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKV5MgtzxHkLgQV5JH7onP4Dxog9TxHK3gOaIP6VdQyCifW4PnwQ7GAPRbWNyYBUli9b8rgQtahXw HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:C3wu_B-H-ArqFJw7Fra15VxkqROiog:putuLS844IAbgsZU;Path=/;Expires=Mon, 03-May-2027 17:15:18 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 03 May 2025 17:15:18 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKV5MhmZByRiPVqXJHONP813UxYBTQLPEeh-W3N3-IpcGgM-YHxZHqthef6jEoqSipC9AtlCvgY1g&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S655121828%3A1746292518520648
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: script-src 'nonce-md-VNTRNNvD8iJUEx_P1Sg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 418
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2 | 142.250.74.35 | 200 OK | 21 kB |
URL GET fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2 IP142.250.74.35:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint62:05:36:C2:8E:4C:CD:95:1E:1C:75:06:44:A3:57:E5:C0:17:02:80 ValidityMon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 20612, version 1.0 Hashb07da7aa3e4f363c5cdbc11312239e8c 47bf5b2f24ea4a4caafccc89b9d2a6677ef9e3b8 e44c11f4834bdd4d6b6da7b8ee5eaebc8acb41250cd6bce5cc82ea8262140eaa
GET /s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://starsessions.forumgo.net
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 20612
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 01 May 2025 09:13:18 GMT
expires: Fri, 01 May 2026 09:13:18 GMT
cache-control: public, max-age=31536000
age: 201717
last-modified: Wed, 08 Jan 2025 18:23:11 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| do7go.com/e/ukbeetm88h2y | 104.26.8.147 | 200 OK | 38 kB |
IP104.26.8.147:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subjectdo7go.com Fingerprint62:14:72:A9:A1:C9:E5:FE:80:F8:A6:E1:89:21:66:B4:38:8B:DF:5B ValidityThu, 20 Mar 2025 08:57:50 GMT - Wed, 18 Jun 2025 09:56:23 GMT
File typeHTML document, ASCII text, with very long lines (38188), with no line terminators Hash0938af53892e2bcfb33d87e5153f007a 158b062ef05f967cb7e255bcd3592e56e7c75545 de32b89629bbee2dc8affa4e820af0d051afdb6a378c3715a76f0088741a70f1
GET /e/ukbeetm88h2y HTTP/1.1
Host: do7go.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Fri, 02 May 2025 17:15:17 GMT
set-cookie: lang=1; domain=.do7go.com; path=/; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vupIeUQRZCBo6zkf%2B8UeTLztbsc1vOOW6Jo%2BG%2BuJF65AIiY2PLsnUL5s8m5IiuZcsdf4IXcGYlrl1dpncqahrpcorsrKEDuSjs3O4%2F5aZL5bWwdqTQv8poVezQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664699e7b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=515&min_rtt=421&rtt_var=130&sent=8&recv=10&lost=0&retrans=0&sent_bytes=3193&recv_bytes=1130&delivery_rate=6724458&cwnd=254&unsent_bytes=0&cid=1b70294f3e7326c5&ts=222&x=0"
X-Firefox-Spdy: h2
|
|
| cdn.flashpost.app/flashpost-banner/amazon-banner.js | 172.67.217.86 | 200 OK | 1.1 MB |
URL GET cdn.flashpost.app/flashpost-banner/amazon-banner.js IP172.67.217.86:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subject3962619c.sni.cloudflaressl.com FingerprintAD:8C:45:CF:26:C2:D7:20:83:1A:05:2E:87:FE:50:27:34:5E:FC:CB ValidityWed, 09 Apr 2025 14:04:20 GMT - Tue, 08 Jul 2025 15:04:05 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size1.1 MB (1140919 bytes) Hashe7126c16c4e9f2537fe5f7b7714a83ec 8109206c0b9b5bedc8b75ad520e3a96232d47910 867d95e0d2d556cfa434ae9bf32ff88c2e42a8e42bac20658b1bb4f63732998b
GET /flashpost-banner/amazon-banner.js HTTP/1.1
Host: cdn.flashpost.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript
etag: W/"e7126c16c4e9f2537fe5f7b7714a83ec"
last-modified: Tue, 25 Mar 2025 00:52:20 GMT
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9290uNtC6nVjeqOT8Pj9lIBxS12%2BwWTbpRrcRVE3AWyFKHD8bctqmGnt6t%2B4s8Ai4S8ximTkiqZNgw3rhyw7cZfm0dLAH1jO15oO7RZjFynPG6QlqOemU3gqHkqcAYGo2cxBNw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 93a1664729f27128-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=531&min_rtt=426&rtt_var=188&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3236&recv_bytes=1064&delivery_rate=7109656&cwnd=254&unsent_bytes=0&cid=34768541d9f2ad26&ts=222&x=0"
X-Firefox-Spdy: h2
|
|
| divisiondrearilyunfiled.com/check.html | 94.242.247.24 | 200 OK | 926 B |
URL GET divisiondrearilyunfiled.com/check.html IP94.242.247.24:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerBuypass AS-983163327 Subject FingerprintCF:34:D4:54:A1:7A:18:F4:1A:75:2E:BB:C8:B3:74:87:96:B5:A3:6C ValidityMon, 03 Mar 2025 23:54:00 GMT - Sat, 30 Aug 2025 21:59:00 GMT
File typeHTML document, ASCII text Hash088dba8e97eede53134c93219f7ebbae adb707654d1fe0af7d0d7a9f55660d22bd3625e4 6da0120b4c7bc45b63fcbb87595c3c1ea2cdca482b0c48d4d2ab434f9e897aff
GET /check.html HTTP/1.1
Host: divisiondrearilyunfiled.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 03 May 2025 17:15:18 GMT
content-type: text/html; charset=utf-8
last-modified: Wed, 16 Apr 2025 07:53:28 GMT
vary: Accept-Encoding
etag: W/"67ff61f8-39e"
x-js-ab: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| ww297q.cloudatacdn.com/favicon.ico?i |  141.94.131.202 | 200 OK | 15 kB |
URL GET ww297q.cloudatacdn.com/favicon.ico?i IP141.94.131.202:443
Requested bymoz-nullprincipal:{f62e0184-0b94-478e-b9d0-476e8790164d}?https://do7go.com CertificateIssuerSectigo Limited Subject*.cloudatacdn.com FingerprintD9:CB:D6:1F:B4:DA:36:1F:52:6C:5B:2E:68:48:4B:77:51:76:16:5B ValidityWed, 31 Jul 2024 00:00:00 GMT - Thu, 31 Jul 2025 23:59:59 GMT
File typeMS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel Hash30d3656f43c817e38c3e7d70b2bfbdad 1aa43b43755e7cba5e145d0978517f7bedad7da6 a558a4796f60f07743027eec96b538b2e7758cca8c544ed796ff745837478555
GET /favicon.ico?i HTTP/1.1
Host: ww297q.cloudatacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:18 GMT
Content-Type: image/vnd.microsoft.icon
Content-Length: 15406
Connection: keep-alive
Last-Modified: Sat, 29 Feb 2020 09:26:04 GMT
ETag: "3c2e-59fb38b06e300"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
|
|
| ukankingwithea.com/ | 104.21.32.1 | 200 OK | 26 B |
IP104.21.32.1:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectukankingwithea.com Fingerprint02:15:28:2A:F2:F8:5D:3A:DE:6D:1D:DC:CF:6D:06:BA:00:3A:63:70 ValidityTue, 29 Apr 2025 13:46:48 GMT - Mon, 28 Jul 2025 14:44:24 GMT
File typeASCII text, with no line terminators Hash20aba9658ba4af825e450ed65ee5ed1b bc66a4e092f3809719a8682fde6f06d69b9c16d2 24d79ef6eb760993d903d89718c8c1c883cde064f1dbc6ea8d212c65050e0e92
GET / HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:18 GMT
content-type: text/plain
server: cloudflare
access-control-allow-origin: https://do7go.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
content-encoding: br
set-cookie: csu=480869813167078@1@1746292518; SameSite=None; Secure; Max-Age=31104000
cf-ray: 93a166501c6f56b5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| skippaccustom.org/S0N6YlYqIRkPaSp+GEQjOS9HR2QNZkgkMngmDwBkLnFLBjV9K0pMNScsDwYwOSwUFnglJg5HZA0MKTQcJCEXLycbEiMrDg9zTSYQBRAfNRwoGxYwYC8BHQEUInoMJhcNFjYIZwwHKxU9LwIzBhIIIBM0BDgiPhoTCAgrV2ANEg07Fw8GICMTLBs3GAwdGxE3OgY0IygOJntJIDF6Jh8qBwEAHSRmEShOAxMyGk80BwoKNTYbDQUNDSwCAjArECIrDCAHDhkzJmIOB0o4YQ0FSyMDeTsdNRMSFjMmIQYCKDNgL3IKBxIfckk1On4QHzouEhBLIxovclcSMw0AO1oOJzM9Bz4JDSIkGzMZPBoaHgIOUQEndygyZS8hNlMcfRkRODMYLgIFAQooPSk8IAspUxMbGjwKMB5wFggBDXo9B2QCDDgaEzgNOwEBGS0JNwEdciI4ZAEMPVNjf2UQETklM0cXLw0AECU7eAQeFDUzCBI | 108.138.7.103 | 200 OK | 3.1 kB |
