Edit tour

Windows Analysis Report
http://yx62415.fyi

Overview

General Information

Sample URL:	http://yx62415.fyi
Analysis ID:	1523591
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Found iframes

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Submit button contains javascript call

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2224,i,8571608066125043265,10275593808496756190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://yx62415.fyi" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://yx62415.fyi/	HTTP Parser: Iframe src: https://tgonly-image-hk.tgchat111.com/crossStorage.html
Source: http://yx62415.fyi/	HTTP Parser: Iframe src: https://tgonly-image-hk.tgchat111.com/crossStorage.html
Source: http://yx62415.fyi/	HTTP Parser: Iframe src: https://tgonly-image-hk.tgchat111.com/crossStorage.html
Source: http://yx62415.fyi/	HTTP Parser: Iframe src: https://tgonly-image-hk.tgchat111.com/crossStorage.html
Source: http://yx62415.fyi/	HTTP Parser: Iframe src: https://tgonly-image-hk.tgchat111.com/crossStorage.html

Source: http://yx62415.fyi/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: http://gopayjc984717.com/

HTTP Parser: Base64 decoded: {"uuid":"6e931c12-c439-4407-9e65-33007686623a","page_time":1727806228,"page_url":"http://gopayjc984717.com/","page_method":"GET","page_request":{},"page_headers":{},"host":"gopayjc984717.com","ip":"8.46.123.33"}

Source: http://yx62415.fyi/

HTTP Parser: Title: Welcome does not match URL

Source: http://yx62415.fyi/

HTTP Parser: Has password / email / username input fields

Source: http://yx62415.fyi/	HTTP Parser: On click: aLeftForm1Sub()
Source: http://yx62415.fyi/	HTTP Parser: On click: aLeftForm1Sub()
Source: http://yx62415.fyi/	HTTP Parser: On click: aLeftForm1Sub()
Source: http://yx62415.fyi/	HTTP Parser: On click: aLeftForm1Sub()
Source: http://yx62415.fyi/	HTTP Parser: On click: aLeftForm1Sub()
Source: http://yx62415.fyi/	HTTP Parser: On click: aLeftForm1Sub()

Source: http://yx62415.fyi/

HTTP Parser: <input type="password" .../> found

Source: http://gopayjc984717.com/	HTTP Parser: No favicon
Source: http://gopayjc984717.com/	HTTP Parser: No favicon
Source: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804	HTTP Parser: No favicon
Source: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804	HTTP Parser: No favicon
Source: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804	HTTP Parser: No favicon
Source: http://sds82215go.com/	HTTP Parser: No favicon
Source: https://lh92d.shepo99.com/	HTTP Parser: No favicon

Source: http://yx62415.fyi/	HTTP Parser: No <meta name="author".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="author".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="author".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="author".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="author".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="author".. found

Source: http://yx62415.fyi/	HTTP Parser: No <meta name="copyright".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="copyright".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="copyright".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="copyright".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="copyright".. found
Source: http://yx62415.fyi/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.4:51776 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: me-qr.com to https://lh92d.shepo99.com/

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /TCaptcha.js HTTP/1.1Host: ssl.captcha.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://yx62415.fyi/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TCaptcha.js HTTP/1.1Host: ssl.captcha.qq.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crossStorage.html HTTP/1.1Host: tgonly-image-hk.tgchat111.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://yx62415.fyi/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://gopayjc984717.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol118%2Cpid-bodis-gcontrol472%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol164&client=dp-bodis30_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fgopayjc984717.com%2F%3Fcaf%3D1%26bpt%3D345&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2262357341367178&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717107&format=r3&nocache=1031727806229361&num=0&output=afd_ads&domain_name=gopayjc984717.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1727806229363&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=816&frm=0&uio=-&cont=rs&drt=0&jsid=caf&nfp=1&jsv=678245571&rurl=http%3A%2F%2Fgopayjc984717.com%2F HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://gopayjc984717.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=f95v4iw178wz&aqid=Fzv8Zp7wEeighcIP87P80A8&psid=3113057640&pbt=bs&adbx=290&adby=143&adbh=480&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=678245571&csala=8%7C0%7C1682%7C1841%7C77&lle=0&ifv=1&hpt=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://gopayjc984717.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=d0ov2c4kounp&aqid=Fzv8Zp7wEeighcIP87P80A8&psid=3113057640&pbt=bv&adbx=290&adby=143&adbh=480&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=678245571&csala=8%7C0%7C1682%7C1841%7C77&lle=0&ifv=1&hpt=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://gopayjc984717.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/enhance.js?pcId=12&domain=oamdikaljka0918471781.com HTTP/1.1Host: parking3.parklogic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/enhance.js?pcId=12&domain=oamdikaljka0918471781.com HTTP/1.1Host: parking3.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=oamdikaljka0918471781.com&pId=130&usid=27&utid=8371154804&query=null&domainJs=ww12.oamdikaljka0918471781.com&path=/dowload/gopay.apk&ss=true&lp=1 HTTP/1.1Host: parking3.parklogic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: http://ww12.oamdikaljka0918471781.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=oamdikaljka0918471781.com&pId=130&usid=27&utid=8371154804&query=null&domainJs=ww12.oamdikaljka0918471781.com&path=/dowload/gopay.apk&ss=true&lp=1 HTTP/1.1Host: parking3.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=bucket007%2C000003%2C001727%2Cbucket070&client=dp-teaminternet12_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.oamdikaljka0918471781.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwNzB8fHx8fHw2NmZjM2IxYzRiZTFhfHx8MTcyNzgwNjIzNi4zNzQ2fDViODVlOTZiZDg3ZTQ0MmIzZmZhNzY2ZDUzN2NjYWQ2ZGM0YTg2Y2R8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTVRKZk0zQm98YWQ3M2E5NjdiNGEzOThlOGUxN2Y0ODdkODQ0YWE3ZTU5YTMxNDFmZXwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGNkNmVjMzU5MzE4OWRiM2E2M2QxNTE2NWNhODcxOGUxZjI5MTFjMTF8MHxkcC10ZWFtaW50ZXJuZXQxMl8zcGh8MHwwfHx8&terms=Ticketmastercom%2CTickets%20and%20Events%2CEvent%20Tickets&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2910317687964208&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=4311727806238939&num=0&output=afd_ads&domain_name=ww12.oamdikaljka0918471781.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1727806238941&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=678245571&rurl=http%3A%2F%2Fww12.oamdikaljka0918471781.com%2Fdowload%2Fgopay.apk%3Fusid%3D27%26utid%3D8371154804 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet12_3ph&output=uds_ads_only&zx=gwt0zgf7byfr&aqid=IDv8Zt-wNI7PhcIPg5HpkAc&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet12_3ph&errv=678245571&csala=10%7C0%7C1478%7C15%7C252&lle=0&ifv=1&hpt=1 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet12_3ph&output=uds_ads_only&zx=wekbjj7vd0k&aqid=IDv8Zt-wNI7PhcIPg5HpkAc&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet12_3ph&errv=678245571&csala=10%7C0%7C1478%7C15%7C252&lle=0&ifv=1&hpt=1 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l/okpay HTTP/1.1Host: me-qr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/home.css HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/swiper-bundle.min.css HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/fontSize.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/index_qr.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/home_header_iphone.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/fontSize.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/android.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/home_header_bg.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/css/home.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/apple.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/tg_icon.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/close_icon.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/index_qr.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/view.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/logo.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/kefu.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/swiper-bundle.min.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/android.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/apple.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/download.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery.min.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery.SuperSlide.2.1.3.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/new.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/advantage_row.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/left.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/right.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/frame.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/tg_icon.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/close_icon.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/nearby.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/Group.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/Vector.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/view.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/logo.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/kefu.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/swiper-bundle.min.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/download.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery.min.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/home_header_iphone.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/serve_item1.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/serve_item2.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/serve_item3.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/left_icon.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/rename1.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery.SuperSlide.2.1.3.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/rename2.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/right.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/left.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/new.js HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/frame.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/rename3.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/tutorial_vector.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/Vector.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/advantage_row.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/serve_item2.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/serve_item1.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/serve_item3.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/nearby.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/collection1.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lh92d.shepo99.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/left_icon.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/tutorial_vector.png HTTP/1.1Host: lh92d.shepo99.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/Font-Awesome/4.7.0/css/font-awesome.min.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/jquery/jquery.min.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/layer/layer.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/jquery/jquery.cookie.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/layer/skin/default/layer.css?v=3.0.11110 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/main.html HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /domain_config HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/chat_float.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/sideslipChat.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/main.html HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/jquery/jquery.min.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/jquery/jquery.cookie.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/layer/layer.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /domain_config HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/css/register_trail.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/css/common.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/css/css.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/lib/js/jquery-1.7.1.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/util/md5.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/util/error.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/chat_float.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/sideslipChat.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/css/float.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/notice.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/util/httpUtil.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/enterLiveGame.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/login.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/register_check.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/register_trail.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/jquery/jquery.SuperSlide.2.1.1.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/lib/js/jquery.liMarquee.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/lib/js/swiper.min.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/lib.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/float.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/commonSite.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/cmsPublicFile/js/loginRedirect.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/Font-Awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveOrigin: http://yx62415.fyiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/js/lib/Font-Awesome/4.7.0/css/font-awesome.min.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/lib/js/jquery-1.7.1.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/util/error.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/util/md5.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/notice.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/util/httpUtil.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/enterLiveGame.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/china.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/image/20220820/20220820185550565961l_842_296.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/login.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/register_check.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/register_trail.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/lib/js/jquery.liMarquee.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/lib/js/swiper.min.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/header/sx.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/header/wm.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lib/jquery/jquery.SuperSlide.2.1.1.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/lib.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/float.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/cmsPublicFile/js/loginRedirect.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/header/ag.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/commonSite.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/china.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/image/20220820/20220820185550565961l_842_296.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/eleGame/css/swiper.min.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/index.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/header/wm.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/header/sx.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/header/ag.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/css/liMarquee.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/jquery.liMarquee.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/css/singleAlertCss.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/css/font-awesome.min.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/css/indexAlertCss.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/css/indexAlertCss2.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/image/20220829/20220829210733397611mtzc_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_download.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/float.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/index.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/js/jquery.liMarquee.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_service.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/float.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_jackpot.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/float.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_game.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/float.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/xpj80/img/index-main-bg-1.jpg HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/css/indexAlertCss3.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_download.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/prizeBg1.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/55.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_jackpot.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/newlivebg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_game.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/json/web_system_config.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/user/regVerify?version=1&clientType=web HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: text/plain, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/float/float_service.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/json/config.json?_=1727806200010 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/cmsPublicFile/css/login.css HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /views/img/55.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/json/limit/registerLimit.json?1727806200005 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/limit/get?name=registerLimit&t=1727806200008 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/json/web_system_config.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB
Source: global traffic	HTTP traffic detected: GET /v/user/regVerify?version=1&clientType=web HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB
Source: global traffic	HTTP traffic detected: GET /views/img/prizeBg1.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB
Source: global traffic	HTTP traffic detected: GET /views/img/newlivebg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB
Source: global traffic	HTTP traffic detected: GET /data/json/limit/registerLimit.json?1727806200914 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/notice_list.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/baseMsg.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/config.json?t=17278062009170.33426557236313315 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/config.json?_=1727806200010 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /v/lottery/getAllOpenInfo HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/lotteryBg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /api/limit/get?name=registerLimit&t=1727806200008 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/limit/registerLimit.json?1727806200005 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/config.json?t=17278062009170.33426557236313315 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/notice_list.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=trueIf-None-Match: W/"9628-1727806199000"If-Modified-Since: Tue, 01 Oct 2024 18:09:59 GMT
Source: global traffic	HTTP traffic detected: GET /views/baseMsg.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/images/bg_gray.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/commData/singleAndDoubleAlert/css/indexAlertCss2.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20191205/20191205204621615264hb_0_0.gif HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/images/alertHot.gif HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/commData/singleAndDoubleAlert/css/indexAlertCss2.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/limit/registerLimit.json?1727806200914 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220831/20220831204043441175202207301834302873301-5_0_0_0_0.gif HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/notice_list.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/lotteryBg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220901/202209012244388767132022_700_500.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220831/20220831204219776887fgbujbf_640_280.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/images/bg_gray.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/commData/singleAndDoubleAlert/images/alertHot.gif HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /data/json/notice_list.json HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=trueIf-None-Match: W/"9628-1727806199000"If-Modified-Since: Tue, 01 Oct 2024 18:09:59 GMT
Source: global traffic	HTTP traffic detected: GET /views/image/20191205/20191205204621615264hb_0_0.gif HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /v/lottery/getAllOpenInfo HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/txffc.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220831/20220831204043441175202207301834302873301-5_0_0_0_0.gif HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220901/202209012244388767132022_700_500.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/36.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/og.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/txffc.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/109.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/130.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/qp.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220831/20220831204219776887fgbujbf_640_280.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ky.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/36.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ky.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/36.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/xy.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/new.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/kx.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/53.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/137.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ksqp.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/dz.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/52.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/82.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/fisharea.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/20.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/68.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/IM.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/32.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/58.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ty.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220829/20220829210733397611mtzc_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/109.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/130.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/qp.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/og.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ky.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/hg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/sb.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/fbty.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/image_2019_02_14T08_53_01_247Z.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/image_2019_02_14T08_52_29_378Z.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/xy.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/new.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/kx.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/137.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/footer_bg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/53.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ksqp.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220822/20220822205240690167qiguai_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194100972934png4_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806193946089195png1_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/52.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/82.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220810/2022081011490779656622_1920_530.jpg HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194018939495png2_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/137.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/footer_bg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/53.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ksqp.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806193946089195png1_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194100972934png4_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/52.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/82.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194018939495png2_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220810/2022081011490779656622_1920_530.jpg HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220822/20220822205240690167qiguai_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/137.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/footer_bg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/53.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194100972934png4_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ksqp.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/52.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806193946089195png1_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194018939495png2_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/82.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220810/2022081011490779656622_1920_530.jpg HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220822/20220822205240690167qiguai_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/fisharea.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/20.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220820/20220820190550158877WaivPnJXH_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/dz.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/68.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/32.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/IM.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/58.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/ty.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/sb.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/hg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/image_2019_02_14T08_53_01_247Z.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220822/20220822203040581921usdt_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220829/2022082919284194014120220822203140620487xixihaha_1920_530_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/header/fbty.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/image_2019_02_14T08_52_29_378Z.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/66.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/77.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/qiapibg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/lotterylistbg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/slotbg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/buyubg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/footer_bg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194100972934png4_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806194018939495png2_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220806/20220806193946089195png1_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220822/20220822205240690167qiguai_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220810/2022081011490779656622_1920_530.jpg HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tiyubg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/css/common.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tip-demo-5.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220820/20220820190550158877WaivPnJXH_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tip-demo-2.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tip-demo-3.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/image_2019_02_14T08_56_54_932Z.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/security/device.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/twlhc.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/xjplhc.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/lhc300.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/xyft.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /css/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1Host: yx62415.fyiConnection: keep-aliveOrigin: http://yx62415.fyiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/commData/singleAndDoubleAlert/css/font-awesome.min.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /js/client.min.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/security/crossSDK.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/77.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/66.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220829/2022082919284194014120220822203140620487xixihaha_1920_530_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/slotbg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220822/20220822203040581921usdt_1920_530.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tip-demo-5.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/qiapibg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/buyubg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tip-demo-3.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tip-demo-2.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/lotterylistbg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/tiyubg.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/img/image_2019_02_14T08_56_54_932Z.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/security/device.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/twlhc.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/lhc300.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/xjplhc.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/game/img/xyft.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /js/client.min.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /page/security/crossSDK.js HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220829/2022082922124129148020220828222114833172logo_60_60_60_60.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://yx62415.fyi/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /views/image/20220829/2022082922124129148020220828222114833172logo_60_60_60_60.png HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET /v/user/device HTTP/1.1Host: yx62415.fyiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=true
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gopayjc984717.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bLzozHCIh.js HTTP/1.1Host: gopayjc984717.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://gopayjc984717.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Source: global traffic	HTTP traffic detected: GET /bLzozHCIh.js HTTP/1.1Host: gopayjc984717.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Source: global traffic	HTTP traffic detected: GET /_fd HTTP/1.1Host: gopayjc984717.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Source: global traffic	HTTP traffic detected: GET /dowload/gopay.apk HTTP/1.1Host: oamdikaljka0918471781.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dowload/gopay.apk HTTP/1.1Host: ww99.oamdikaljka0918471781.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_tr HTTP/1.1Host: gopayjc984717.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; __gsas=ID=a983e6c9968d7737:T=1727806231:RT=1727806231:S=ALNI_MZcu1Bx-ASYsF2UjI2GVMpSVUW40Q
Source: global traffic	HTTP traffic detected: GET /dowload/gopay.apk?usid=27&utid=8371154804 HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=oamdikaljka0918471781.com&toggle=browserjs&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls.php?t=66fc3b1c&token=cd6ec3593189db3a63d15165ca8718e1f2911c11 HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.oamdikaljka0918471781.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=oamdikaljka0918471781.com&toggle=browserjs&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=oamdikaljka0918471781.com&caf=1&toggle=answercheck&answer=yes&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Source: global traffic	HTTP traffic detected: GET /track.php?domain=oamdikaljka0918471781.com&caf=1&toggle=answercheck&answer=yes&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.oamdikaljka0918471781.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: sds82215go.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sds82215go.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sds82215go.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: yx62415.fyi
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ssl.captcha.qq.com
Source: global traffic	DNS traffic detected: DNS query: tgonly-image-hk.tgchat111.com
Source: global traffic	DNS traffic detected: DNS query: gopayjc984717.com
Source: global traffic	DNS traffic detected: DNS query: syndicatedsearch.goog
Source: global traffic	DNS traffic detected: DNS query: www.gob0dkwsnal2.live
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: oamdikaljka0918471781.com
Source: global traffic	DNS traffic detected: DNS query: ww99.oamdikaljka0918471781.com
Source: global traffic	DNS traffic detected: DNS query: ww12.oamdikaljka0918471781.com
Source: global traffic	DNS traffic detected: DNS query: parking3.parklogic.com
Source: global traffic	DNS traffic detected: DNS query: d38psrni17bvxu.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sds82215go.com
Source: global traffic	DNS traffic detected: DNS query: me-qr.com
Source: global traffic	DNS traffic detected: DNS query: lh92d.shepo99.com