URL GET skippaccustom.org/S0N6YlYqIRkPaSp+GEQjOS9HR2QNZkgkMngmDwBkLnFLBjV9K0pMNScsDwYwOSwUFnglJg5HZA0MKTQcJCEXLycbEiMrDg9zTSYQBRAfNRwoGxYwYC8BHQEUInoMJhcNFjYIZwwHKxU9LwIzBhIIIBM0BDgiPhoTCAgrV2ANEg07Fw8GICMTLBs3GAwdGxE3OgY0IygOJntJIDF6Jh8qBwEAHSRmEShOAxMyGk80BwoKNTYbDQUNDSwCAjArECIrDCAHDhkzJmIOB0o4YQ0FSyMDeTsdNRMSFjMmIQYCKDNgL3IKBxIfckk1On4QHzouEhBLIxovclcSMw0AO1oOJzM9Bz4JDSIkGzMZPBoaHgIOUQEndygyZS8hNlMcfRkRODMYLgIFAQooPSk8IAspUxMbGjwKMB5wFggBDXo9B2QCDDgaEzgNOwEBGS0JNwEdciI4ZAEMPVNjf2UQETklM0cXLw0AECU7eAQeFDUzCBI IP108.138.7.103:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerAmazon Subjectskippaccustom.org Fingerprint15:49:95:51:A8:90:D7:56:43:5C:64:FD:78:CB:BB:EF:FF:14:0D:3A ValiditySun, 06 Apr 2025 00:00:00 GMT - Tue, 05 May 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (3070), with no line terminators Hashfcf6991e1dc02756b195b148c060c4e5 782fb8a2cd681b1d5e4bbd5cc450bf11d204fe3e fcee27608667769ebfdae79516647da33029f1c7220535c62cd8f5d002b1c8fb
GET /S0N6YlYqIRkPaSp+GEQjOS9HR2QNZkgkMngmDwBkLnFLBjV9K0pMNScsDwYwOSwUFnglJg5HZA0MKTQcJCEXLycbEiMrDg9zTSYQBRAfNRwoGxYwYC8BHQEUInoMJhcNFjYIZwwHKxU9LwIzBhIIIBM0BDgiPhoTCAgrV2ANEg07Fw8GICMTLBs3GAwdGxE3OgY0IygOJntJIDF6Jh8qBwEAHSRmEShOAxMyGk80BwoKNTYbDQUNDSwCAjArECIrDCAHDhkzJmIOB0o4YQ0FSyMDeTsdNRMSFjMmIQYCKDNgL3IKBxIfckk1On4QHzouEhBLIxovclcSMw0AO1oOJzM9Bz4JDSIkGzMZPBoaHgIOUQEndygyZS8hNlMcfRkRODMYLgIFAQooPSk8IAspUxMbGjwKMB5wFggBDXo9B2QCDDgaEzgNOwEBGS0JNwEdciI4ZAEMPVNjf2UQETklM0cXLw0AECU7eAQeFDUzCBI HTTP/1.1
Host: skippaccustom.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1219
date: Sat, 03 May 2025 17:15:18 GMT
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
set-cookie: AWSALB=NeZE4ruEzzkVPRgQx55w1pyJ6NVxd40KZWT5PFN3tOjlXpva1QU2ZPk0e2JA+lrNPJQAwiyM7dTebqJqZuBwkgmStLn040bF4Wnsi/CsxHmcn2MIkxWAhwY9XPBm; Expires=Sat, 10 May 2025 17:15:18 GMT; Path=/
AWSALBCORS=NeZE4ruEzzkVPRgQx55w1pyJ6NVxd40KZWT5PFN3tOjlXpva1QU2ZPk0e2JA+lrNPJQAwiyM7dTebqJqZuBwkgmStLn040bF4Wnsi/CsxHmcn2MIkxWAhwY9XPBm; Expires=Sat, 10 May 2025 17:15:18 GMT; Path=/; SameSite=None
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 ecb3ea567a6c6095a23354fbdc938128.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: HB_4hHnjxi2FWjQhbdyNaY2RAM_Um2bpVZcQmb8peuyu4yXx7hy4lA==
X-Firefox-Spdy: h2
|
|
| widget.supercounters.com/ssl/texthit.js | 104.21.16.1 | 200 OK | 2.5 kB |
URL GET widget.supercounters.com/ssl/texthit.js IP104.21.16.1:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subjectsupercounters.com Fingerprint0B:8E:25:66:E0:67:33:FA:A1:AE:3D:39:47:86:65:99:9A:3C:DD:E3 ValidityMon, 31 Mar 2025 22:34:34 GMT - Sun, 29 Jun 2025 23:30:10 GMT
File typeASCII text, with CRLF line terminators Hashef3dec9754e78264ead09f01ab971ab5 250f936c6ad03858d3b97d34ae8c18d08ccbab1d 8b99af59e75387bad78d5131c9422c5524fa6a4e9fa1f706a1963ac6a34c3a4a
GET /ssl/texthit.js HTTP/1.1
Host: widget.supercounters.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript
server: cloudflare
last-modified: Thu, 03 Mar 2022 12:17:42 GMT
cf-cache-status: HIT
cache-control: max-age=300
etag: W/"6220b1e6-9bc"
content-encoding: br
cf-ray: 93a16646ffbc56c9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js | 104.17.25.14 | 200 OK | 1.3 kB |
URL GET cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js IP104.17.25.14:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT
File typeJavaScript source, ASCII text, with very long lines (1266) Hash4412bf8023109ee9eb1f1f226d391329 c273960aa874a87dd022b5e597887142f1b8e34f d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
GET /ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 591
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 93a16649cd7f0afa-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec1-514"
last-modified: Mon, 04 May 2020 16:11:45 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 137814
expires: Thu, 23 Apr 2026 17:15:17 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vAToL64xJTA%2FxDPJsInsK2e7xhCyiAEqYj%2BR8E7siJrJjIKspM2CJtsKkV%2FHtT2dFR1qkCDVremL2KnkKwlAV9FOFUofBS5L3gHVzj%2BJcG%2BNy06cf24Ut6%2B0WFUGZ7sqN%2BYux99u"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| undefined/SmJ2SVUrABUkaitfFG8gOA5LbGcMR0QPMXkHAytnL1BHLTZ8CkZnNiYNAy0zOA0YPXskBwJsZwxWLCRlPQYyLhMLDkIaFzIrMx8QISggJWUPMDdwBhlSNw4NGyAnHxc5MjcYHC8kRyoZGVMZAQM9BRINAS40OiM9HidFfQQaUz9+FntWMRwvCwczITEfMSchFAs0MygNexY6Hwc6ACF4Ih0kID4QHyMkGgEbBicRBz4hMj4TKSQkeAABFSAoFg8sEAgTMjIyPhsfJUZxAxkjPAwDIig/CD4bKCAiGAs3Jzo+GSM8DAE9WjILPgsGIBptHDARLjAdFVsbBwkbJAAUITA9DBAtJjgYORw1JHwQDzc4LxQILBILBBAEIxg6LToBCxMJJCwqFA83Eh8TezU+HDoOIUdxGAI0JzsUHwE7GhN6NTcYAxJEHDo6JBJLCjgCNxUuEzwwFAZmcgkVDQ | 0.0.0.0 | | 0 B |
URL GET undefined/SmJ2SVUrABUkaitfFG8gOA5LbGcMR0QPMXkHAytnL1BHLTZ8CkZnNiYNAy0zOA0YPXskBwJsZwxWLCRlPQYyLhMLDkIaFzIrMx8QISggJWUPMDdwBhlSNw4NGyAnHxc5MjcYHC8kRyoZGVMZAQM9BRINAS40OiM9HidFfQQaUz9+FntWMRwvCwczITEfMSchFAs0MygNexY6Hwc6ACF4Ih0kID4QHyMkGgEbBicRBz4hMj4TKSQkeAABFSAoFg8sEAgTMjIyPhsfJUZxAxkjPAwDIig/CD4bKCAiGAs3Jzo+GSM8DAE9WjILPgsGIBptHDARLjAdFVsbBwkbJAAUITA9DBAtJjgYORw1JHwQDzc4LxQILBILBBAEIxg6LToBCxMJJCwqFA83Eh8TezU+HDoOIUdxGAI0JzsUHwE7GhN6NTcYAxJEHDo6JBJLCjgCNxUuEzwwFAZmcgkVDQ IP0.0.0.0:0
Requested byhttps://do7go.com/e/ukbeetm88h2y
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /SmJ2SVUrABUkaitfFG8gOA5LbGcMR0QPMXkHAytnL1BHLTZ8CkZnNiYNAy0zOA0YPXskBwJsZwxWLCRlPQYyLhMLDkIaFzIrMx8QISggJWUPMDdwBhlSNw4NGyAnHxc5MjcYHC8kRyoZGVMZAQM9BRINAS40OiM9HidFfQQaUz9+FntWMRwvCwczITEfMSchFAs0MygNexY6Hwc6ACF4Ih0kID4QHyMkGgEbBicRBz4hMj4TKSQkeAABFSAoFg8sEAgTMjIyPhsfJUZxAxkjPAwDIig/CD4bKCAiGAs3Jzo+GSM8DAE9WjILPgsGIBptHDARLjAdFVsbBwkbJAAUITA9DBAtJjgYORw1JHwQDzc4LxQILBILBBAEIxg6LToBCxMJJCwqFA83Eh8TezU+HDoOIUdxGAI0JzsUHwE7GhN6NTcYAxJEHDo6JBJLCjgCNxUuEzwwFAZmcgkVDQ HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| fonts.googleapis.com/css?family=Roboto | 142.250.74.10 | 200 OK | 5.5 kB |
URL GET fonts.googleapis.com/css?family=Roboto IP142.250.74.10:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint06:13:4C:49:F4:23:BB:58:C3:31:41:0E:F9:E0:C5:EF:74:A9:0C:67 ValidityMon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
File typeASCII text, with very long lines (1572) Hash4bc672c05c21882d2a3bceff73dc6bf9 e174c25a2513d0f6f8dba7284ba34e40ba77aa3e e9b0ffd113504bae48ab96bfb28583b11db871dc76dbcbf04fe3eb229b48bcd9
GET /css?family=Roboto HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 03 May 2025 17:15:15 GMT
date: Sat, 03 May 2025 17:15:15 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| bodgertyphous.top/r68155c81f00b4/70849 | 94.242.236.141 | 200 OK | 62 kB |
URL GET bodgertyphous.top/r68155c81f00b4/70849 IP94.242.236.141:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerZeroSSL Subjectbodgertyphous.top FingerprintCA:81:3D:C8:64:67:8A:78:E6:82:06:6F:BF:6A:77:78:19:DE:0E:4C ValidityThu, 01 May 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (61454), with no line terminators Hashf8eaba596268cf88fa7cd97ca665adf8 ce8d1457d903611effbf8152315f48b1652a52e7 3b1fdc9a5ea0a09ae773035a068160e896032a74dfd4f3e2238e2b69914701c6
GET /r68155c81f00b4/70849 HTTP/1.1
Host: bodgertyphous.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://do7go.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Sun, 04-May-2025 17:15:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Sun, 04-May-2025 17:15:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| bluehomework.com/YV2.xWpXZYW_5a0bZcGdF-0fYgTh9iy_ckmllmknP-TpdqmrMsD_kuxvZwTxB-izYA2BVCl_YEWFMG0HY-TJlKkLNMW_NOkPYQzRk-yTYUTVQWx_MYmZMa5bM-jdQe0f | 88.85.68.219 | 200 OK | 0 B |
URL POST bluehomework.com/YV2.xWpXZYW_5a0bZcGdF-0fYgTh9iy_ckmllmknP-TpdqmrMsD_kuxvZwTxB-izYA2BVCl_YEWFMG0HY-TJlKkLNMW_NOkPYQzRk-yTYUTVQWx_MYmZMa5bM-jdQe0f IP88.85.68.219:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subjectbluehomework.com Fingerprint81:77:64:B1:0E:35:C0:8C:25:6B:D0:29:DE:78:0C:D5:19:8B:F8:ED ValidityFri, 11 Apr 2025 22:05:26 GMT - Thu, 10 Jul 2025 22:05:25 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /YV2.xWpXZYW_5a0bZcGdF-0fYgTh9iy_ckmllmknP-TpdqmrMsD_kuxvZwTxB-izYA2BVCl_YEWFMG0HY-TJlKkLNMW_NOkPYQzRk-yTYUTVQWx_MYmZMa5bM-jdQe0f HTTP/1.1