Source: unknown

HTTP traffic detected: POST /v/user/device HTTP/1.1Host: yx62415.fyiConnection: keep-aliveContent-Length: 275Accept: application/json, text/javascript, */*; q=0.01X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json; charset=UTF-8Origin: http://yx62415.fyiReferer: http://yx62415.fyi/views/main.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=F85241A874207ABA5BD57170602631BB; md5Password=trueData Raw: 7b 22 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 28 31 31 37 2e 30 2e 30 2e 30 29 22 2c 22 6f 73 54 79 70 65 22 3a 22 77 65 62 22 2c 22 6f 73 44 61 74 61 22 3a 7b 22 67 75 69 64 22 3a 22 67 65 74 43 72 6f 73 73 53 74 6f 72 61 67 65 49 64 20 66 61 69 6c 21 22 2c 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 33 34 33 38 39 35 36 39 31 2c 22 6f 73 22 3a 22 57 69 6e 64 6f 77 73 28 31 30 29 22 2c 22 63 70 75 22 3a 22 61 6d 64 36 34 22 2c 22 73 63 72 65 65 6e 22 3a 22 31 32 38 30 78 39 38 34 22 2c 22 70 69 78 65 6c 52 61 74 69 6f 22 3a 31 2c 22 63 6f 6c 6f 72 44 65 70 74 68 22 3a 32 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 61 73 74 65 72 6e 20 44 61 79 6c 69 67 68 74 20 54 69 6d 65 22 2c 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 65 6e 67 69 6e 65 22 3a 22 57 65 62 4b 69 74 28 35 33 37 2e 33 36 29 22 7d 7d Data Ascii: {"name":"Chrome(117.0.0.0)","osType":"web","osData":{"guid":"getCrossStorageId fail!","fingerprint":343895691,"os":"Windows(10)","cpu":"amd64","screen":"1280x984","pixelRatio":1,"colorDepth":24,"timezone":"Eastern Daylight Time","language":"en-US","engine":"WebKit(537.36)"}}

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 01 Oct 2024 18:10:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveETag: W/"66fb7ac9-d7c"Content-Encoding: gzipData Raw: 34 63 66 0d 0a 1f 8b 08 00 00 00 00 00 02 03 b5 57 5b 6b 1b 47 14 7e d7 af 98 6c 5b 64 63 ef ae 24 db b1 2d ef 2a 90 c4 60 83 9b b8 8e 5b 28 25 98 d1 ee 48 3b ca 6a 66 33 33 ab 8b 43 20 0d 81 52 a8 a1 b4 05 97 e0 be 04 0a 7e a9 53 e8 bd 49 e8 9f a9 6c e7 29 7f a1 33 b3 bb ae 24 ab be 88 74 1f a4 9d 33 e7 7c e7 32 67 be 99 75 ae dc bc 7d 63 f3 e3 f5 65 10 88 66 58 c9 39 01 82 7e 25 97 03 00 38 4d 24 20 f0 02 c8 38 12 ae 11 8b 9a b9 60 54 d4 8c 7e 1c 81 45 88 2a 1f c4 50 30 0a 4c b0 0e 99 c0 5e 88 b8 63 27 33 ff 6a 6a 20 02 9b c8 35 7c c4 3d 86 23 81 29 31 80 47 89 40 44 62 1b 15 00 46 aa c3 58 04 94 0d 68 8e d4 6b 61 d4 8e 28 13 7d 9a 6d ec 8b c0 f5 51 0b 7b c8 d4 83 69 80 09 16 18 86 26 f7 60 88 dc e2 34 68 c2 0e 6e c6 cd 4c d0 8f 1e 62 72 0f 30 14 ba 06 17 5d 99 56 80 90 84 0f 18 aa b9 86 6d 23 c6 28 8b 60 1d 59 db 41 cc 83 f8 be b0 3c da 4c c4 5b 4a 6e 7b 9c db 55 c8 91 25 5f de 36 6e 13 62 f2 7f e0 b6 10 f1 29 1b 46 4e 56 0c 70 e6 5d 0c a9 21 03 a4 3e 62 04 6f 33 ab 21 a1 1c 3b 81 90 7d e5 d8 69 83 c9 d7 2a f5 bb 69 ab 29 21 62 c0 0b 21 e7 ae a1 d2 33 13 51 7f 1c 3e 6e 65 1a 8c b6 fb 66 46 69 84 b4 4e 47 a8 00 07 a6 35 c1 c4 47 1d 4b 75 bd 91 36 b1 63 c3 61 03 c7 96 90 b2 39 fb ba f3 44 a2 03 b7 93 30 b5 9d 43 60 0b 60 5f c6 8f 48 6c ca 81 d9 66 30 4a 82 70 6c 39 4e 92 4d 60 ae 98 26 50 79 66 0d ab 66 dc 4b 3f c0 34 13 78 0d a5 7d ab da cd 16 66 cd 14 d7 18 28 6a 2a 34 a3 74 b3 9a 6a 79 72 23 4b 9c a9 a6 39 9c ae e4 a0 3a 0f a0 4f db 26 6d 21 16 c2 ae 5a 73 55 a7 73 cd fa a3 1a b5 5c 17 5e fb b3 2c 3c 1a 9a a2 8d c2 16 3a d3 f0 5c cc 53 3e 82 62 e6 e2 9e 6c 77 53 04 58 96 53 16 1f 2c 6f 6c dc de b0 64 77 14 2b 97 47 8d 2e 6f 93 3d 87 8f f7 7b df bf 7a f3 f2 8b de ab af 7b 9f ef 1c 1f fc f5 7a f7 e0 e8 e9 93 e3 5f 9e 1c fe f9 e5 df bf ef f4 7e f8 b6 b7 b7 0f 8e 9f ff 76 fc e9 37 47 3f bd e8 1d 3c 3b dc db 19 27 77 98 a5 ee b3 2d 48 08 8e 25 f9 d4 31 17 72 cf 02 d1 8d 24 29 57 63 21 14 cd ab b6 e4 71 b5 89 4f f8 28 10 22 e2 65 db ee 60 48 09 62 c2 e2 01 8d 6c 0f aa 63 41 6f c9 6b 48 1a cd 2f 2e 16 4b 5e ad 88 d0 cc 62 09 15 16 aa 05 34 57 9a f5 67 8b a8 ba 50 42 73 73 46 e5 e8 f1 1f bd cf 5e f4 be da 3f 7e fe 0c 8c d8 be 17 48 c3 8e 2a 60 bc f4 65 84 31 0b 81 66 5b d7 a8 c9 1e 36 39 de 46 e5 e2 6c d4 59 92 2d 47 59 f9 9d 5a ad b0 a4 cf 9e b2 3c c9 e8 52 80 70 3d 10 e5 52 e1 bd 25 a0 b6 c8 38 01 57 59 65 cc 68 bd 98 dd 84 02 9d 13 f1 4c 6d be 76 75 dc e0 22 e5 07 47 6a 0b 9c f2 52 9a e9 af cb 7c b1 50 d0 35 90 f5 bf ac 9f f3 37 7f 42 d2 9a 64 ed 64 e7 2b a6 bc 14 d6 00 86 e4 9c ff 02 18 89 30 60 dc cf 71 1a 25 77 a6 7a 3f f1 66 fc 9e 1c 21 0a 68 00 b4 8f e7 b5 66 4e b3 9e da 6f 91 bc 09 d0 93 03 f4 44 9c c9 52 76 ce 48 7a 9c 23 be 71 3f 46 ac 6b 96 ac a2 35 63 35 e5 7d 64 f0 a4 1f 07 32 0a e3 3a 26 fc 2d 20 e9 0b d2 10 8c 2a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Tue, 01 Oct 2024 18:10:45 GMTContent-Type: text/htmlContent-Length: 552Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: chromecache_281.1.dr, chromecache_277.1.dr	String found in binary or memory: http://00000asdf1.com/
Source: chromecache_281.1.dr, chromecache_277.1.dr	String found in binary or memory: http://okzf1112.com//
Source: chromecache_358.1.dr, chromecache_414.1.dr	String found in binary or memory: http://www.opensource.org/licenses/GPL-2.0
Source: chromecache_358.1.dr, chromecache_414.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=
Source: chromecache_255.1.dr	String found in binary or memory: https://github.com/OBKoro1/koro1FileHeader/wiki/%E9%85%8D%E7%BD%AE
Source: chromecache_358.1.dr, chromecache_414.1.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_281.1.dr, chromecache_277.1.dr	String found in binary or memory: https://okpay.vtbot.vip/almBC4
Source: chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_242.1.dr, chromecache_207.1.dr	String found in binary or memory: https://parking3.parklogic.com/page/scribe.php?pcId=12&domain=oamdikaljka0918471781.com&pId=130&usid
Source: chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js
Source: chromecache_293.1.dr, chromecache_316.1.dr, chromecache_260.1.dr	String found in binary or memory: https://swiperjs.com
Source: chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	String found in binary or memory: https://syndicatedsearch.goog
Source: chromecache_281.1.dr, chromecache_277.1.dr	String found in binary or memory: https://t.me/okpay777
Source: chromecache_281.1.dr, chromecache_277.1.dr	String found in binary or memory: https://tf.szsyd.net/tf/merge/okpay01
Source: chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	String found in binary or memory: https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5
Source: chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/16521530460/?gad_source=1&adview_type=3

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2224,i,8571608066125043265,10275593808496756190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://yx62415.fyi"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2224,i,8571608066125043265,10275593808496756190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://syndicatedsearch.goog	0%	URL Reputation	safe
https://swiperjs.com	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://syndicatedsearch.goog/adsense/domains/caf.js?pac=0	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
google.com	142.250.186.78	true	false	unknown
tgonly-image-hk.tgchat111.com	103.244.3.95	true	false	unknown
syndicatedsearch.goog	142.250.185.78	true	false	unknown
sds82215go.com	46.8.127.12	true	false	unknown
944279.parkingcrew.net	75.2.81.221	true	false	unknown
yxgbback.javalebogame008.com	185.121.179.118	true	false	unknown
me-qr.com	188.114.97.3	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	unknown
ww99.oamdikaljka0918471781.com	67.225.218.25	true	false	unknown
parking3.parklogic.com	45.79.244.209	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
oamdikaljka0918471781.com	172.232.4.213	true	false	unknown
5eupf2kr.n.xmocloud01.com	69.160.169.247	true	false	unknown
ssl.captcha.qq.com	157.255.220.168	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
gopayjc984717.com	199.59.243.227	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.97	true	false	unknown
d38psrni17bvxu.cloudfront.net	18.66.121.69	true	false	unknown
afs.googleusercontent.com	unknown	unknown	false	unknown
ww12.oamdikaljka0918471781.com	unknown	unknown	false	unknown
yx62415.fyi	unknown	unknown	false	unknown
lh92d.shepo99.com	unknown	unknown	false	unknown
www.gob0dkwsnal2.live	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true	false		unknown
http://yx62415.fyi/views/img/newlivebg.png	false		unknown
http://yx62415.fyi/views/img/tip-demo-3.png	false		unknown
http://yx62415.fyi/data/json/config.json?t=17278062009170.33426557236313315	false		unknown
http://yx62415.fyi/views/image/20220806/20220806194018939495png2_1920_530.png	false		unknown
https://syndicatedsearch.goog/afs/gen_204?client=dp-teaminternet12_3ph&output=uds_ads_only&zx=gwt0zgf7byfr&aqid=IDv8Zt-wNI7PhcIPg5HpkAc&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet12_3ph&errv=678245571&csala=10%7C0%7C1478%7C15%7C252&lle=0&ifv=1&hpt=1	false		unknown
http://yx62415.fyi/page/cmsPublicFile/js/loginRedirect.js	false		unknown
http://yx62415.fyi/views/img/header/68.png	false		unknown
https://lh92d.shepo99.com/image/tutorial_vector.png	false		unknown
http://yx62415.fyi/views/img/header/hg.png	false		unknown
https://lh92d.shepo99.com/image/close_icon.png	false		unknown
https://lh92d.shepo99.com/css/swiper-bundle.min.css	false		unknown
http://yx62415.fyi/data/json/notice_list.json	false		unknown
http://yx62415.fyi/page/security/device.js	false		unknown
http://yx62415.fyi/js/lib/util/error.js	false		unknown
http://yx62415.fyi/js/register_trail.js	false		unknown
http://yx62415.fyi/views/img/77.png	false		unknown
http://yx62415.fyi/data/json/config.json?_=1727806200010	false		unknown
http://yx62415.fyi/views/image/20220901/202209012244388767132022_700_500.png	false		unknown
http://ww99.oamdikaljka0918471781.com/dowload/gopay.apk	false		unknown
http://yx62415.fyi/views/img/header/ksqp.png	false		unknown
http://yx62415.fyi/js/lib/jquery/jquery.min.js	false		unknown
http://yx62415.fyi/views/main.html	false		unknown
https://me-qr.com/l/okpay	false		unknown
http://yx62415.fyi/js/login.js	false		unknown
https://lh92d.shepo99.com/image/rename3.png	false		unknown
http://yx62415.fyi/views/img/float/float_game.png	false		unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff	false		unknown
https://lh92d.shepo99.com/js/jquery.min.js	false		unknown
http://yx62415.fyi/views/image/20220806/20220806193946089195png1_1920_530.png	false		unknown
http://yx62415.fyi/views/commData/commonSite.js	false		unknown
http://yx62415.fyi/views/img/66.png	false		unknown
http://yx62415.fyi/views/img/buyubg.png	false		unknown
http://yx62415.fyi/views/image/20220829/2022082919284194014120220822203140620487xixihaha_1920_530_1920_530.png	false		unknown
http://yx62415.fyi/js/lib/layer/layer.js	false		unknown
http://yx62415.fyi/js/enterLiveGame.js	false		unknown
http://sds82215go.com/favicon.ico	false		unknown
http://yx62415.fyi/page/game/img/txffc.png	false		unknown
https://lh92d.shepo99.com/image/Group.png	false		unknown
http://yx62415.fyi/views/js/index.js	false		unknown
http://ww12.oamdikaljka0918471781.com/ls.php?t=66fc3b1c&token=cd6ec3593189db3a63d15165ca8718e1f2911c11	false		unknown
https://lh92d.shepo99.com/image/logo.png	false		unknown
https://parking3.parklogic.com/page/enhance.js?pcId=12&domain=oamdikaljka0918471781.com	false		unknown
http://yx62415.fyi/	false		unknown
https://syndicatedsearch.goog/adsense/domains/caf.js?pac=0	false	URL Reputation: safe	unknown
https://lh92d.shepo99.com/image/serve_item2.png	false		unknown
http://yx62415.fyi/views/img/qiapibg.png	false		unknown
http://yx62415.fyi/views/css/float.css	false		unknown
https://lh92d.shepo99.com/image/collection1.png	false		unknown
http://yx62415.fyi/views/img/header/52.png	false		unknown
http://yx62415.fyi/views/image/20220822/20220822205240690167qiguai_1920_530.png	false		unknown
http://yx62415.fyi/views/commData/singleAndDoubleAlert/css/indexAlertCss.css	false		unknown
http://yx62415.fyi/js/lib/Font-Awesome/4.7.0/css/font-awesome.min.css	false		unknown
http://yx62415.fyi/js/register_check.js	false		unknown
http://ww12.oamdikaljka0918471781.com/favicon.ico	false		unknown
http://yx62415.fyi/views/img/slotbg.png	false		unknown
http://yx62415.fyi/page/security/crossSDK.js	false		unknown
https://lh92d.shepo99.com/image/home_header_bg.png	false		unknown
http://gopayjc984717.com/_fd	false		unknown
http://yx62415.fyi/v/lottery/getAllOpenInfo	false		unknown
http://yx62415.fyi/views/baseMsg.json	false		unknown
http://yx62415.fyi/views/img/header/sx.png	false		unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff	false		unknown
http://yx62415.fyi/views/img/header/109.png	false		unknown
http://gopayjc984717.com/bLzozHCIh.js	false		unknown
http://gopayjc984717.com/	false		unknown
http://yx62415.fyi/views/commData/singleAndDoubleAlert/css/indexAlertCss2.css	false		unknown
http://yx62415.fyi/views/img/header/32.png	false		unknown
http://yx62415.fyi/views/image/20220829/20220829210733397611mtzc_1920_530.png	false		unknown
http://yx62415.fyi/images/chat_float.png	false		unknown
https://tgonly-image-hk.tgchat111.com/crossStorage.html	false		unknown
http://yx62415.fyi/views/commData/singleAndDoubleAlert/images/alertHot.gif	false		unknown
http://yx62415.fyi/views/img/header/137.png	false		unknown
http://yx62415.fyi/views/css/css.css	false		unknown
http://yx62415.fyi/views/img/header/dz.png	false		unknown
https://syndicatedsearch.goog/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=f95v4iw178wz&aqid=Fzv8Zp7wEeighcIP87P80A8&psid=3113057640&pbt=bs&adbx=290&adby=143&adbh=480&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=678245571&csala=8%7C0%7C1682%7C1841%7C77&lle=0&ifv=1&hpt=0	false		unknown
http://yx62415.fyi/views/image/20220806/20220806194100972934png4_1920_530.png	false		unknown
https://lh92d.shepo99.com/image/nearby.png	false		unknown
http://yx62415.fyi/views/img/header/og.png	false		unknown
http://yx62415.fyi/views/img/header/wm.png	false		unknown
http://gopayjc984717.com/_tr	false		unknown
http://yx62415.fyi/views/img/header/fisharea.png	false		unknown
http://yx62415.fyi/views/image/20191205/20191205204621615264hb_0_0.gif	false		unknown
https://lh92d.shepo99.com/image/frame.png	false		unknown
http://yx62415.fyi/css/fonts/fontawesome-webfont.woff2?v=4.7.0	false		unknown
http://yx62415.fyi/js/lib/util/httpUtil.js	false		unknown
https://lh92d.shepo99.com/js/new.js	false		unknown
https://lh92d.shepo99.com/image/serve_item3.png	false		unknown
http://yx62415.fyi/views/img/header/36.png	false		unknown
https://lh92d.shepo99.com/image/home_header_iphone.png	false		unknown
http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://syndicatedsearch.goog	chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	false	URL Reputation: safe	unknown
https://swiperjs.com	chromecache_293.1.dr, chromecache_316.1.dr, chromecache_260.1.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_358.1.dr, chromecache_414.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5	chromecache_395.1.dr, chromecache_282.1.dr, chromecache_266.1.dr, chromecache_341.1.dr, chromecache_444.1.dr, chromecache_413.1.dr	false		unknown
https://github.com/OBKoro1/koro1FileHeader/wiki/%E9%85%8D%E7%BD%AE	chromecache_255.1.dr	false		unknown
http://www.opensource.org/licenses/GPL-2.0	chromecache_358.1.dr, chromecache_414.1.dr	false		unknown
https://t.me/okpay777	chromecache_281.1.dr, chromecache_277.1.dr	false		unknown
https://parking3.parklogic.com/page/scribe.php?pcId=12&domain=oamdikaljka0918471781.com&pId=130&usid	chromecache_242.1.dr, chromecache_207.1.dr	false		unknown
http://00000asdf1.com/	chromecache_281.1.dr, chromecache_277.1.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.185.78	syndicatedsearch.goog	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
103.244.3.95	tgonly-image-hk.tgchat111.com	Hong Kong	55720	GIGABIT-MYGigabitHostingSdnBhdMY	false
69.160.169.247	5eupf2kr.n.xmocloud01.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
18.66.121.69	d38psrni17bvxu.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
172.217.18.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.184.225	unknown	United States	15169	GOOGLEUS	false
142.250.74.193	unknown	United States	15169	GOOGLEUS	false
75.2.81.221	944279.parkingcrew.net	United States	16509	AMAZON-02US	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
45.79.244.209	parking3.parklogic.com	United States	63949	LINODE-APLinodeLLCUS	false
185.121.179.118	yxgbback.javalebogame008.com	Iceland	138995	BILLY-AS-APAntboxNetworkCN	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
172.232.4.213	oamdikaljka0918471781.com	United States	20940	AKAMAI-ASN1EU	false
199.59.243.227	gopayjc984717.com	United States	395082	BODIS-NJUS	false
67.225.218.25	ww99.oamdikaljka0918471781.com	United States	32244	LIQUIDWEBUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
46.8.127.12	sds82215go.com	Russian Federation	56669	NNGS-ASRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	me-qr.com	European Union	13335	CLOUDFLARENETUS	false
69.160.168.250	unknown	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
157.255.220.168	ssl.captcha.qq.com	China	17623	CNCGROUP-SZChinaUnicomShenzennetworkCN	false