Host: bluehomework.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 54
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 03 May 2025 17:15:17 GMT
content-length: 0
expires: Mon, 26 Jul 2011 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
x-content-type-options: nosniff
X-Firefox-Spdy: h2
|
|
| i.doodcdn.io/theme_2/img/loader.svg | 104.26.15.102 | 200 OK | 694 B |
URL GET i.doodcdn.io/theme_2/img/loader.svg IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeexported SGML document, ASCII text Hashbe00fc4a29d03016e78b28c9943e3f51 10f2025f5aa96706cc81e050eadfcaa9bcc55af5 eec2c40d8b1bb98306990239204d8b90ca030f0def0e00dfe3117ae42991e126
GET /theme_2/img/loader.svg HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i.doodcdn.io/css/embed.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: image/svg+xml
last-modified: Mon, 03 Jan 2022 15:43:40 GMT
cache-control: max-age=2592000
expires: Sun, 01 Jun 2025 05:36:40 GMT
access-control-allow-origin: *
cf-cache-status: HIT
age: 46280
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hyt9x2uZnhBieyh%2B%2FmmoRDzPQut4i73TgOke9VrLiAkPIpu%2Ft8Re85lMsp%2BTZlxm8ypQHIfKNpUDi7sRRZN0NatRvtHAgZTdjI0fMqd18zFD1ZgaZqo9cNF%2BqhTTYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664ce9631c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30816&min_rtt=2175&rtt_var=21273&sent=11&recv=6&lost=0&retrans=0&sent_bytes=4085&recv_bytes=1113&delivery_rate=295108&cwnd=12000&unsent_bytes=0&cid=1e35aa82ed720789&ts=560&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| efullofeedshen.com/OTNwMmcWDBNBWm93HH0CbF8bcVRVeBNlPnZXG0ZCC3UqRR8PYB5BQU1aFA9WCQNEAlAKFQBbAwQCVkETWEcFQVoIFRlcAVYOVkRaCB1DBkkKBV4GQUwOQRQTSVIXD1YfQwRGCwQCRwZRCwpCB1YOCkAL | 172.67.158.191 | 204 No Content | 0 B |
URL GET efullofeedshen.com/OTNwMmcWDBNBWm93HH0CbF8bcVRVeBNlPnZXG0ZCC3UqRR8PYB5BQU1aFA9WCQNEAlAKFQBbAwQCVkETWEcFQVoIFRlcAVYOVkRaCB1DBkkKBV4GQUwOQRQTSVIXD1YfQwRGCwQCRwZRCwpCB1YOCkAL IP172.67.158.191:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectefullofeedshen.com Fingerprint0C:E4:11:07:1D:40:1B:2C:6E:69:17:1B:05:1A:0B:F5:C8:8D:17:D2 ValidityThu, 03 Apr 2025 11:44:01 GMT - Wed, 02 Jul 2025 12:42:34 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /OTNwMmcWDBNBWm93HH0CbF8bcVRVeBNlPnZXG0ZCC3UqRR8PYB5BQU1aFA9WCQNEAlAKFQBbAwQCVkETWEcFQVoIFRlcAVYOVkRaCB1DBkkKBV4GQUwOQRQTSVIXD1YfQwRGCwQCRwZRCwpCB1YOCkAL HTTP/1.1
Host: efullofeedshen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sat, 03 May 2025 17:15:18 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 93a1664dce797127-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/25edc65.js | 162.159.140.237 | 200 OK | 264 kB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/25edc65.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (65485) Size264 kB (264197 bytes) Hash031bcb3589df32aca2b3cf1927586eb1 b136b0773addc657b2a0bd025097deb50fc8bb2f b3120ed90ea0539af3f4c9c50088b6d7dd6e8750bfa4ff2f9c4a3150eea3722b
GET /assets/0.3/25edc65.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:15 GMT
Content-Type: application/javascript
Content-Length: 264197
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "031bcb3589df32aca2b3cf1927586eb1"
Last-Modified: Wed, 26 Feb 2025 06:06:40 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663c7bba5689-OSL
|
|
| img.doodcdn.io/splash/c42gi1bbwdwe8320.jpg | 104.26.15.102 | 200 OK | 55 kB |
URL GET img.doodcdn.io/splash/c42gi1bbwdwe8320.jpg IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1264x715, components 3 Hash783b03132e055eb7ca80ea5b5ddfa7e6 7e3c5fb9a550a76c6169cd553ee8d34494268098 a936f3677f6e9cddc2955e5b548ef6cb5269c7f9dee8744e63c3d87cc88d75ea
GET /splash/c42gi1bbwdwe8320.jpg HTTP/1.1
Host: img.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: image/jpeg
content-length: 54559
access-control-allow-origin: *
cache-control: max-age=1209600
cf-bgj: imgq:100,h2pri
cf-polished: origSize=57363
etag: "68153ea8-e013"
expires: Sat, 17 May 2025 13:40:22 GMT
last-modified: Fri, 02 May 2025 21:52:40 GMT
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yI0fx4br%2BQ4Xbhe1ZqSDVgZ47ZKTjWkekKRDvXzrA14Kutgpm7T7SUopG8Dwgdgi%2FS7e6aWnxudrQlyZVrPlIANqQ0vB8CByQpOS%2BsS%2F8ZGWXzQQimmtO8Ask47DLlGi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a16649cf9e0b31-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1070&min_rtt=409&rtt_var=222&sent=117&recv=36&lost=0&retrans=0&sent_bytes=141360&recv_bytes=1578&delivery_rate=65914831&cwnd=257&unsent_bytes=0&cid=7f09d69b8c06f0c1&ts=644&x=0"
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/video.js/7.21.5/video.min.js | 104.17.25.14 | 200 OK | 589 kB |
URL GET cdnjs.cloudflare.com/ajax/libs/video.js/7.21.5/video.min.js IP104.17.25.14:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (48459) Size589 kB (589278 bytes) Hashd7fdaaab43bc993b85290c713fd2d289 46bf3d27b2cf38b0e999d3b0a7613011181c87f9 c9535ea3a4e0af22e960ac1e32d363a71029f31aa96b29fc894e111fee49329e
GET /ajax/libs/video.js/7.21.5/video.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 137405
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 93a166498d070afa-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "64bb5c88-218bd"
last-modified: Sat, 22 Jul 2023 04:35:20 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 21493
expires: Thu, 23 Apr 2026 17:15:17 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tOgOXtlX%2BJwkJoF%2FbIwF2SgW697Lty%2B9HNPa3zjaAIlsvx3%2B1bnJoQTbXmMzzbC2yiGwskRMJqSfHgAplvkLjpi%2BSwc2zS8xYNiUKU4NF4XMelEaAuyR6fAmj1jOW7iubwgD01xN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| do7go.com/pass_md5/204087696-91-90-1746292517-1d0f1ee13324ab5a2ea7c3f20c805f8d/9i5tp9rhtechrno55fynn8x4 | 104.26.8.147 | 200 OK | 103 B |
URL GET do7go.com/pass_md5/204087696-91-90-1746292517-1d0f1ee13324ab5a2ea7c3f20c805f8d/9i5tp9rhtechrno55fynn8x4 IP104.26.8.147:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdo7go.com Fingerprint62:14:72:A9:A1:C9:E5:FE:80:F8:A6:E1:89:21:66:B4:38:8B:DF:5B ValidityThu, 20 Mar 2025 08:57:50 GMT - Wed, 18 Jun 2025 09:56:23 GMT
File typeASCII text, with no line terminators Hashf97930bf9653cd68af202c53f9853667 cd199401fabc646557704c83fec95663875cb70a 4528140b4604b6c1afd5a4b7e437e71e37eafc984136aa0a7b2b561eba54f1f0
GET /pass_md5/204087696-91-90-1746292517-1d0f1ee13324ab5a2ea7c3f20c805f8d/9i5tp9rhtechrno55fynn8x4 HTTP/1.1
Host: do7go.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/e/ukbeetm88h2y
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 03 May 2025 17:15:18 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2BNa%2BFsWopwyW7ZrB0popqB2jUtH9ZaS9Rf8vU2W9EppnLK4sRDrbnE7L2qE%2FxyM6nVTlkU51MM6YC%2B3K904QlE74SjNW04d8wDhf8EK16et4sW3qOHHfKGbag%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664ceedf56b1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2523&min_rtt=1296&rtt_var=1362&sent=12&recv=8&lost=0&retrans=0&sent_bytes=4144&recv_bytes=1264&delivery_rate=185337&cwnd=12000&unsent_bytes=0&cid=e404a91c9b4d34bd&ts=927&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| cdn.tsyndicate.com/ed85951b219e49ffa74b7b74a3c8089c.js | 45.133.44.71 | 404 Not Found | 0 B |
URL GET cdn.tsyndicate.com/ed85951b219e49ffa74b7b74a3c8089c.js IP45.133.44.71:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerLet's Encrypt Subjectcdn.tsyndicate.com FingerprintC8:21:B5:22:CE:B2:90:D0:CE:CF:F7:57:FA:B4:14:52:BA:AF:3B:EF ValidityFri, 04 Apr 2025 07:32:05 GMT - Thu, 03 Jul 2025 07:32:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ed85951b219e49ffa74b7b74a3c8089c.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Sat, 03 May 2025 17:15:17 GMT
content-type: text/html; charset=utf-8
server: nginx
content-encoding: gzip
x-cdn-host-id: ds9612,ds5859
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| i.doodcdn.io/img/logo-s.png | 104.26.15.102 | 200 OK | 1.9 kB |
URL GET i.doodcdn.io/img/logo-s.png IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeRIFF (little-endian) data, Web/P image Hashf0c6bed8c2b7297aab801aa1c449dd14 f44f3ee770d099eedc8ecc32fe5d5a2be9d6bd16 0c591bf4d1b3bd51127f30c9c1f4a727bdf146a60d1a8106bfd575f2bf68c9f3
GET /img/logo-s.png HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 03 May 2025 17:15:18 GMT
content-type: image/webp
content-length: 1932
access-control-allow-origin: *
cache-control: public, max-age=2592000, no-transform
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=png, origSize=6212
content-disposition: inline; filename="logo-s.webp"
etag: "61d3187c-1844"
expires: Sun, 01 Jun 2025 09:06:04 GMT
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
vary: Accept
cf-cache-status: HIT
age: 41140
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4B9y3CMoXVuVnhJgasRyMFWXisvi30bPIFDaOx%2BXOiipokcj%2F3ekdU7po2SMfyRlVhMcAb6VJ0MjvEPQ%2FeQv0qre8EGx7IoXvMgTOo4Hr%2F1cnEgfwCmT6JWWTY63tw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664f3c281c06-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=29571&min_rtt=2175&rtt_var=18445&sent=13&recv=8&lost=0&retrans=0&sent_bytes=5257&recv_bytes=1431&delivery_rate=2304&cwnd=12000&unsent_bytes=0&cid=1e35aa82ed720789&ts=915&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| divisiondrearilyunfiled.com/solid.gif?z=1941940&nojs=0&abvar=0&febuild=1.0.539&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&fn=3&es=13&ge=2&th=z02kQ6a-f&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=801&y=801&md=0&psu=MYsIZF7aHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnk&afid=3210669770334720&eclog=0&snc=0&ssc=0&vp=1&dto=2&im=1&noch=1&de=0&cs=5 | 94.242.247.24 | 200 OK | 43 B |
URL POST divisiondrearilyunfiled.com/solid.gif?z=1941940&nojs=0&abvar=0&febuild=1.0.539&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&fn=3&es=13&ge=2&th=z02kQ6a-f&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=801&y=801&md=0&psu=MYsIZF7aHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnk&afid=3210669770334720&eclog=0&snc=0&ssc=0&vp=1&dto=2&im=1&noch=1&de=0&cs=5 IP94.242.247.24:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerBuypass AS-983163327 Subject FingerprintCF:34:D4:54:A1:7A:18:F4:1A:75:2E:BB:C8:B3:74:87:96:B5:A3:6C ValidityMon, 03 Mar 2025 23:54:00 GMT - Sat, 30 Aug 2025 21:59:00 GMT
File typeGIF image data, version 89a, 1 x 1 Hash28e463819a210071de3b45ebe7633613 6dccd571828ec0912629119cf7eabfea9f33ddbc 44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
POST /solid.gif?z=1941940&nojs=0&abvar=0&febuild=1.0.539&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&fn=3&es=13&ge=2&th=z02kQ6a-f&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=801&y=801&md=0&psu=MYsIZF7aHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnk&afid=3210669770334720&eclog=0&snc=0&ssc=0&vp=1&dto=2&im=1&noch=1&de=0&cs=5 HTTP/1.1
Host: divisiondrearilyunfiled.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Cookie: cart=1; cart_p=2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
server: nginx
date: Sat, 03 May 2025 17:15:18 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
set-cookie: CHCK=1; Path=/; Expires=Sat, 06 Jun 2026 17:15:18 GMT; Secure; SameSite=None
UID=250503121582445c6718e144a5ad36e9f197; Path=/; Expires=Sat, 06 Jun 2026 17:15:18 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
|
|
| accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube | 74.125.131.84 | 302 Found | 0 B |
URL GET accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube IP74.125.131.84:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint52:D3:F7:7E:94:6F:70:55:50:A6:EA:38:4B:15:DF:91:54:96:59:82 ValidityMon, 31 Mar 2025 08:56:30 GMT - Mon, 23 Jun 2025 08:56:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:yqRSAiFGNv06S2mcfJUL8sCU4vCRzA:eRMNYPuQ1N-ATDwc; Expires=Mon, 03-May-2027 17:15:18 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 03 May 2025 17:15:18 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKV5MgtzxHkLgQV5JH7onP4Dxog9TxHK3gOaIP6VdQyCifW4PnwQ7GAPRbWNyYBUli9b8rgQtahXw
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-f0GExLLdGe5Tw1XcKXSyCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKV5MhmZByRiPVqXJHONP813UxYBTQLPEeh-W3N3-IpcGgM-YHxZHqthef6jEoqSipC9AtlCvgY1g&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S655121828%3A1746292518520648 | 74.125.131.84 | 403 Forbidden | 0 B |
URL GET accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKV5MhmZByRiPVqXJHONP813UxYBTQLPEeh-W3N3-IpcGgM-YHxZHqthef6jEoqSipC9AtlCvgY1g&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S655121828%3A1746292518520648 IP74.125.131.84:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint52:D3:F7:7E:94:6F:70:55:50:A6:EA:38:4B:15:DF:91:54:96:59:82 ValidityMon, 31 Mar 2025 08:56:30 GMT - Mon, 23 Jun 2025 08:56:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKV5MhmZByRiPVqXJHONP813UxYBTQLPEeh-W3N3-IpcGgM-YHxZHqthef6jEoqSipC9AtlCvgY1g&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S655121828%3A1746292518520648 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 03 May 2025 17:15:18 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-EUYxDNlrqhHTSZD2lPhQuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://translate.google.com/translate_a/element.js https://www.google.com/recaptcha/api.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.E_-11t052Go.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/7b8ec9d.js | 162.159.140.237 | 200 OK | 7.3 kB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/7b8ec9d.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (7276), with no line terminators Hashfff488f4c9cf9c629dad5bc12af7bd51 f0d050ab7e8b9a036c5129a58e1e5670e854afec a11c00cfe15af91d93c02c538bfc30ec82e04f0967b4eca02f6b0d2649ba813d
GET /assets/0.3/7b8ec9d.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:15 GMT
Content-Type: application/javascript
Content-Length: 7276
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "fff488f4c9cf9c629dad5bc12af7bd51"
Last-Modified: Wed, 26 Feb 2025 06:06:52 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663c7af6712d-OSL
|
|
| d3eub2e21dc6h0.cloudfront.net/?ebued=1004073 | 3.167.7.216 | 200 OK | 232 kB |
URL GET d3eub2e21dc6h0.cloudfront.net/?ebued=1004073 IP3.167.7.216:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerAmazon Subject*.cloudfront.net Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62 ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (38488) Size232 kB (232496 bytes) Hashd86dd18c4051ab6a08c0c82a7ffa5e22 60035a0ecd0314c81f440d51ec9da2f37fe5ea2e 7010b14fdd8eff38b0edfd975ec6c9e968c9bf91c0c8dd13bcffee4be3361c75
GET /?ebued=1004073 HTTP/1.1
Host: d3eub2e21dc6h0.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 79250
date: Sat, 03 May 2025 17:15:17 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 0091ee978574700d165730d7f2557c34.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: e43lrFtZOsGXcnLtFD7WTrlolm26HblrUSA9eio0cRW0L7pVy8RVkQ==
X-Firefox-Spdy: h2
|
|