IP
192.168.2.17
192.168.2.4

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523591
Start date and time:	2024-10-01 20:08:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://yx62415.fyi
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean4.win@26/497@75/26
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: http://gopayjc984717.com/ Browse: http://www.gob0dkwsnal2.live/client/chat/home.html?code=b156a2500aa981cb4273aa1638e9bcf8a5cc1b22f658cc19 Browse: http://oamdikaljka0918471781.com/dowload/gopay.apk Browse: http://sds82215go.com/ Browse: https://me-qr.com/l/okpay

Input	Output
URL: http://yx62415.fyi/ Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: http://yx62415.fyi/ Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: http://yx62415.fyi/ Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://lh92d.shepo99.com/ Model: jbxai	{ "brand":["Apple", "Android"], "contains_trigger_text":true, "trigger_text":"click here to view document", "prominent_button_name":"OKG", "text_input_field_labels":["username", "password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, from Unix, original size modulo 2^32 8772
Category:	dropped
Size (bytes):	8582
Entropy (8bit):	7.977298573303231
Encrypted:	false
SSDEEP:	192:wuxFumq+YpHF6EDIROARDgnO4Aj/rk/rdcAi/9z5g1BJd50gX:wuxY31pHF6eMDgOBj/4/eAy7g1J+2
MD5:	4136C53BC1F6FB873885F85D41FD89C6
SHA1:	6E6177C8E31443DF12D910C499E975A172E43DDE
SHA-256:	1E1BEDCCC7DA12FC1167B22CB82656CC60D19DC8A1590E46945F4104D44E1765
SHA-512:	DD94A0A0BEE6E9D8A676CD2BF20EDAF65ADECB37FC057FF642103CC4BD3A2B15BB48059AED596348678FC90DE90CF9D88EA07187C0B7818A96E19907C137FB61
Malicious:	false
Reputation:	low
Preview:	...........zuP[_.mp..P.H..Z...[..)...Z.....C.E.[q.P........7/..{O...k....D.W...I. .."/'....k....._.g.n.............p..q..0q.]..+.....n..n....n....... v~6N.6Nv_.Kn....=..-.<.].A.f.&.2..........u1 .%H^J\.+.(..Kc._..,#..,8L..1.e..D.=Nl.~.!.jR....ue....N..f1L...t.;.my..S...z.2n.;......4y..\.A...!!......V...K@.../?............`s`.>...=........z.f.....m.g..B.j......,....v".e.......^+..y..<.... dws..\|'...wyJ.;.]B...5.\L%W.S..~PY.[..-.vI 6UF.....?.VI...9gL.b...4}...-.l...m....[.ezC...C..:(+.j..<..?..../.@..6EG.....7...q'5..?......d.4.q..]..vi.M..Z.4xK,.9...z....I.g.L2]...9.=.ajr...KV........6..8>.(.(...w..9...e..8..(o...%..=..U....X..H..F>Y.S/A.n.e,....p.i....#x..e.,.\|.n..\=.2.8.=@.\|p.o.R..DWb.....&..,..{......N.\|..JMr..p...O........![.....).i.\|.x..:X@..N'#..P.n.Vc$......M .....C....:...$...U..[...dFo...i..`.a.p.....A..t0.<a....j;I/t<....&.._...l...w.=..n.~&c..{o$.....-'B.M&.5`N.....&eD..J.....{;..w...$.7~.JP6v.2...`.4..&...xA......,Q...Y.