| hoptreeperrie.shop/gd/70849?md=eyJhIjoyNzEsInMiOiIxMjgweDEwMjQiLCJiIjoiNjAweDQ4MCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnkiLCJoIjo3NzgyLCJsIjoiZW4tVVMiLCJ0IjowLCJ6IjozOTkwLCJrIjowLCJ1IjoiIiwiZiI6dHJ1ZSwid2giOiI2MDB4NDgwIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiODYxcXNtbjk0endpdTNvIiwibyI6dHJ1ZSwibSI6MTc0NjI5MjUxODAwMSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyY3JhenklMjBhbGNvaG9saWNzMjUlMjAtJTIwRG9vZFN0cmVhbSUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJ3aW5kb3clM0E1JTIyJTJDJTIybGl2ZSUzQTQlMjIlMkMlMjJ5b3UlM0E0JTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoiTWVzYSIsInZyIjoibGx2bXBpcGUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoidW5rbm93biIsImNkbG0iOi0xLCJjZGwiOi0xLCJjcnR0IjotMSwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&fc=h7q5T8idLKWMMrmW6iTG0g&pr=1YB8DBYXc1mTRxnxJxgO3A | 212.117.186.252 | 200 OK | 0 B |
URL OPTIONS hoptreeperrie.shop/gd/70849?md=eyJhIjoyNzEsInMiOiIxMjgweDEwMjQiLCJiIjoiNjAweDQ4MCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnkiLCJoIjo3NzgyLCJsIjoiZW4tVVMiLCJ0IjowLCJ6IjozOTkwLCJrIjowLCJ1IjoiIiwiZiI6dHJ1ZSwid2giOiI2MDB4NDgwIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiODYxcXNtbjk0endpdTNvIiwibyI6dHJ1ZSwibSI6MTc0NjI5MjUxODAwMSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyY3JhenklMjBhbGNvaG9saWNzMjUlMjAtJTIwRG9vZFN0cmVhbSUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJ3aW5kb3clM0E1JTIyJTJDJTIybGl2ZSUzQTQlMjIlMkMlMjJ5b3UlM0E0JTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoiTWVzYSIsInZyIjoibGx2bXBpcGUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoidW5rbm93biIsImNkbG0iOi0xLCJjZGwiOi0xLCJjcnR0IjotMSwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&fc=h7q5T8idLKWMMrmW6iTG0g&pr=1YB8DBYXc1mTRxnxJxgO3A IP212.117.186.252:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerLet's Encrypt Subjecthoptreeperrie.shop FingerprintC6:93:EA:0D:2E:33:EB:CD:93:C7:EA:53:6D:B5:0C:7B:CC:38:E5:85 ValidityTue, 22 Apr 2025 20:48:41 GMT - Mon, 21 Jul 2025 20:48:40 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
OPTIONS /gd/70849?md=eyJhIjoyNzEsInMiOiIxMjgweDEwMjQiLCJiIjoiNjAweDQ4MCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnkiLCJoIjo3NzgyLCJsIjoiZW4tVVMiLCJ0IjowLCJ6IjozOTkwLCJrIjowLCJ1IjoiIiwiZiI6dHJ1ZSwid2giOiI2MDB4NDgwIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiODYxcXNtbjk0endpdTNvIiwibyI6dHJ1ZSwibSI6MTc0NjI5MjUxODAwMSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyY3JhenklMjBhbGNvaG9saWNzMjUlMjAtJTIwRG9vZFN0cmVhbSUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJ3aW5kb3clM0E1JTIyJTJDJTIybGl2ZSUzQTQlMjIlMkMlMjJ5b3UlM0E0JTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoiTWVzYSIsInZyIjoibGx2bXBpcGUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoidW5rbm93biIsImNkbG0iOi0xLCJjZGwiOi0xLCJjcnR0IjotMSwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&fc=h7q5T8idLKWMMrmW6iTG0g&pr=1YB8DBYXc1mTRxnxJxgO3A HTTP/1.1
Host: hoptreeperrie.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://do7go.com/
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://do7go.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/css/1b7ab17.css | 162.159.140.237 | 200 OK | 395 kB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/css/1b7ab17.css IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size395 kB (395403 bytes) Hash7f7d227d2e30f15741bc0c9b98dbbb13 8966c0b4245cdb223d11b5238dd4a3d30628c6c6 a3f27407cb33454ced62c93365a014b4f530b7ae8d13d585bc6c44a74c110492
GET /assets/0.3/css/1b7ab17.css HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:15 GMT
Content-Type: text/css
Content-Length: 395403
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "7f7d227d2e30f15741bc0c9b98dbbb13"
Last-Modified: Wed, 26 Feb 2025 06:07:15 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663c7e6b0b06-OSL
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/8a29f31.js | 162.159.140.237 | 200 OK | 458 B |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/8a29f31.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (458), with no line terminators Hashf07791c919c7ae14df9d6d78504b4ff4 c84429c2cbdee7be785e6ca0a9e4156b7d54b99e 834100b1c48037891fa77deac4269b98ef82719a5478f9eab897ede4fb17d551
GET /assets/0.3/8a29f31.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:16 GMT
Content-Type: application/javascript
Content-Length: 458
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "f07791c919c7ae14df9d6d78504b4ff4"
Last-Modified: Wed, 26 Feb 2025 06:06:55 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a16642adac56a2-OSL
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/f2fb257.js | 162.159.140.237 | 200 OK | 494 B |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/f2fb257.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (494), with no line terminators Hash4a5e4bae54112801d183e0914d707962 bc00c6afcb6b9a5ef4f9a32b5d93b65344cd8b7f da5b5d047ad023757313fe4b2fc95c856c7f578bf3891a4a7e5fdd4736e257fb
GET /assets/0.3/f2fb257.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: application/javascript
Content-Length: 494
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "4a5e4bae54112801d183e0914d707962"
Last-Modified: Wed, 26 Feb 2025 06:07:11 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a166479c84569f-OSL
|
|
| hoptreeperrie.shop/gd/70849?md=eyJhIjoyNzEsInMiOiIxMjgweDEwMjQiLCJiIjoiNjAweDQ4MCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnkiLCJoIjo3NzgyLCJsIjoiZW4tVVMiLCJ0IjowLCJ6IjozOTkwLCJrIjowLCJ1IjoiIiwiZiI6dHJ1ZSwid2giOiI2MDB4NDgwIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiODYxcXNtbjk0endpdTNvIiwibyI6dHJ1ZSwibSI6MTc0NjI5MjUxODAwMSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyY3JhenklMjBhbGNvaG9saWNzMjUlMjAtJTIwRG9vZFN0cmVhbSUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJ3aW5kb3clM0E1JTIyJTJDJTIybGl2ZSUzQTQlMjIlMkMlMjJ5b3UlM0E0JTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoiTWVzYSIsInZyIjoibGx2bXBpcGUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoidW5rbm93biIsImNkbG0iOi0xLCJjZGwiOi0xLCJjcnR0IjotMSwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&fc=h7q5T8idLKWMMrmW6iTG0g&pr=1YB8DBYXc1mTRxnxJxgO3A | 212.117.186.252 | 200 OK | 669 B |
URL POST hoptreeperrie.shop/gd/70849?md=eyJhIjoyNzEsInMiOiIxMjgweDEwMjQiLCJiIjoiNjAweDQ4MCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnkiLCJoIjo3NzgyLCJsIjoiZW4tVVMiLCJ0IjowLCJ6IjozOTkwLCJrIjowLCJ1IjoiIiwiZiI6dHJ1ZSwid2giOiI2MDB4NDgwIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiODYxcXNtbjk0endpdTNvIiwibyI6dHJ1ZSwibSI6MTc0NjI5MjUxODAwMSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyY3JhenklMjBhbGNvaG9saWNzMjUlMjAtJTIwRG9vZFN0cmVhbSUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJ3aW5kb3clM0E1JTIyJTJDJTIybGl2ZSUzQTQlMjIlMkMlMjJ5b3UlM0E0JTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoiTWVzYSIsInZyIjoibGx2bXBpcGUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoidW5rbm93biIsImNkbG0iOi0xLCJjZGwiOi0xLCJjcnR0IjotMSwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&fc=h7q5T8idLKWMMrmW6iTG0g&pr=1YB8DBYXc1mTRxnxJxgO3A IP212.117.186.252:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerLet's Encrypt Subjecthoptreeperrie.shop FingerprintC6:93:EA:0D:2E:33:EB:CD:93:C7:EA:53:6D:B5:0C:7B:CC:38:E5:85 ValidityTue, 22 Apr 2025 20:48:41 GMT - Mon, 21 Jul 2025 20:48:40 GMT
Hash1cabdf7411dabbb13836fb97011b426b 902e80ad406ac9e457e03366c7e728983e8dce70 2f057e8030225a1e75b18a627f07daf81c5ef8af9e94b651534bbd3209d700ad