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 20:09:52.676827908 CEST	192.168.2.4	1.1.1.1	0xca67	Standard query (0)	yx62415.fyi	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:52.677006006 CEST	192.168.2.4	1.1.1.1	0x1fb9	Standard query (0)	yx62415.fyi	65	IN (0x0001)	false
Oct 1, 2024 20:09:54.774136066 CEST	192.168.2.4	1.1.1.1	0xf6a7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:54.774774075 CEST	192.168.2.4	1.1.1.1	0x4bd0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:09:55.272202015 CEST	192.168.2.4	1.1.1.1	0xf0c9	Standard query (0)	yx62415.fyi	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:55.275378942 CEST	192.168.2.4	1.1.1.1	0x7f	Standard query (0)	yx62415.fyi	65	IN (0x0001)	false
Oct 1, 2024 20:09:56.312647104 CEST	192.168.2.4	1.1.1.1	0xcc6e	Standard query (0)	ssl.captcha.qq.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:56.312956095 CEST	192.168.2.4	1.1.1.1	0x86ec	Standard query (0)	ssl.captcha.qq.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:00.101670027 CEST	192.168.2.4	1.1.1.1	0xc8c1	Standard query (0)	ssl.captcha.qq.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:00.102092981 CEST	192.168.2.4	1.1.1.1	0x5d98	Standard query (0)	ssl.captcha.qq.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:17.011516094 CEST	192.168.2.4	1.1.1.1	0x7f9e	Standard query (0)	tgonly-image-hk.tgchat111.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:17.011516094 CEST	192.168.2.4	1.1.1.1	0x4a03	Standard query (0)	tgonly-image-hk.tgchat111.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:27.520514965 CEST	192.168.2.4	1.1.1.1	0x968f	Standard query (0)	gopayjc984717.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:27.520653963 CEST	192.168.2.4	1.1.1.1	0x3098	Standard query (0)	gopayjc984717.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:28.213975906 CEST	192.168.2.4	1.1.1.1	0xe823	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:28.214236975 CEST	192.168.2.4	1.1.1.1	0xaf2d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:28.468760967 CEST	192.168.2.4	1.1.1.1	0x1caa	Standard query (0)	gopayjc984717.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:28.469252110 CEST	192.168.2.4	1.1.1.1	0xa45d	Standard query (0)	gopayjc984717.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:29.625317097 CEST	192.168.2.4	1.1.1.1	0xd0e4	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:29.625588894 CEST	192.168.2.4	1.1.1.1	0x99c6	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 20:10:30.488775015 CEST	192.168.2.4	1.1.1.1	0x8c8a	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:30.488975048 CEST	192.168.2.4	1.1.1.1	0x8a27	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 20:10:30.658600092 CEST	192.168.2.4	1.1.1.1	0x3a82	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:30.659061909 CEST	192.168.2.4	1.1.1.1	0x121a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:31.704998016 CEST	192.168.2.4	1.1.1.1	0x1dd7	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:31.705399036 CEST	192.168.2.4	1.1.1.1	0xc747	Standard query (0)	www.gob0dkwsnal2.live	65	IN (0x0001)	false
Oct 1, 2024 20:10:31.767426968 CEST	192.168.2.4	1.1.1.1	0x7a77	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:31.783483982 CEST	192.168.2.4	1.1.1.1	0x135c	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:31.785423994 CEST	192.168.2.4	1.1.1.1	0x6c7	Standard query (0)	www.gob0dkwsnal2.live	65	IN (0x0001)	false
Oct 1, 2024 20:10:32.002651930 CEST	192.168.2.4	8.8.8.8	0xbbe4	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:32.003335953 CEST	192.168.2.4	1.1.1.1	0x9ef5	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.420938969 CEST	192.168.2.4	1.1.1.1	0xf131	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.421461105 CEST	192.168.2.4	1.1.1.1	0xd27	Standard query (0)	www.gob0dkwsnal2.live	65	IN (0x0001)	false
Oct 1, 2024 20:10:33.476991892 CEST	192.168.2.4	1.1.1.1	0x9ecd	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.477437019 CEST	192.168.2.4	1.1.1.1	0x90a8	Standard query (0)	www.gob0dkwsnal2.live	65	IN (0x0001)	false
Oct 1, 2024 20:10:33.597105026 CEST	192.168.2.4	1.1.1.1	0xf684	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.597234011 CEST	192.168.2.4	1.1.1.1	0x1d2	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 20:10:33.641803980 CEST	192.168.2.4	1.1.1.1	0x8579	Standard query (0)	oamdikaljka0918471781.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.642119884 CEST	192.168.2.4	1.1.1.1	0xb8f9	Standard query (0)	oamdikaljka0918471781.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:34.306718111 CEST	192.168.2.4	1.1.1.1	0xf71e	Standard query (0)	ww99.oamdikaljka0918471781.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:34.306957006 CEST	192.168.2.4	1.1.1.1	0x10c8	Standard query (0)	ww99.oamdikaljka0918471781.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:35.524554014 CEST	192.168.2.4	1.1.1.1	0x609	Standard query (0)	ww12.oamdikaljka0918471781.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:35.525341988 CEST	192.168.2.4	1.1.1.1	0x553	Standard query (0)	ww12.oamdikaljka0918471781.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:36.565901995 CEST	192.168.2.4	1.1.1.1	0xa4c1	Standard query (0)	parking3.parklogic.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:36.566171885 CEST	192.168.2.4	1.1.1.1	0x8a56	Standard query (0)	parking3.parklogic.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:37.416172981 CEST	192.168.2.4	1.1.1.1	0x80ea	Standard query (0)	parking3.parklogic.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:37.417821884 CEST	192.168.2.4	1.1.1.1	0xef9d	Standard query (0)	parking3.parklogic.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:38.151432991 CEST	192.168.2.4	1.1.1.1	0x363e	Standard query (0)	d38psrni17bvxu.cloudfront.net	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.152023077 CEST	192.168.2.4	1.1.1.1	0xf303	Standard query (0)	d38psrni17bvxu.cloudfront.net	65	IN (0x0001)	false
Oct 1, 2024 20:10:38.153525114 CEST	192.168.2.4	1.1.1.1	0xda33	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.153934002 CEST	192.168.2.4	1.1.1.1	0x7cf0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:38.219175100 CEST	192.168.2.4	1.1.1.1	0x9a29	Standard query (0)	ww12.oamdikaljka0918471781.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.219341040 CEST	192.168.2.4	1.1.1.1	0x2392	Standard query (0)	ww12.oamdikaljka0918471781.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:38.916351080 CEST	192.168.2.4	1.1.1.1	0xed90	Standard query (0)	d38psrni17bvxu.cloudfront.net	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.916520119 CEST	192.168.2.4	1.1.1.1	0x2aba	Standard query (0)	d38psrni17bvxu.cloudfront.net	65	IN (0x0001)	false
Oct 1, 2024 20:10:39.221712112 CEST	192.168.2.4	1.1.1.1	0x790	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:39.222034931 CEST	192.168.2.4	1.1.1.1	0xcc12	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 20:10:39.474112034 CEST	192.168.2.4	1.1.1.1	0xf3e5	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:39.474410057 CEST	192.168.2.4	1.1.1.1	0x22b2	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:39.579149961 CEST	192.168.2.4	1.1.1.1	0x3ef6	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:39.581929922 CEST	192.168.2.4	1.1.1.1	0xdc52	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 20:10:40.714401007 CEST	192.168.2.4	1.1.1.1	0x568	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:40.714842081 CEST	192.168.2.4	1.1.1.1	0x9492	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:41.308587074 CEST	192.168.2.4	1.1.1.1	0x9c	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:41.308881044 CEST	192.168.2.4	1.1.1.1	0x4bee	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:44.205152035 CEST	192.168.2.4	1.1.1.1	0xb6cc	Standard query (0)	sds82215go.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:44.205338001 CEST	192.168.2.4	1.1.1.1	0x1568	Standard query (0)	sds82215go.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:46.131587982 CEST	192.168.2.4	1.1.1.1	0xef50	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:47.476006031 CEST	192.168.2.4	1.1.1.1	0xc608	Standard query (0)	me-qr.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:47.477210045 CEST	192.168.2.4	1.1.1.1	0x6f8	Standard query (0)	me-qr.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:49.383060932 CEST	192.168.2.4	1.1.1.1	0x1f18	Standard query (0)	lh92d.shepo99.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.383208990 CEST	192.168.2.4	1.1.1.1	0x51c2	Standard query (0)	lh92d.shepo99.com	65	IN (0x0001)	false
Oct 1, 2024 20:10:53.297178030 CEST	192.168.2.4	1.1.1.1	0x2a13	Standard query (0)	lh92d.shepo99.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.297980070 CEST	192.168.2.4	1.1.1.1	0xdd12	Standard query (0)	lh92d.shepo99.com	65	IN (0x0001)	false
Oct 1, 2024 20:11:05.346775055 CEST	192.168.2.4	1.1.1.1	0x5eac	Standard query (0)	www.gob0dkwsnal2.live	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 20:09:52.752715111 CEST	1.1.1.1	192.168.2.4	0x1fb9	No error (0)	yx62415.fyi	yxgbweb.xaomenlebo008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:52.752715111 CEST	1.1.1.1	192.168.2.4	0x1fb9	No error (0)	yxgbweb.xaomenlebo008.com	yxgbback.javalebogame008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:52.887025118 CEST	1.1.1.1	192.168.2.4	0xca67	No error (0)	yx62415.fyi	yxgbweb.xaomenlebo008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:52.887025118 CEST	1.1.1.1	192.168.2.4	0xca67	No error (0)	yxgbweb.xaomenlebo008.com	yxgbback.javalebogame008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:52.887025118 CEST	1.1.1.1	192.168.2.4	0xca67	No error (0)	yxgbback.javalebogame008.com		185.121.179.118	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:54.781347036 CEST	1.1.1.1	192.168.2.4	0x4bd0	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 20:09:54.781557083 CEST	1.1.1.1	192.168.2.4	0xf6a7	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:55.454226017 CEST	1.1.1.1	192.168.2.4	0x7f	No error (0)	yx62415.fyi	yxgbweb.xaomenlebo008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:55.454226017 CEST	1.1.1.1	192.168.2.4	0x7f	No error (0)	yxgbweb.xaomenlebo008.com	yxgbback.javalebogame008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:55.561338902 CEST	1.1.1.1	192.168.2.4	0xf0c9	No error (0)	yx62415.fyi	yxgbweb.xaomenlebo008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:55.561338902 CEST	1.1.1.1	192.168.2.4	0xf0c9	No error (0)	yxgbweb.xaomenlebo008.com	yxgbback.javalebogame008.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:09:55.561338902 CEST	1.1.1.1	192.168.2.4	0xf0c9	No error (0)	yxgbback.javalebogame008.com		185.121.179.118	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:09:56.322038889 CEST	1.1.1.1	192.168.2.4	0xcc6e	No error (0)	ssl.captcha.qq.com		157.255.220.168	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:00.257400990 CEST	1.1.1.1	192.168.2.4	0xc8c1	No error (0)	ssl.captcha.qq.com		157.255.220.168	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:08.571049929 CEST	1.1.1.1	192.168.2.4	0xbdf6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:08.571049929 CEST	1.1.1.1	192.168.2.4	0xbdf6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:08.571049929 CEST	1.1.1.1	192.168.2.4	0xbdf6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:15.030579090 CEST	1.1.1.1	192.168.2.4	0x8372	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:15.030579090 CEST	1.1.1.1	192.168.2.4	0x8372	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:17.058330059 CEST	1.1.1.1	192.168.2.4	0x7f9e	No error (0)	tgonly-image-hk.tgchat111.com		103.244.3.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:27.592456102 CEST	1.1.1.1	192.168.2.4	0x968f	No error (0)	gopayjc984717.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:28.224697113 CEST	1.1.1.1	192.168.2.4	0xaf2d	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 20:10:28.226699114 CEST	1.1.1.1	192.168.2.4	0xe823	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:28.563904047 CEST	1.1.1.1	192.168.2.4	0x1caa	No error (0)	gopayjc984717.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:29.634376049 CEST	1.1.1.1	192.168.2.4	0xd0e4	No error (0)	syndicatedsearch.goog		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:30.495645046 CEST	1.1.1.1	192.168.2.4	0x8c8a	No error (0)	syndicatedsearch.goog		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:30.668734074 CEST	1.1.1.1	192.168.2.4	0x121a	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 20:10:30.669755936 CEST	1.1.1.1	192.168.2.4	0x3a82	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:31.725471020 CEST	1.1.1.1	192.168.2.4	0xc747	Name error (3)	www.gob0dkwsnal2.live	none	none	65	IN (0x0001)	false
Oct 1, 2024 20:10:31.726555109 CEST	1.1.1.1	192.168.2.4	0x1dd7	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:31.779814959 CEST	1.1.1.1	192.168.2.4	0x7a77	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:31.795562029 CEST	1.1.1.1	192.168.2.4	0x6c7	Name error (3)	www.gob0dkwsnal2.live	none	none	65	IN (0x0001)	false
Oct 1, 2024 20:10:31.876857042 CEST	1.1.1.1	192.168.2.4	0x135c	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:32.013495922 CEST	1.1.1.1	192.168.2.4	0x9ef5	No error (0)	google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:32.015093088 CEST	8.8.8.8	192.168.2.4	0xbbe4	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.429867983 CEST	1.1.1.1	192.168.2.4	0xf131	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.432301044 CEST	1.1.1.1	192.168.2.4	0xd27	Name error (3)	www.gob0dkwsnal2.live	none	none	65	IN (0x0001)	false
Oct 1, 2024 20:10:33.486809969 CEST	1.1.1.1	192.168.2.4	0x9ecd	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.487587929 CEST	1.1.1.1	192.168.2.4	0x90a8	Name error (3)	www.gob0dkwsnal2.live	none	none	65	IN (0x0001)	false
Oct 1, 2024 20:10:33.604274988 CEST	1.1.1.1	192.168.2.4	0xf684	No error (0)	syndicatedsearch.goog		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.775304079 CEST	1.1.1.1	192.168.2.4	0x8579	No error (0)	oamdikaljka0918471781.com		172.232.4.213	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.775304079 CEST	1.1.1.1	192.168.2.4	0x8579	No error (0)	oamdikaljka0918471781.com		172.232.25.148	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:33.775304079 CEST	1.1.1.1	192.168.2.4	0x8579	No error (0)	oamdikaljka0918471781.com		172.232.31.180	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:34.543350935 CEST	1.1.1.1	192.168.2.4	0xf71e	No error (0)	ww99.oamdikaljka0918471781.com		67.225.218.25	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:35.757222891 CEST	1.1.1.1	192.168.2.4	0x553	No error (0)	ww12.oamdikaljka0918471781.com	944279.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:35.783230066 CEST	1.1.1.1	192.168.2.4	0x609	No error (0)	ww12.oamdikaljka0918471781.com	944279.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:35.783230066 CEST	1.1.1.1	192.168.2.4	0x609	No error (0)	944279.parkingcrew.net		75.2.81.221	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:36.575333118 CEST	1.1.1.1	192.168.2.4	0xa4c1	No error (0)	parking3.parklogic.com		45.79.244.209	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:37.428257942 CEST	1.1.1.1	192.168.2.4	0x80ea	No error (0)	parking3.parklogic.com		45.79.244.209	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.161170006 CEST	1.1.1.1	192.168.2.4	0xda33	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.162080050 CEST	1.1.1.1	192.168.2.4	0x363e	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.69	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.162080050 CEST	1.1.1.1	192.168.2.4	0x363e	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.190	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.162080050 CEST	1.1.1.1	192.168.2.4	0x363e	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.135	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.162080050 CEST	1.1.1.1	192.168.2.4	0x363e	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.138	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.163281918 CEST	1.1.1.1	192.168.2.4	0x7cf0	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 20:10:38.342062950 CEST	1.1.1.1	192.168.2.4	0x2392	No error (0)	ww12.oamdikaljka0918471781.com	944279.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:38.429399014 CEST	1.1.1.1	192.168.2.4	0x9a29	No error (0)	ww12.oamdikaljka0918471781.com	944279.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:38.429399014 CEST	1.1.1.1	192.168.2.4	0x9a29	No error (0)	944279.parkingcrew.net		75.2.81.221	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.930063963 CEST	1.1.1.1	192.168.2.4	0xed90	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.69	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.930063963 CEST	1.1.1.1	192.168.2.4	0xed90	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.135	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.930063963 CEST	1.1.1.1	192.168.2.4	0xed90	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.190	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:38.930063963 CEST	1.1.1.1	192.168.2.4	0xed90	No error (0)	d38psrni17bvxu.cloudfront.net		18.66.121.138	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:39.228996038 CEST	1.1.1.1	192.168.2.4	0x790	No error (0)	syndicatedsearch.goog		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:39.481811047 CEST	1.1.1.1	192.168.2.4	0xf3e5	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:39.481811047 CEST	1.1.1.1	192.168.2.4	0xf3e5	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.97	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:39.481909037 CEST	1.1.1.1	192.168.2.4	0x22b2	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:39.586007118 CEST	1.1.1.1	192.168.2.4	0x3ef6	No error (0)	syndicatedsearch.goog		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:40.722817898 CEST	1.1.1.1	192.168.2.4	0x568	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:40.722817898 CEST	1.1.1.1	192.168.2.4	0x568	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:40.724020958 CEST	1.1.1.1	192.168.2.4	0x9492	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:41.316780090 CEST	1.1.1.1	192.168.2.4	0x9c	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:41.316780090 CEST	1.1.1.1	192.168.2.4	0x9c	No error (0)	googlehosted.l.googleusercontent.com		142.250.74.193	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:41.317436934 CEST	1.1.1.1	192.168.2.4	0x4bee	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:44.243014097 CEST	1.1.1.1	192.168.2.4	0xb6cc	No error (0)	sds82215go.com		46.8.127.12	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:46.141609907 CEST	1.1.1.1	192.168.2.4	0xef50	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:47.484677076 CEST	1.1.1.1	192.168.2.4	0xc608	No error (0)	me-qr.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:47.484677076 CEST	1.1.1.1	192.168.2.4	0xc608	No error (0)	me-qr.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:47.487409115 CEST	1.1.1.1	192.168.2.4	0x6f8	No error (0)	me-qr.com			65	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	lh92d.shepo99.com	6y4b7p2d-u.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	6y4b7p2d-u.xmocloud01.com	5eupf2kr.n.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.169.247	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.169.246	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.168.251	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.168.250	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		43.252.175.177	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		147.92.38.232	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.397814989 CEST	1.1.1.1	192.168.2.4	0x1f18	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.169.248	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:49.861567974 CEST	1.1.1.1	192.168.2.4	0x51c2	No error (0)	lh92d.shepo99.com	6y4b7p2d-u.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:49.861567974 CEST	1.1.1.1	192.168.2.4	0x51c2	No error (0)	6y4b7p2d-u.xmocloud01.com	5eupf2kr.n.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:53.305881023 CEST	1.1.1.1	192.168.2.4	0xdd12	No error (0)	lh92d.shepo99.com	6y4b7p2d-u.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:53.305881023 CEST	1.1.1.1	192.168.2.4	0xdd12	No error (0)	6y4b7p2d-u.xmocloud01.com	5eupf2kr.n.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	lh92d.shepo99.com	6y4b7p2d-u.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	6y4b7p2d-u.xmocloud01.com	5eupf2kr.n.xmocloud01.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.168.250	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		43.252.175.177	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		147.92.38.232	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.169.248	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.169.247	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.169.246	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:10:53.521182060 CEST	1.1.1.1	192.168.2.4	0x2a13	No error (0)	5eupf2kr.n.xmocloud01.com		69.160.168.251	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:11:05.356667995 CEST	1.1.1.1	192.168.2.4	0x5eac	Name error (3)	www.gob0dkwsnal2.live	none	none	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:27.690383911 CEST	432	OUT	GET / HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:28.192651987 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:27 GMT content-type: text/html; charset=utf-8 content-length: 1050 x-request-id: 6e931c12-c439-4407-9e65-33007686623a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_kKy1+2Rh3mEXYKEjDs8MqrvyuJUxAfHMx5N49EAHSfSR27o9A3kwPJwHogtvRXXuLS5SLTSqQvEtg64s3/EDVw== set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:28 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6b 4b 79 31 2b 32 52 68 33 6d 45 58 59 4b 45 6a 44 73 38 4d 71 72 76 79 75 4a 55 78 41 66 48 4d 78 35 4e 34 39 45 41 48 53 66 53 52 32 37 6f 39 41 33 6b 77 50 4a 77 48 6f 67 74 76 52 58 58 75 4c 53 35 53 4c 54 53 71 51 76 45 74 67 36 34 73 33 2f 45 44 56 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_kKy1+2Rh3mEXYKEjDs8MqrvyuJUxAfHMx5N49EAHSfSR27o9A3kwPJwHogtvRXXuLS5SLTSqQvEtg64s3/EDVw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Oct 1, 2024 20:10:28.192751884 CEST	484	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNmU5MzFjMTItYzQzOS00NDA3LTllNjUtMzMwMDc2ODY2MjNhIiwicGFnZV90aW1lIjoxNzI3ODA2MjI4LCJwYWdlX3VybCI6I
Oct 1, 2024 20:10:28.234682083 CEST	380	OUT	GET /bLzozHCIh.js HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://gopayjc984717.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Oct 1, 2024 20:10:28.364624977 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:27 GMT content-type: application/javascript; charset=utf-8 content-length: 34193 x-request-id: 0bc8bd48-3e87-41a1-9170-8ca1fd0b8e4f set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:28 GMT Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 74 28 65 78 70 6f 72 74 73 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 5d 2c 74 29 3a 74 28 28 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 65 7c 7c 73 65 6c 66 29 2e 76 65 72 73 69 6f 6e 3d 7b 7d 29 7d 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 65 78 70 6f 72 74 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 61 77 61 69 74 65 72 28 65 2c 74 2c 6e 2c 69 29 7b 72 65 74 75 72 6e 20 6e 65 77 28 6e 7c 7c 28 6e 3d 50 72 6f 6d 69 73 65 29 29 28 28 66 75 6e 63 74 69 6f 6e 28 73 2c 61 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 74 72 79 7b 64 28 69 2e 6e [TRUNCATED] Data Ascii: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).version={})}(this,(function(exports){"use strict";function __awaiter(e,t,n,i){return new(n\|\|(n=Promise))((function(s,a){function o(e){try{d(i.next(e))}catch(e){a(e)}}function r(e){try{d(i.throw(e))}catch(e){a(e)}}function d(e){var t;e.done?s(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(o,r)}d((i=i.apply(e,t\|\|[])).next())}))}var Blocking;"function"==typeof SuppressedError&&SuppressedError,function(e){e.PENDING="pending",e.NONE="none",e.BLOCKED="blocked",e.ALLOWED="allowed"}(Blocking\|\|(Blocking={}));class Adblock{constructor(e){this.state=Blocking.PENDING,this._mocked=!1,e?(this.state=e,this._mocked=!0):this.state=Blocking.ALLOWED}inject(){return __awaiter(this,void 0,void 0,(function*(){}))}get isBlocked(){return this.
Oct 1, 2024 20:10:28.364722967 CEST	1236	IN	Data Raw: 73 74 61 74 65 3d 3d 3d 42 6c 6f 63 6b 69 6e 67 2e 42 4c 4f 43 4b 45 44 7d 67 65 74 20 69 73 41 6c 6c 6f 77 65 64 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 74 61 74 65 3d 3d 3d 42 6c 6f 63 6b 69 6e 67 2e 41 4c 4c 4f 57 45 44 7d 74 6f 43 6f Data Ascii: state===Blocking.BLOCKED}get isAllowed(){return this.state===Blocking.ALLOWED}toContext(){return{user_has_ad_blocker:null,is_ad_blocked:null}}}const OBFUSCATING_BASE_64_PREFIX="UxFdVMwNFNwN0wzODEybV",encode=e=>OBFUSCATING_BASE_64_PREFIX+btoa(u
Oct 1, 2024 20:10:28.364733934 CEST	448	IN	Data Raw: 5f 46 41 49 4c 5f 41 44 53 3d 22 63 61 66 5f 61 64 6c 6f 61 64 66 61 69 6c 5f 61 64 73 22 2c 65 2e 44 49 53 41 42 4c 45 44 5f 47 42 3d 22 64 69 73 61 62 6c 65 64 5f 67 62 22 2c 65 2e 44 49 53 41 42 4c 45 44 5f 41 42 3d 22 64 69 73 61 62 6c 65 64 Data Ascii: _FAIL_ADS="caf_adloadfail_ads",e.DISABLED_GB="disabled_gb",e.DISABLED_AB="disabled_ab",e.DISABLED_DS="disabled_ds",e.AD_BLOCKED="ad_blocked",e.PREFERRED="preferred"}(ZeroClickReasons\|\|(ZeroClickReasons={}));const getZeroClick=e=>__awaiter(void
Oct 1, 2024 20:10:28.365070105 CEST	1236	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 7d 7d 29 2e 74 68 65 6e 28 28 65 3d 3e 5f 5f 61 77 61 69 74 65 72 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 Data Ascii: Content-Type":"application/json"}}).then((e=>__awaiter(void 0,void 0,void 0,(function*(){try{return decode$1(yield e.text())}catch(e){return{}}}))))})),waiter=(e,t)=>new Promise((n=>{t(e),e<=0&&n();let i=e;const s=()=>{i>0?(i-=1,t(i),setTimeou
Oct 1, 2024 20:10:28.365082026 CEST	1236	IN	Data Raw: 63 6f 6c 6f 72 3a 20 23 38 45 41 42 43 30 3b 5c 6e 7d 5c 6e 5c 6e 23 73 61 6c 65 73 2d 62 6f 78 20 61 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 5c 6e 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 5c 6e 20 20 74 65 78 74 2d 64 65 Data Ascii: color: #8EABC0;\n}\n\n#sales-box a {\n display: block;\n width: 100%;\n text-decoration: inherit;\n color: #8EABC0;\n cursor: pointer;\n}\n\n/* Sales Box - Highlighted State */\n\n#sales-box.is-highlighted {\n position: relative;\n z-in
Oct 1, 2024 20:10:28.365092993 CEST	1236	IN	Data Raw: 2d 31 20 30 2e 36 73 20 69 6e 66 69 6e 69 74 65 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 20 72 65 76 65 72 73 65 3b 5c 6e 7d 5c 6e 5c 6e 2e 70 6b 2d 6c 6f 61 64 65 72 2d 74 65 78 74 20 7b 5c 6e 20 20 70 6f 73 69 Data Ascii: -1 0.6s infinite;\n animation-direction: reverse;\n}\n\n.pk-loader-text {\n position: fixed;\n font-size: 12px;\n right: 20px;\n bottom: 20px;\n font-weight: lighter;\n}\n\n/* Utilities */\n\n.pk-message-title {\n font-size: 2em;\n fon
Oct 1, 2024 20:10:28.365104914 CEST	1236	IN	Data Raw: 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 64 6f 6d 4e 6f 64 65 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 65 29 Data Ascii: lementsByTagName("head")[0].appendChild(t)},this.domNode=document.querySelector(e)}get domIsReady(){return this._domIsReady}set domIsReady(e){this._domIsReady=e,e&&this.injectStyles(PAGE_STYLES)}message(e,t=""){if(this.injectHTML(MESSAGE_TEMPL
Oct 1, 2024 20:10:28.365416050 CEST	1236	IN	Data Raw: 6e 20 20 20 20 20 20 3c 68 31 3e 41 64 20 62 6c 6f 63 6b 20 64 65 74 65 63 74 65 64 3c 2f 68 31 3e 5c 6e 20 20 20 20 20 20 50 6c 65 61 73 65 20 64 69 73 61 62 6c 65 20 79 6f 75 72 20 61 64 20 62 6c 6f 63 6b 65 72 20 61 6e 64 20 72 65 6c 6f 61 64 Data Ascii: n <h1>Ad block detected</h1>\n Please disable your ad blocker and reload the page.\n ")}errorParkingUnavailable(){this.message("\n <h1>An Error Occurred</h1>\n <p>Parking is currently unavailable. We'll be right back.</p
Oct 1, 2024 20:10:28.365788937 CEST	552	IN	Data Raw: 6f 20 72 65 6e 64 65 72 20 74 68 69 73 20 70 61 67 65 2e 20 44 4f 4d 20 6e 6f 64 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 22 29 29 7d 70 72 65 72 65 6e 64 65 72 28 65 29 7b 74 68 69 73 2e 69 6e 6a 65 63 74 4d 65 74 61 44 65 73 63 72 69 70 74 69 6f 6e Data Ascii: o render this page. DOM node not found."))}prerender(e){this.injectMetaDescription(e.domain),this.injectHTML(e.html)}template(e){var t;this.domIsReady\|\|this.prerender(e),this.injectStyles(e.stylesheet),this.imprint(e.imprint),this.salesBanner(
Oct 1, 2024 20:10:28.365799904 CEST	1236	IN	Data Raw: 79 70 65 3d 7b 7d 29 29 3b 6c 65 74 20 53 74 61 74 65 24 32 3d 63 6c 61 73 73 7b 67 65 74 20 74 72 61 63 6b 69 6e 67 54 79 70 65 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 74 72 61 63 6b 69 6e 67 54 79 70 65 7d 73 65 74 20 74 72 61 63 6b 69 Data Ascii: ype={}));let State$2=class{get trackingType(){return this._trackingType}set trackingType(e){this._trackingType=e}get track(){return!!this.trackingType}};class Disabled extends State$2{constructor(){super(...arguments),this.type=Type.Disabled}s
Oct 1, 2024 20:10:28.465688944 CEST	470	OUT	POST /_fd HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive Content-Length: 0 Accept: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Origin: http://gopayjc984717.com Referer: http://gopayjc984717.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Oct 1, 2024 20:10:28.581087112 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:28 GMT content-type: application/json; charset=utf-8 content-length: 5241 x-request-id: b4ee3759-d4b9-4db2-a58d-04bf81908c1b set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:28 GMT Data Raw: 55 78 46 64 56 4d 77 4e 46 4e 77 4e 30 77 7a 4f 44 45 79 62 56 65 79 4a 69 62 47 39 6a 61 33 4d 69 4f 6c 74 37 49 6d 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 36 49 6e 4a 7a 49 69 77 69 62 6e 56 74 59 6d 56 79 49 6a 6f 7a 4c 43 4a 30 65 58 42 6c 49 6a 6f 69 63 6d 56 73 59 58 52 6c 5a 48 4e 6c 59 58 4a 6a 61 43 49 73 49 6e 56 70 54 33 42 30 61 57 31 70 65 6d 55 69 4f 6d 5a 68 62 48 4e 6c 66 53 78 37 49 6d 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 36 49 6d 46 6b 4c 54 45 69 4c 43 4a 75 64 57 31 69 5a 58 49 69 4f 6a 4d 73 49 6e 52 35 63 47 55 69 4f 69 4a 68 5a 48 4d 69 4c 43 4a 31 61 55 39 77 64 47 6c 74 61 58 70 6c 49 6a 70 6d 59 57 78 7a 5a 58 31 64 4c 43 4a 6a 59 57 35 75 62 33 52 51 59 58 4a 72 49 6a 6f 69 49 69 77 69 59 32 46 75 57 6d 56 79 62 30 4e 73 61 57 4e 72 49 6a 70 30 63 6e 56 6c 4c 43 4a 6b 62 32 31 68 61 57 35 4f 59 57 31 6c 49 6a 6f 69 5a 32 39 77 59 58 6c 71 59 7a 6b 34 4e 44 63 78 4e 79 35 6a 62 32 30 69 4c 43 4a 6d 5a 46 39 7a 5a 58 4a 32 5a 58 49 69 4f 69 4a 70 63 43 30 78 4d 43 30 79 4d [TRUNCATED] Data Ascii: UxFdVMwNFNwN0wzODEybVeyJibG9ja3MiOlt7ImNvbnRhaW5lciI6InJzIiwibnVtYmVyIjozLCJ0eXBlIjoicmVsYXRlZHNlYXJjaCIsInVpT3B0aW1pemUiOmZhbHNlfSx7ImNvbnRhaW5lciI6ImFkLTEiLCJudW1iZXIiOjMsInR5cGUiOiJhZHMiLCJ1aU9wdGltaXplIjpmYWxzZX1dLCJjYW5ub3RQYXJrIjoiIiwiY2FuWmVyb0NsaWNrIjp0cnVlLCJkb21haW5OYW1lIjoiZ29wYXlqYzk4NDcxNy5jb20iLCJmZF9zZXJ2ZXIiOiJpcC0xMC0yMDEtMTYtNTEuZWMyLmludGVybmFsIiwiZmRfc2VydmVyX2RhdGV0aW1lIjoxNzI3ODA2MjI4LCJmbGV4X3J1bGUiOnsiYWN0aW9uIjoiIiwiY3VzdG9tX3JlYXNvbiI6IiIsImZsZXhfaWQiOjAsIm1pc21hdGNoIjpmYWxzZX0sImdvb2dsZUFuYWx5dGljcyI6IiIsImltcHJpbnRUZXh0IjoiIiwiaW5saW5lSnMiOiIiLCJwYWdlT3B0aW9ucyI6eyJhZHRlc3QiOiJvZmYiLCJib2Rpc1RlbXBsYXRlQWxsb3dzWmMiOnRydWUsImNoYW5uZWwiOiJwaWQtYm9kaXMtZ2NvbnRyb2w5NyxwaWQtYm9kaXMtZ2NvbnRyb2wxMTgscGlkLWJvZGlzLWdjb250cm9sNDcyLHBpZC1ib2Rpcy1nY29udHJvbDE1MixwaWQtYm9kaXMtZ2NvbnRyb2wxNjQiLCJkb21haW5SZWdpc3RyYW50IjoiYXMtZHJpZC0yMjYyMzU3MzQxMzY3MTc4Iiwia3ciOiIiLCJtYXhUZXJtTGVuZ3RoIjo1MCwicGVyc29uYWxpemVkQWRzIjpmYWxzZSwicHViS
Oct 1, 2024 20:10:34.496824026 CEST	565	OUT	POST /_tr HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive Content-Length: 1809 Accept: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Origin: http://gopayjc984717.com Referer: http://gopayjc984717.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; __gsas=ID=a983e6c9968d7737:T=1727806231:RT=1727806231:S=ALNI_MZcu1Bx-ASYsF2UjI2GVMpSVUW40Q
Oct 1, 2024 20:10:34.603039026 CEST	281	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:33 GMT content-type: application/json; charset=utf-8 content-length: 2 x-request-id: afec24ea-d89a-4b0a-a67d-bc1c5d8a7698 set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:34 GMT Data Raw: 6f 6b Data Ascii: ok