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /gd/70849?md=eyJhIjoyNzEsInMiOiIxMjgweDEwMjQiLCJiIjoiNjAweDQ4MCIsInIiOiIiLCJxIjoiaHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnkiLCJoIjo3NzgyLCJsIjoiZW4tVVMiLCJ0IjowLCJ6IjozOTkwLCJrIjowLCJ1IjoiIiwiZiI6dHJ1ZSwid2giOiI2MDB4NDgwIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiODYxcXNtbjk0endpdTNvIiwibyI6dHJ1ZSwibSI6MTc0NjI5MjUxODAwMSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyY3JhenklMjBhbGNvaG9saWNzMjUlMjAtJTIwRG9vZFN0cmVhbSUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJ3aW5kb3clM0E1JTIyJTJDJTIybGl2ZSUzQTQlMjIlMkMlMjJ5b3UlM0E0JTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoiTWVzYSIsInZyIjoibGx2bXBpcGUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoidW5rbm93biIsImNkbG0iOi0xLCJjZGwiOi0xLCJjcnR0IjotMSwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&fc=h7q5T8idLKWMMrmW6iTG0g&pr=1YB8DBYXc1mTRxnxJxgO3A HTTP/1.1
Host: hoptreeperrie.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
Content-Type: application/json
Content-Length: 82
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 17:15:18 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://do7go.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Sun, 04-May-2025 17:15:18 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Sun, 04-May-2025 17:15:18 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| cdn.tsyndicate.com/sdk/v1/puengine.js | 45.133.44.71 | 200 OK | 90 kB |
URL GET cdn.tsyndicate.com/sdk/v1/puengine.js IP45.133.44.71:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerLet's Encrypt Subjectcdn.tsyndicate.com FingerprintC8:21:B5:22:CE:B2:90:D0:CE:CF:F7:57:FA:B4:14:52:BA:AF:3B:EF ValidityFri, 04 Apr 2025 07:32:05 GMT - Thu, 03 Jul 2025 07:32:04 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash87781e1d7683222115078304d2414b35 8bf54dd8a67d75a6f38ab240d47007c12c6e2fdc 37cf30c764c95d5900378ec4e56d09a6088a8b90ed7540c0b7cd3abebba37459
GET /sdk/v1/puengine.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:18 GMT
content-type: application/javascript; charset=utf-8
server: nginx
last-modified: Wed, 15 Jan 2025 14:08:26 GMT
etag: W/"6787c15a-15dda"
x-robots-tag: noindex, nofollow
content-encoding: gzip
cache-control: max-age=172800
expires: Mon, 05 May 2025 17:15:18 GMT
vary: Accept-Encoding
x-cdn-host-id: ah1742,ds5859
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/863688a.js | 162.159.140.237 | 200 OK | 787 kB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/863688a.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size787 kB (787165 bytes) Hashfda73fb22ba263daddd4ef0af67c918f f4cfa41cc8aa0485c223df9ac8949c2cf69451cd bbff6f582d70a2f4776cb1d29a6aefd8995067960e151ebfcc6b7b4fc642637d
GET /assets/0.3/863688a.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:15 GMT
Content-Type: application/javascript
Content-Length: 787165
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "fda73fb22ba263daddd4ef0af67c918f"
Last-Modified: Wed, 26 Feb 2025 06:06:53 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663c78c0569f-OSL
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/23ca741.js | 162.159.140.237 | 200 OK | 458 B |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/23ca741.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (458), with no line terminators Hash60c5d1c2cebd0f33b1631f5e8d6e8dd5 7b40984f5cc3cf0881d4a5683fec547914bc8dd1 39cb9574ec410118c935fa6ad7fc7792d920bde547bfa60a92c2c2ec8c19c2b6
GET /assets/0.3/23ca741.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: application/javascript
Content-Length: 458
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "60c5d1c2cebd0f33b1631f5e8d6e8dd5"
Last-Modified: Wed, 26 Feb 2025 06:06:39 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a166479e0d56a2-OSL
|
|
| service.supercounters.com/fc.php?id=1673103&w=0&v=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0&ref=&url=https%3A%2F%2Fstarsessions.forumgo.net%2F&sw=1280&sh=1024&rand=80 | 172.104.29.90 | 200 OK | 36 B |
URL GET service.supercounters.com/fc.php?id=1673103&w=0&v=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0&ref=&url=https%3A%2F%2Fstarsessions.forumgo.net%2F&sw=1280&sh=1024&rand=80 IP172.104.29.90:443 ASN#63949 Akamai Connected Cloud
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerDigiCert Inc Subject*.supercounters.com Fingerprint14:87:00:FD:88:4C:34:FC:54:93:6C:E2:7A:A6:29:8E:D3:A3:89:F7 ValidityWed, 16 Oct 2024 00:00:00 GMT - Sun, 16 Nov 2025 23:59:59 GMT
File typeASCII text, with CRLF line terminators Hash9d946277f8b80beeb21a717011c404d9 d426456177513749749da4aa214fbf51bebe52e1 f975e4d4ec2fb4347adb7ef20110479fd15b67619e98e9456739592756675649
GET /fc.php?id=1673103&w=0&v=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0&ref=&url=https%3A%2F%2Fstarsessions.forumgo.net%2F&sw=1280&sh=1024&rand=80 HTTP/1.1
Host: service.supercounters.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.13
Content-Encoding: gzip
|
|
| i.doodcdn.io/fonts/avertastd-regular-webfont.woff2 | 104.26.15.102 | 200 OK | 24 kB |
URL GET i.doodcdn.io/fonts/avertastd-regular-webfont.woff2 IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 23812, version 1.524 Hasheb586e5a1b86dbf1c866e3ed80f9d18e 280ee78d19c017ab9335f769595e5157d3c4a343 714e70103deac0d67f52a6285c5fabee6088ce4d710ce7e74353503837038baf
GET /fonts/avertastd-regular-webfont.woff2 HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Referer: https://i.doodcdn.io/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: font/woff2
content-length: 23812
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
cache-control: max-age=2592000
expires: Sun, 01 Jun 2025 03:47:18 GMT
vary: User-Agent,Accept-Encoding
access-control-allow-origin: *
cf-cache-status: HIT
age: 57885
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vUe3vJIUYHFBsCwq27BwoRPc4kiOjLawaQKV5ktc%2BALn7RNxhEloqLXSim%2F8VWmPVQqVbZVVqYoD2gweho0%2BYrLE5b10tkEf0eHCRBTjwLdpBoHEVACWyddc6AW18g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664c7cb656b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4258&min_rtt=2527&rtt_var=2184&sent=11&recv=6&lost=0&retrans=0&sent_bytes=4084&recv_bytes=1160&delivery_rate=254054&cwnd=12000&unsent_bytes=0&cid=a454cfaa24beaa00&ts=42&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| i.doodcdn.io/get_slides/107/c42gi1bbwdwe8320.jpg | 104.26.15.102 | 200 OK | 3.2 kB |
URL GET i.doodcdn.io/get_slides/107/c42gi1bbwdwe8320.jpg IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
Hash755c47117e0831f7175ba1d86cd1f552 41a8e1653234ebd6c8f5cd9901c5f116643b7ad9 0284f96a1c13e002665d3e7ed55ef8da1b91b85a9cb93d8a9f18459065faf811
GET /get_slides/107/c42gi1bbwdwe8320.jpg HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://do7go.com
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 03 May 2025 17:15:18 GMT
content-type: text/vtt
access-control-allow-origin: *
last-modified: Sat, 03 May 2025 00:43:36 GMT
cache-control: max-age=86400
cf-cache-status: HIT
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bZY4pGKOO5OW1AGyIAJutgmqybz0QsBl6zxcKOoTWCeSD7znsNszRPSLflWggZFKvTAyb0Hy2EBUva01qwEZJFuytkssUQvK7GeCzVRcRv7K7eVL3JIVstF2FQYQ0g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a1664f491956b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3110&min_rtt=1362&rtt_var=2179&sent=82&recv=12&lost=0&retrans=0&sent_bytes=86005&recv_bytes=1872&delivery_rate=11893935&cwnd=48000&unsent_bytes=0&cid=a454cfaa24beaa00&ts=533&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/ae9661a.js | 162.159.140.237 | 200 OK | 482 B |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/ae9661a.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (482), with no line terminators Hasheb44255e9fdd369dc182bb49439f9a4a 1748b04e5ed346c97dfc0c5318bb86273f146bad 717d8e4aebe9c73302ad073d8406d1f57418ffd88e24cc0233ad85f060ecd558
GET /assets/0.3/ae9661a.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:17 GMT
Content-Type: application/javascript
Content-Length: 482
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "eb44255e9fdd369dc182bb49439f9a4a"