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:28.572757006 CEST	344	OUT	GET /bLzozHCIh.js HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Oct 1, 2024 20:10:29.032264948 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:28 GMT content-type: application/javascript; charset=utf-8 content-length: 34193 x-request-id: b5b22493-e516-4ca4-be28-37ffcbb64e61 set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:28 GMT Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 74 28 65 78 70 6f 72 74 73 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 5d 2c 74 29 3a 74 28 28 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 65 7c 7c 73 65 6c 66 29 2e 76 65 72 73 69 6f 6e 3d 7b 7d 29 7d 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 65 78 70 6f 72 74 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 61 77 61 69 74 65 72 28 65 2c 74 2c 6e 2c 69 29 7b 72 65 74 75 72 6e 20 6e 65 77 28 6e 7c 7c 28 6e 3d 50 72 6f 6d 69 73 65 29 29 28 28 66 75 6e 63 74 69 6f 6e 28 73 2c 61 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 74 72 79 7b 64 28 69 2e 6e [TRUNCATED] Data Ascii: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).version={})}(this,(function(exports){"use strict";function __awaiter(e,t,n,i){return new(n\|\|(n=Promise))((function(s,a){function o(e){try{d(i.next(e))}catch(e){a(e)}}function r(e){try{d(i.throw(e))}catch(e){a(e)}}function d(e){var t;e.done?s(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(o,r)}d((i=i.apply(e,t\|\|[])).next())}))}var Blocking;"function"==typeof SuppressedError&&SuppressedError,function(e){e.PENDING="pending",e.NONE="none",e.BLOCKED="blocked",e.ALLOWED="allowed"}(Blocking\|\|(Blocking={}));class Adblock{constructor(e){this.state=Blocking.PENDING,this._mocked=!1,e?(this.state=e,this._mocked=!0):this.state=Blocking.ALLOWED}inject(){return __awaiter(this,void 0,void 0,(function*(){}))}get isBlocked(){return this.
Oct 1, 2024 20:10:29.032485962 CEST	224	IN	Data Raw: 73 74 61 74 65 3d 3d 3d 42 6c 6f 63 6b 69 6e 67 2e 42 4c 4f 43 4b 45 44 7d 67 65 74 20 69 73 41 6c 6c 6f 77 65 64 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 74 61 74 65 3d 3d 3d 42 6c 6f 63 6b 69 6e 67 2e 41 4c 4c 4f 57 45 44 7d 74 6f 43 6f Data Ascii: state===Blocking.BLOCKED}get isAllowed(){return this.state===Blocking.ALLOWED}toContext(){return{user_has_ad_blocker:null,is_ad_blocked:null}}}const OBFUSCATING_BASE_64_PREFIX="UxFdVMwNFNwN0wzODEybV",encode=e=>OBFUSCATING_BA
Oct 1, 2024 20:10:29.032495975 CEST	1236	IN	Data Raw: 53 45 5f 36 34 5f 50 52 45 46 49 58 2b 62 74 6f 61 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 29 29 29 3b 66 75 6e 63 74 69 6f 6e 20 64 65 63 6f 64 65 Data Ascii: SE_64_PREFIX+btoa(unescape(encodeURIComponent(JSON.stringify(e))));function decode$1(e){return JSON.parse(decodeURIComponent(escape(atob(e.replace(OBFUSCATING_BASE_64_PREFIX,"")))))}var version="0.4.1";const APP_ENV="production",TRACKING_DOMAI
Oct 1, 2024 20:10:29.032629967 CEST	1236	IN	Data Raw: 6b 3d 65 3d 3e 5f 5f 61 77 61 69 74 65 72 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 2a 28 29 7b 63 6f 6e 73 74 20 74 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 4f 62 6a 65 63 74 2e 61 73 73 69 Data Ascii: k=e=>__awaiter(void 0,void 0,void 0,(function*(){const t=Object.assign(Object.assign({},e),{type:"zc_fetch"});return fetch("/_zc",{method:"POST",body:JSON.stringify({signature:encode(t)}),headers:{Accept:"application/json","Content-Type":"appl
Oct 1, 2024 20:10:29.032640934 CEST	1236	IN	Data Raw: 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 5c 6e 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 5c 6e 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 5c 6e 7d 5c 6e 5c 6e 2f 2a 20 53 61 6c 65 73 20 42 Data Ascii: tion: column;\n align-items: center;\n justify-content: center;\n}\n\n/* Sales Box - Default State */\n\n#sales-box {\n display: block;\n width: 100%;\n padding: 3px;\n text-align: center;\n text-decoration: none;\n color: #8EABC0;\n}\
Oct 1, 2024 20:10:29.032649040 CEST	1236	IN	Data Raw: 69 6c 64 28 32 29 20 7b 5c 6e 20 20 6c 65 66 74 3a 20 38 70 78 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 70 6b 2d 61 6e 69 6d 2d 32 20 30 2e 36 73 20 69 6e 66 69 6e 69 74 65 3b 5c 6e 7d 5c 6e 5c 6e 2e 70 6b 2d 6c 6f 61 64 65 72 20 64 69 76 Data Ascii: ild(2) {\n left: 8px;\n animation: pk-anim-2 0.6s infinite;\n}\n\n.pk-loader div:nth-child(3) {\n left: 32px;\n animation: pk-anim-2 0.6s infinite;\n}\n\n.pk-loader div:nth-child(4) {\n left: 56px;\n animation: pk-anim-1 0.6s infinite;\n
Oct 1, 2024 20:10:29.032660007 CEST	1236	IN	Data Raw: 69 6e 6a 65 63 74 4d 65 74 61 44 65 73 63 72 69 70 74 69 6f 6e 3d 65 3d 3e 7b 69 66 28 21 65 7c 7c 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 3b 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 65 3b 63 6f 6e 73 74 Data Ascii: injectMetaDescription=e=>{if(!e\|\|0===e.length)return;window.document.title=e;const t=document.createElement("meta");t.setAttribute("name","description"),t.setAttribute("content",`See relevant content for ${e}`),document.getElementsByTagName("h
Oct 1, 2024 20:10:29.033077002 CEST	1236	IN	Data Raw: 20 20 3c 64 69 76 3e 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 3e 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 3e 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 3c 64 69 76 20 Data Ascii: <div></div>\n <div></div>\n <div></div>\n </div>\n <div class="pk-loader-text hidden-xs">\n Page loading in ${t} seconds, please wait...\n </div>\n `)}adBlockMessage(){this.message("\n <h1>Ad block
Oct 1, 2024 20:10:29.033087969 CEST	1236	IN	Data Raw: 22 2c 74 2e 73 72 63 3d 65 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 69 6e 6a 65 63 74 4a 53 28 6a 73 29 7b 6a 73 26 26 30 21 3d 3d 6a 73 2e 6c 65 6e 67 74 68 26 26 65 76 61 6c 28 6a 73 29 7d 69 6e Data Ascii: ",t.src=e,document.body.appendChild(t)}injectJS(js){js&&0!==js.length&&eval(js)}injectHTML(e){this.domNode?(e&&(this.domNode.innerHTML=e),this.domIsReady=!0):(this.domIsReady=!1,console.error("An error occurred when trying to render this page.
Oct 1, 2024 20:10:29.033097982 CEST	1236	IN	Data Raw: 73 77 69 74 63 68 28 74 68 69 73 2e 72 65 61 73 6f 6e 29 7b 63 61 73 65 22 61 64 62 6c 6f 63 6b 65 72 22 3a 72 65 74 75 72 6e 22 3c 68 31 3e 41 64 20 62 6c 6f 63 6b 20 64 65 74 65 63 74 65 64 3c 2f 68 31 3e 20 50 6c 65 61 73 65 20 64 69 73 61 62 Data Ascii: switch(this.reason){case"adblocker":return"<h1>Ad block detected</h1> Please disable your ad blocker and reload the page.";case"disabled_mr":return`<h1>Invalid URL</h1> Referral traffic for ${this.domain} does not meet requirements.`;default:r
Oct 1, 2024 20:10:29.037571907 CEST	1236	IN	Data Raw: 74 61 2d 6e 6f 73 6e 69 70 70 65 74 3e 4e 6f 20 53 70 6f 6e 73 6f 72 73 3c 2f 68 31 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 6e 6f 73 6e 69 70 70 65 74 3e 24 7b 74 68 69 73 2e 64 6f 6d 61 69 6e 7d 20 63 75 72 72 65 6e 74 6c Data Ascii: ta-nosnippet>No Sponsors</h1>\n <p data-nosnippet>${this.domain} currently does not have any sponsors for you.</p>`;case"disabled_mr":return`\n <h1>Invalid URL</h1>\n <p>Referral traffic for ${this.domain} does not m
Oct 1, 2024 20:10:34.648488998 CEST	427	OUT	GET /_tr HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; __gsas=ID=a983e6c9968d7737:T=1727806231:RT=1727806231:S=ALNI_MZcu1Bx-ASYsF2UjI2GVMpSVUW40Q
Oct 1, 2024 20:10:34.748975992 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:34 GMT content-type: text/html; charset=utf-8 content-length: 1054 x-request-id: 62735b5a-3ebb-4fb1-bf5c-8041e53a2bcc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_lUdqAFLuIaMLxv6o1C2ZMjRUJLo0YoHDXugh+2A80IqSBxhzV2TBCDZB9eC4yUOIhFFAbTAA50rw4ywevpB8dg== set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:34 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6c 55 64 71 41 46 4c 75 49 61 4d 4c 78 76 36 6f 31 43 32 5a 4d 6a 52 55 4a 4c 6f 30 59 6f 48 44 58 75 67 68 2b 32 41 38 30 49 71 53 42 78 68 7a 56 32 54 42 43 44 5a 42 39 65 43 34 79 55 4f 49 68 46 46 41 62 54 41 41 35 30 72 77 34 79 77 65 76 70 42 38 64 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_lUdqAFLuIaMLxv6o1C2ZMjRUJLo0YoHDXugh+2A80IqSBxhzV2TBCDZB9eC4yUOIhFFAbTAA50rw4ywevpB8dg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:28.593770981 CEST	335	OUT	GET /_fd HTTP/1.1 Host: gopayjc984717.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a
Oct 1, 2024 20:10:29.081794024 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 18:10:28 GMT content-type: text/html; charset=utf-8 content-length: 1054 x-request-id: 1f6f911d-4b6a-4701-9f98-792dcda85168 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_nClwX+twiNGiWqtdvui7ifh1iz8Ju0LJ/nwrVMWagUBD8wQee8yfYzgL3uYOW3q9J31Lvez2x4hc2p2ZMFpkKw== set-cookie: parking_session=6e931c12-c439-4407-9e65-33007686623a; expires=Tue, 01 Oct 2024 18:25:29 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6e 43 6c 77 58 2b 74 77 69 4e 47 69 57 71 74 64 76 75 69 37 69 66 68 31 69 7a 38 4a 75 30 4c 4a 2f 6e 77 72 56 4d 57 61 67 55 42 44 38 77 51 65 65 38 79 66 59 7a 67 4c 33 75 59 4f 57 33 71 39 4a 33 31 4c 76 65 7a 32 78 34 68 63 32 70 32 5a 4d 46 70 6b 4b 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_nClwX+twiNGiWqtdvui7ifh1iz8Ju0LJ/nwrVMWagUBD8wQee8yfYzgL3uYOW3q9J31Lvez2x4hc2p2ZMFpkKw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Oct 1, 2024 20:10:29.082298994 CEST	480	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNmU5MzFjMTItYzQzOS00NDA3LTllNjUtMzMwMDc2ODY2MjNhIiwicGFnZV90aW1lIjoxNzI3ODA2MjI5LCJwYWdlX3VybCI6Imh0dHA6L