Last-Modified: Wed, 26 Feb 2025 06:07:01 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1664799e656cb-OSL
|
|
| bluehomework.com/c.D/9k6/b-2Q5/l/SvWwQR9YNyTPIV3/M/zzE/w/OSCB0-1DMYj/cdzHM/THA/5Y | 88.85.68.219 | 200 OK | 42 kB |
URL GET bluehomework.com/c.D/9k6/b-2Q5/l/SvWwQR9YNyTPIV3/M/zzE/w/OSCB0-1DMYj/cdzHM/THA/5Y IP88.85.68.219:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subjectbluehomework.com Fingerprint81:77:64:B1:0E:35:C0:8C:25:6B:D0:29:DE:78:0C:D5:19:8B:F8:ED ValidityFri, 11 Apr 2025 22:05:26 GMT - Thu, 10 Jul 2025 22:05:25 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (22055) Hash25213ee455f4f9fc2f4d98106688eeb0 b7917c8edd2fc879250eceb6e25664ed20f2f156 5b90dc366f19e0f008d4956b91b1e870416a9ead57df6e5ea614c4eff76f154e
GET /c.D/9k6/b-2Q5/l/SvWwQR9YNyTPIV3/M/zzE/w/OSCB0-1DMYj/cdzHM/THA/5Y HTTP/1.1
Host: bluehomework.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://starsessions.forumgo.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript
vary: Accept-Encoding
expires: Mon, 26 Jul 2011 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
access-control-allow-methods: GET
access-control-allow-headers: Content-Type
last-modified: Sat, 03 May 2025 17:15:17 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
set-cookie: kadSlcJ=eyJ0aW1lU3RhbXAiOjE3NDYyOTI1MTcsInpvbmVzIjp7IjUyNzMxMDgiOls1MjczMTA4LDEsMTc0NjI5MjUxN119fQ==; max-age=1777828517; path=/
uniqCookie=99ab3f8c82f276ecd2b7ba9b767ad0ef; max-age=1748884517; path=/
x-content-type-options: nosniff
content-encoding: br
X-Firefox-Spdy: h2
|
|
| i.doodcdn.io/img/no_video_3.svg | 104.26.15.102 | 200 OK | 2.8 kB |
URL GET i.doodcdn.io/img/no_video_3.svg IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeSVG Scalable Vector Graphics image Hash077bfdaa49ae4877a42611b739ec4752 a2f9e1222b7af9abc05122411ab8902efcc08ead 70d6a17097a8c27edfaad6740e11359d9363f3f04bff1b93483e29c25609fa6c
GET /img/no_video_3.svg HTTP/1.1
Host: i.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: image/svg+xml
content-length: 2812
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
etag: "61d3187c-afc"
expires: Mon, 02 Jun 2025 04:06:55 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
cf-cache-status: HIT
age: 40591
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6wGmxlvQdk0Ffxj40Em1fNspCY5Goow13LqKkJxZg5Hej3H31l%2BxKB33SRJe4DqxuIKYQ5C1hZZp59B%2FIguiOiswnLUv6Q0ygNnBcjp91dIzYP6tJfZ9x%2FoCyVU0Tg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a166495f050b31-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1452&min_rtt=409&rtt_var=1676&sent=11&recv=13&lost=0&retrans=0&sent_bytes=4078&recv_bytes=1291&delivery_rate=7883847&cwnd=257&unsent_bytes=0&cid=7f09d69b8c06f0c1&ts=92&x=0"
X-Firefox-Spdy: h2
|
|
| d3eub2e21dc6h0.cloudfront.net/OSVJobmMqPQYIXD07DFNSeWJcXlR6dBgcBi9vDAFULj1GDQwkdAIdDCciVRsaDxECKQ56FQwYADEZAEgXMzZVXkUlMwYJXm83Bg1eeHQJCgF0Zk4aEyY5VQAIOTMFFwozIAJIFihvBQEZID4ED0Z7FF1AU2xgWEYUIDwMARQ6d1peDT13Wl5SeXxYS1ALd1-peFCA8XlpGehBNXFMxZFxLUAt3Wl4RP3dbL1J6ZkZeSmxgWAkGKjkHS1EPYFhfU3ljWF9Ge2IOBxEsNAcWRnsUWV1XZ2JOG154 | 3.167.7.216 | 200 OK | 855 B |
URL GET d3eub2e21dc6h0.cloudfront.net/OSVJobmMqPQYIXD07DFNSeWJcXlR6dBgcBi9vDAFULj1GDQwkdAIdDCciVRsaDxECKQ56FQwYADEZAEgXMzZVXkUlMwYJXm83Bg1eeHQJCgF0Zk4aEyY5VQAIOTMFFwozIAJIFihvBQEZID4ED0Z7FF1AU2xgWEYUIDwMARQ6d1peDT13Wl5SeXxYS1ALd1-peFCA8XlpGehBNXFMxZFxLUAt3Wl4RP3dbL1J6ZkZeSmxgWAkGKjkHS1EPYFhfU3ljWF9Ge2IOBxEsNAcWRnsUWV1XZ2JOG154 IP3.167.7.216:443
Requested byhttps://skippaccustom.org/S0N6YlYqIRkPaSp+GEQjOS9HR2QNZkgkMngmDwBkLnFLBjV9K0pMNScsDwYwOSwUFnglJg5HZA0MKTQcJCEXLycbEiMrDg9zTSYQBRAfNRwoGxYwYC8BHQEUInoMJhcNFjYIZwwHKxU9LwIzBhIIIBM0BDgiPhoTCAgrV2ANEg07Fw8GICMTLBs3GAwdGxE3OgY0IygOJntJIDF6Jh8qBwEAHSRmEShOAxMyGk80BwoKNTYbDQUNDSwCAjArECIrDCAHDhkzJmIOB0o4YQ0FSyMDeTsdNRMSFjMmIQYCKDNgL3IKBxIfckk1On4QHzouEhBLIxovclcSMw0AO1oOJzM9Bz4JDSIkGzMZPBoaHgIOUQEndygyZS8hNlMcfRkRODMYLgIFAQooPSk8IAspUxMbGjwKMB5wFggBDXo9B2QCDDgaEzgNOwEBGS0JNwEdciI4ZAEMPVNjf2UQETklM0cXLw0AECU7eAQeFDUzCBI CertificateIssuerAmazon Subject*.cloudfront.net Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62 ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File typeASCII text, with very long lines (855), with no line terminators Hash1530e6d5de92bc2f7b6102560bc79c89 0cbf321af0c516c583da575c92fdfcb13d21491a af00a75f4e73d6b09aa7d0351f118d640eaf50fbbc1caaf2ad45924bb4bef2a3
GET /OSVJobmMqPQYIXD07DFNSeWJcXlR6dBgcBi9vDAFULj1GDQwkdAIdDCciVRsaDxECKQ56FQwYADEZAEgXMzZVXkUlMwYJXm83Bg1eeHQJCgF0Zk4aEyY5VQAIOTMFFwozIAJIFihvBQEZID4ED0Z7FF1AU2xgWEYUIDwMARQ6d1peDT13Wl5SeXxYS1ALd1-peFCA8XlpGehBNXFMxZFxLUAt3Wl4RP3dbL1J6ZkZeSmxgWAkGKjkHS1EPYFhfU3ljWF9Ge2IOBxEsNAcWRnsUWV1XZ2JOG154 HTTP/1.1
Host: d3eub2e21dc6h0.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://skippaccustom.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 613
date: Sat, 03 May 2025 17:15:18 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 0091ee978574700d165730d7f2557c34.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: -iN2GD5vjDY_La8XhFTmXkaZDQasjvYRdhkIW-63KcOwdrCVJImLbQ==
X-Firefox-Spdy: h2
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/cb42003.js | 162.159.140.237 | 200 OK | 1.9 MB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/cb42003.js IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeJavaScript source, ASCII text, with very long lines (65485) Size1.9 MB (1871959 bytes) Hash3412a6a8cae7d9856dc802bd942cf417 b147969cf63fbb056ac0a2bdd8ce7dba8f53fa54 504dfa2f17db322b33d8756ecffbefb6435ac52a095a3be0b027550239473dd4
GET /assets/0.3/cb42003.js HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:15 GMT
Content-Type: application/javascript
Content-Length: 1871959
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=31536000
ETag: "3412a6a8cae7d9856dc802bd942cf417"
Last-Modified: Wed, 26 Feb 2025 06:07:04 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663c7a1656a2-OSL
|
|
| www.psajushuphu.pro/ecc874/711cee5662df.js | 45.133.44.1 | 200 OK | 70 kB |
URL GET www.psajushuphu.pro/ecc874/711cee5662df.js IP45.133.44.1:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subjectwww.psajushuphu.pro Fingerprint51:48:74:3D:A8:C2:92:68:DA:D0:F2:19:AC:84:D2:28:7F:A2:9B:9C ValidityMon, 28 Apr 2025 07:07:33 GMT - Sun, 27 Jul 2025 07:07:32 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashe57dc6337c9f8a5f45e4d92e44f0a1d8 37759c545645d4607aa90cda8df568c4ef623e1f 77fe761b086ddada890cfb11c9e810cb5d9e60c138a921d066158259aab43157
GET /ecc874/711cee5662df.js HTTP/1.1
Host: www.psajushuphu.pro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
server: nginx
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: Content-Type
cache-control: max-age=172800
content-encoding: gzip
expires: Mon, 05 May 2025 17:15:17 GMT
x-cdn-host-id: ah0543
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKV5MixpnKH16wyAcN6KlDYx1c1nN47a8hP0mTCrcXahiHZ6OaBRotRgBZ1kV5dVlzo1bSuYD4nzw | 74.125.131.84 | 302 Found | 0 B |
URL GET accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKV5MixpnKH16wyAcN6KlDYx1c1nN47a8hP0mTCrcXahiHZ6OaBRotRgBZ1kV5dVlzo1bSuYD4nzw IP74.125.131.84:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint52:D3:F7:7E:94:6F:70:55:50:A6:EA:38:4B:15:DF:91:54:96:59:82 ValidityMon, 31 Mar 2025 08:56:30 GMT - Mon, 23 Jun 2025 08:56:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=ASKV5MixpnKH16wyAcN6KlDYx1c1nN47a8hP0mTCrcXahiHZ6OaBRotRgBZ1kV5dVlzo1bSuYD4nzw HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://do7go.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:pqWK4sZuzqXxOtM72MYVTlqt-vVRTQ:odT17Hl6rLheINrP;Path=/;Expires=Mon, 03-May-2027 17:15:18 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 03 May 2025 17:15:18 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=ASKV5Mj2xvEALCoFbLzhrJrpIYhG6fxz3ByI1_tNBPhAm8kK-dXIOlXn5BOvfYeZkkrtvf5OdXdIHA&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S135243737%3A1746292518507940
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-MhK72EzTdN_2Fe1CJ-iohw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 416
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/fonts/materialdesignicons-webfont.e9db400.woff2 | 162.159.140.237 | 200 OK | 325 kB |
URL GET pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/assets/0.3/fonts/materialdesignicons-webfont.e9db400.woff2 IP162.159.140.237:443
Requested byhttps://starsessions.forumgo.net/ CertificateIssuerLet's Encrypt Subject*.r2.dev FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5 ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 325244, version 1.0 Size325 kB (325244 bytes) Hash7a44ea195f395e1d086010e44555a5c4 5bc948afffe6633639154e024bf047cf3ef81326 da7fba3ca3e0b9cd42a9cd10c7c6ed16d2fdb938174116601cd3d51033c6f490
GET /assets/0.3/fonts/materialdesignicons-webfont.e9db400.woff2 HTTP/1.1
Host: pub-1e27250373774d6ca37239bbf5810b5c.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://starsessions.forumgo.net
DNT: 1
Connection: keep-alive
Referer: https://pub-1e27250373774d6ca37239bbf5810b5c.r2.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 03 May 2025 17:15:16 GMT
Content-Type: font/woff2
Content-Length: 325244
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
ETag: "7a44ea195f395e1d086010e44555a5c4"
Last-Modified: Wed, 26 Feb 2025 06:07:26 GMT
Vary: Origin, Accept-Encoding
Server: cloudflare
CF-RAY: 93a1663f7c74b50f-OSL
|
|
| static.doodcdn.io/js/embed3.js | 104.26.15.102 | 200 OK | 113 kB |
URL GET static.doodcdn.io/js/embed3.js IP104.26.15.102:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerGoogle Trust Services Subjectdoodcdn.io Fingerprint55:EE:8C:FC:C3:6E:6C:90:2B:D0:6B:34:0E:02:CA:FA:E1:1A:08:16 ValidityWed, 05 Mar 2025 17:45:54 GMT - Tue, 03 Jun 2025 18:44:30 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (27236) Size113 kB (112942 bytes) Hash2cdc3aa1ffb8ca7b629675d83b2862dc be0a9072b9559c544d1c852c4559f5a64833c888 f23168d2b1910ff6e49bab3debce5786f7859e9e65ceda07a5554b66fd60f876
GET /js/embed3.js HTTP/1.1
Host: static.doodcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript
content-length: 112942
last-modified: Wed, 05 Mar 2025 20:27:01 GMT
etag: "67c8b395-1b92e"
expires: Mon, 02 Jun 2025 04:30:11 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
cf-cache-status: HIT
age: 22434
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FuHQwDdPsjsZmeIRiX6wktC2EfzzpQ%2Boz6M5Wa5UtvQMUi6ci11EYpNBwo7fLF7TMVLgCoETKsO%2B3%2Bz00fROvKzanUUcNaw%2BiAKWkY27QMB%2BXC7AQqV5F0CE%2FGehy4ljysjh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 93a16649bf8a0b31-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1548&min_rtt=409&rtt_var=1141&sent=33&recv=18&lost=0&retrans=0&sent_bytes=26923&recv_bytes=1578&delivery_rate=16100069&cwnd=257&unsent_bytes=0&cid=7f09d69b8c06f0c1&ts=163&x=0"
X-Firefox-Spdy: h2
|
|
| cdn.tsyndicate.com/sdk/v1/p.js | 45.133.44.71 | 200 OK | 12 kB |
URL GET cdn.tsyndicate.com/sdk/v1/p.js IP45.133.44.71:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerLet's Encrypt Subjectcdn.tsyndicate.com FingerprintC8:21:B5:22:CE:B2:90:D0:CE:CF:F7:57:FA:B4:14:52:BA:AF:3B:EF ValidityFri, 04 Apr 2025 07:32:05 GMT - Thu, 03 Jul 2025 07:32:04 GMT
File typeJavaScript source, ASCII text, with very long lines (12242) Hash86d871d26d14d0f6129ede98ab46bd25 7140c1e643a3ef5394b15d86e7e53db932e25d84 1255376ace55a89f78ef754bf13aa350163b9fa096fa0841ff6475ad1be44911
GET /sdk/v1/p.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:17 GMT
content-type: application/javascript; charset=utf-8
server: nginx
last-modified: Fri, 02 May 2025 10:05:51 GMT
etag: W/"681498ff-301e"
x-robots-tag: noindex, nofollow
content-encoding: gzip
expires: Mon, 05 May 2025 17:15:17 GMT
cache-control: max-age=172800
vary: Accept-Encoding
x-cdn-host-id: ds5859
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| starsessions.forumgo.net/ | 188.114.97.1 | 200 OK | 94 kB |
URL User Request GET starsessions.forumgo.net/ IP188.114.97.1:443
CertificateIssuerGoogle Trust Services Subjectforumgo.net FingerprintE0:D9:83:3B:4E:10:5A:CF:57:A5:10:1B:A9:1A:A1:8A:47:70:5B:51 ValidityWed, 12 Mar 2025 05:56:01 GMT - Tue, 10 Jun 2025 06:53:51 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (28979) Hash431ddce6feb67dba66e5344feea85917 9bef729215d6840a19f2a5c1ac473b2eee1873ee c97fd18c98a6c2379fc1492e5dd5493558e266f63bd4d425e2fef368ca410e92
GET / HTTP/1.1
Host: starsessions.forumgo.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 17:15:15 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=15724800; includeSubDomains
content-security-policy: default-src 'self' https: 'unsafe-inline' wss://api.flashpost.app;img-src 'self' data: https:;font-src 'self' data: https:;script-src 'self' https: 'unsafe-inline' 'unsafe-eval' blob:;object-src 'none';form-action 'self';frame-ancestors 'self';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy: same-origin
permissions-policy: fullscreen=(self), payment=(self), sync-xhr=()
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
set-cookie: auth.strategy=local; Path=/
auth.X-Host=starsessions.forumgo.net; Path=/
cf-ray: 93a166393c3e56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| divisiondrearilyunfiled.com/get/1941940?zoneid=1941940&jp=_cleienwnqeiqiyzglpsuqo&dr=49&nojs=0&abvar=0&febuild=1.0.539&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&fn=3&es=13&ge=2&th=z02kQ6a-f&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=801&y=801&md=0&psu=MYsIZF7aHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnk&afid=3210669770334720&eclog=0&snc=0&ssc=0&vp=1&dto=2&im=1&noch=1&de=0&cs=5&uf=0 | 94.242.247.24 | 200 OK | 3.3 kB |
URL GET divisiondrearilyunfiled.com/get/1941940?zoneid=1941940&jp=_cleienwnqeiqiyzglpsuqo&dr=49&nojs=0&abvar=0&febuild=1.0.539&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&fn=3&es=13&ge=2&th=z02kQ6a-f&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=801&y=801&md=0&psu=MYsIZF7aHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnk&afid=3210669770334720&eclog=0&snc=0&ssc=0&vp=1&dto=2&im=1&noch=1&de=0&cs=5&uf=0 IP94.242.247.24:443
Requested byhttps://do7go.com/e/ukbeetm88h2y CertificateIssuerBuypass AS-983163327 Subject FingerprintCF:34:D4:54:A1:7A:18:F4:1A:75:2E:BB:C8:B3:74:87:96:B5:A3:6C ValidityMon, 03 Mar 2025 23:54:00 GMT - Sat, 30 Aug 2025 21:59:00 GMT
File typeASCII text, with very long lines (3285), with no line terminators Hashb9cb89e0d555173fde0b98f3f2a0698c 93f3682422cb7e83f73960bfff6341e2abdfefd1 68ebfc2e341147f104b5684775de3c3ed857d7b33efbfa32863425bcf76ed50f
GET /get/1941940?zoneid=1941940&jp=_cleienwnqeiqiyzglpsuqo&dr=49&nojs=0&abvar=0&febuild=1.0.539&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&fn=3&es=13&ge=2&th=z02kQ6a-f&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=801&y=801&md=0&psu=MYsIZF7aHR0cHM6Ly9kbzdnby5jb20vZS91a2JlZXRtODhoMnk&afid=3210669770334720&eclog=0&snc=0&ssc=0&vp=1&dto=2&im=1&noch=1&de=0&cs=5&uf=0 HTTP/1.1
Host: divisiondrearilyunfiled.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://do7go.com/
Cookie: cart=1; cart_p=2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 03 May 2025 17:15:18 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: UID=250503121534c85cb70afb436283ca7abbb1; Path=/; Expires=Sat, 06 Jun 2026 17:15:18 GMT; Secure; SameSite=None
CHCK=1; Path=/; Expires=Sat, 06 Jun 2026 17:15:18 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
|
|