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:33.812624931 CEST	457	OUT	GET /dowload/gopay.apk HTTP/1.1 Host: oamdikaljka0918471781.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:34.299777985 CEST	493	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 01 Oct 2024 18:10:34 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.oamdikaljka0918471781.com/dowload/gopay.apk Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:34.558809996 CEST	462	OUT	GET /dowload/gopay.apk HTTP/1.1 Host: ww99.oamdikaljka0918471781.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:35.371397018 CEST	381	IN	HTTP/1.1 302 Moved Temporarily Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 Cache-Control: no-cache Content-Type: text/html; charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:35 GMT Location: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Pragma: no-cache Connection: Keep-Alive X-Powered-By: PHP/5.4.16 Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:35.812130928 CEST	486	OUT	GET /dowload/gopay.apk?usid=27&utid=8371154804 HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:36.485102892 CEST	1236	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:36 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_f8meGwNVm6RhO2gKChxnLlATN/Y7E16ueDFInwh1XBaka4hhxHeFZd7stK5g35AAMwutP6gILJFHRq9dMNMsAQ== X-Domain: oamdikaljka0918471781.com X-Pcrew-Blocked-Reason: X-Pcrew-Ip-Organization: CenturyLink X-Subdomain: ww12 Transfer-Encoding: chunked Data Raw: 63 33 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5b 69 7b da c8 96 fe 7c fd 2b 14 f2 5c 83 a7 59 24 16 83 4d 70 06 1b 2f 38 01 2f c1 0b e4 c9 e4 11 52 01 02 2d b4 24 cc d2 d7 ff 7d de 53 25 09 61 e3 ee e4 4e 77 cf 97 eb ee 80 54 cb 39 a7 ce 5e a7 8a 0f ef 1a 57 27 9d ee f5 a9 34 f2 2d f3 68 e7 03 7d 49 ba ea ab 19 55 ef 9b 8e 36 99 b0 65 2d d1 3a 9b cf 1b 37 dd cb 4f 4e af 39 7a d2 da f5 9b d3 e3 e3 9b 7a e3 cb bc 3e ff 52 bf 3c ae 7f fe 75 d6 38 3b ed 3c de da f2 85 2b 97 06 77 d7 e5 d3 cb 4e b9 bc e8 da d7 d6 6d 7f da 5a 16 9f 26 95 4f 5d e3 c2 9e b4 a7 4c b7 c7 57 f5 f6 a5 a6 3e 36 1e b5 4f 37 97 6d d9 7e fc d4 bb fc 5c ee 68 c6 65 a3 52 77 2e 1e 3f 29 a5 ca 49 7d 7e 5a af df d4 6a df 07 15 8b 9d cf db f7 d6 fe ed e8 2a 3f fc 74 32 5a d8 9f cd 7a a7 9d eb 96 4f 95 fd 19 6b 9c 35 ed f9 48 79 3c 56 27 6a 71 34 5a 5c b0 b3 9e 5e f6 fc 4f a5 61 a1 54 af b7 e6 33 ff 7a 7f d8 fc 7c 79 76 71 fb eb 81 de 6a b7 3c 02 9c 90 16 96 69 7b b5 c4 c8 f7 a7 87 b9 dc 7c 3e cf ce 0b 59 c7 1d e6 94 83 83 83 dc 82 f8 [TRUNCATED] Data Ascii: c38[i{\|+\Y$Mp/8/R-$}S%aNwT9^W'4-h}IU6e-:7ON9zz>R<u8;<+wNmZ&O]LW>6O7m~\heRw.?)I}~Zj*?t2ZzOk5Hy<V'jq4Z\^OaT3z\|yvqj<i{\|>YLNH`1_i:3j
Oct 1, 2024 20:10:36.485276937 CEST	224	IN	Data Raw: 99 ed 67 3a cb 29 4b 48 9a 78 ab 25 7c b6 f0 73 04 a9 2a 69 23 d5 f5 98 5f 9b f9 83 4c 25 91 8b 03 b2 55 8b d5 12 4f 06 9b 4f 1d d7 8f 4d 9f 1b ba 3f aa e9 ec c9 d0 58 86 bf a4 25 c3 36 7c 43 35 33 9e a6 9a ac a6 a4 25 6f e4 1a f6 24 e3 3b 99 81 Data Ascii: g:)KHx%\|s*i#_L%UOOM?X%6\|C53%o$;l'j'\|Te\Qc}bE4d1PkOs_sV@wW]Ym}U]gf5S\N/TkJe5#f1/x9';4=v2.240JJa
Oct 1, 2024 20:10:36.485286951 CEST	1236	IN	Data Raw: db 88 19 c3 91 8f d7 3c 7f d5 0d 6f 6a aa cb 43 30 c0 34 6c 96 e1 3a 5a dd 79 de d9 89 11 a9 fc 49 44 2a 7f 25 91 17 7f 12 91 17 7f 3e 91 9e e1 33 70 77 42 14 4e 55 5d 37 ec 61 c6 0d c4 b0 4f 62 20 76 7b cc 34 99 7b ab fa e8 f5 24 f5 90 26 a4 5f Data Ascii: <ojC04l:ZyID%>3pwBNU]7aOb v{4{$&_7?M3r]\|n4>:\q%FZ;4CY%#]8\(%%U3^Q1v=#R@B`0JRo4( VRg';.HnCI Xj{
Oct 1, 2024 20:10:36.485409021 CEST	1236	IN	Data Raw: 7b 53 6e 8e 8b 15 ed fc 4c 56 4f 8e 27 d7 5f 2e db 18 37 57 1b 4d 59 47 df 97 c6 f1 3e e8 08 e8 be 9c f5 f3 25 b3 69 54 7e b9 be 38 1e 61 fe b0 07 5c 9d ce dd ec aa 31 1c b6 4f 8a 8b d6 64 be 40 b5 a0 d0 36 ea 8b 96 35 f7 db cb 62 f1 ea a4 5e f8 Data Ascii: {SnLVO'_.7WMYG>%iT~8a\1Od@65b^<;_zNou[h_2t=?i}=(tv:G7;6azSki}^IAGB9QcC%8OMc&X"4%$F0VT1(!y&9bUG
Oct 1, 2024 20:10:36.485455990 CEST	1236	IN	Data Raw: 2d 67 d3 e6 cd e3 ed e4 56 e9 39 5d 53 f7 f4 87 db 8b 7b 94 fa fb f7 dd 79 e7 fe f6 53 6f 22 af 6e ac 83 4a f7 e1 a6 d0 ca 03 e7 58 37 da e7 a7 ab ab ce 08 b8 ef 16 ed 7c 57 be 6a e8 93 ab c6 0d 0a 61 64 32 0d 0a 8d dc 7d 38 2d f4 3a 77 a5 6e a7 Data Ascii: -gV9]S{ySo"nJX7\|Wjad2}8-:wnh7\t~>.!y{:-^=@i]5Vlv><^J;"iVqRTg_K:1H!gx]>f!<{S
Oct 1, 2024 20:10:36.485467911 CEST	1236	IN	Data Raw: 6f 2d 8e 96 f5 22 c6 42 02 31 e5 1c 40 39 ff 52 99 10 82 5d fa 78 cb 94 02 df 28 08 f9 79 c7 bb dd 6b fd a5 4b 42 bd 70 8e 93 88 11 d3 26 bb e2 b9 26 a2 fb 1b e9 d1 6b ef cf 7d cd cf a4 6a 88 c8 42 4f ff 42 b7 b0 65 59 a8 27 ff ac 39 fd bf d0 e9 Data Ascii: o-"B1@9R]x(ykKBp&&k}jBOBeY'914\|@Lrcg>0 R;E-xlFp#Rz>S\|R`/$LUSJpxWLgY]\!`b9rJHJ12o=^qSx,tt}
Oct 1, 2024 20:10:36.485835075 CEST	376	IN	Data Raw: ac b2 b0 ed 0d 28 82 ce 35 c5 31 ba b9 ec f8 35 2f 6c 30 28 92 43 bc 14 5e 73 26 2e 4d f3 b0 8a 38 eb d7 f6 f7 07 5a a1 af 68 d8 0a 40 f0 35 ea 88 4e 6c 70 3a 4c ca 00 a5 80 3d 07 98 b9 40 68 43 42 37 28 ab 3b a6 97 22 1b da 14 71 0a 53 d6 f9 34 Data Ascii: (515/l0(C^s&.M8Zh@5Nlp:L=@hCB7(;"qS4ni>R9u+%eRaT{Ct6<zh'\8-~!.#Wc[U\~=u<,OPpG]S9O4z]"jqhE8
Oct 1, 2024 20:10:37.395689011 CEST	569	OUT	GET /track.php?domain=oamdikaljka0918471781.com&toggle=browserjs&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:37.624861956 CEST	599	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:37 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Custom-Track: browserjs Transfer-Encoding: chunked Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Oct 1, 2024 20:10:38.155591011 CEST	437	OUT	GET /ls.php?t=66fc3b1c&token=cd6ec3593189db3a63d15165ca8718e1f2911c11 HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:38.404795885 CEST	856	IN	HTTP/1.1 201 Created Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Origin: Access-Control-Max-Age: 86400 Charset: utf-8 Content-Type: text/javascript;charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:38 GMT Server: Caddy Server: nginx X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_CjErsXMSCw1L49JJROIsv1TCrWMpS9MVZMSTx+HHG4KVrpkmf6gClrD15CkbrXzlRnC4Iy2i5cwRrurN85xgkw== Transfer-Encoding: chunked Data Raw: 31 30 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 10{"success":true}0
Oct 1, 2024 20:10:41.054461956 CEST	688	OUT	GET /track.php?domain=oamdikaljka0918471781.com&caf=1&toggle=answercheck&answer=yes&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Oct 1, 2024 20:10:41.290110111 CEST	601	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:41 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Custom-Track: answercheck Transfer-Encoding: chunked Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Oct 1, 2024 20:10:41.301273108 CEST	545	OUT	GET /favicon.ico HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ww12.oamdikaljka0918471781.com/dowload/gopay.apk?usid=27&utid=8371154804 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Oct 1, 2024 20:10:41.524041891 CEST	221	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 0 Content-Type: image/x-icon Date: Tue, 01 Oct 2024 18:10:41 GMT Etag: "66e18132-0" Last-Modified: Wed, 11 Sep 2024 11:38:26 GMT Server: Caddy Server: nginx
Oct 1, 2024 20:11:26.610327005 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:38.063276052 CEST	233	IN	HTTP/1.1 408 Request Time-out Content-length: 110 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>
Oct 1, 2024 20:11:23.109766960 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:38.168906927 CEST	443	OUT	GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1 Host: d38psrni17bvxu.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ww12.oamdikaljka0918471781.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:38.819817066 CEST	442	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 11375 Connection: keep-alive Server: nginx Date: Tue, 01 Oct 2024 11:04:53 GMT Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT Accept-Ranges: bytes ETag: "65fc1e7b-2c6f" X-Cache: Hit from cloudfront Via: 1.1 5ddb18e15e6b0ed6114111e515bddc66.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P2 X-Amz-Cf-Id: mCqE0RoTqZmVXegF8kn-k8utPRxgf85vjr0fzU0cLIGoMEanqoTWTg== Age: 25545
Oct 1, 2024 20:10:38.819868088 CEST	1236	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 dc 00 00 02 58 08 03 00 00 00 4f 6d d4 16 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 00 50 4c 54 45 00 00 00 ff Data Ascii: PNGIHDRXOmtEXtSoftwareAdobe ImageReadyqe<PLTEcdtIK^IK]IK\03IHK_acsceubdtcet0=@SHK]IL]HK\MPbNQbORc.0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes-0 5!6"7#8
Oct 1, 2024 20:10:38.820013046 CEST	1236	IN	Data Raw: a4 aa 57 2a 20 af c2 1d de 89 88 54 d3 3e 08 77 78 27 22 52 4c fb 60 dc e1 9d 88 48 2d ed c3 70 87 77 22 22 a5 b4 0f c7 1d de 89 88 54 d2 3e 0a 77 78 27 22 12 d9 08 bb 47 e2 0e ef 44 44 ea 68 af 83 3b bc 13 11 29 a3 bd 1e ee f0 4e 44 a4 8a f6 ba Data Ascii: W* T>wx'"RL`H-pw""T>wx'"GDDh;)ND;"DDjho{'~X""74wx'"OND$v/H6;dqw""}+DD2io;ND$;@DDh;=ND$P;Q~GND$;
Oct 1, 2024 20:10:38.820025921 CEST	1236	IN	Data Raw: 3d 32 ee c9 79 07 77 74 27 af 58 35 e9 71 8f 4b 7b 74 dc 3b bc 7f 09 dc d1 9d b0 1d dc d3 d2 9e 00 f7 f9 f9 53 bb c0 1d dd 49 70 3f 67 c5 a4 c6 3d 3e ed 49 70 4f c8 3b b8 5f e9 4e c4 22 8e c9 48 c5 3d 05 ed 89 70 4f c6 3b b8 5f 8d eb 4c 54 b3 cf Data Ascii: =2ywt'X5qK{t;SIp?g=>IpO;_N"H=pO;_LTZd'W;.T'}~K=IqO;;aXS;fI\]J{ZwpGwj+$i{Tf="py[gwp2=p;W{1\|=#
Oct 1, 2024 20:10:38.820247889 CEST	1236	IN	Data Raw: 7b 5e dc 77 ec b8 e5 05 b5 b4 07 c0 3d db 5b da fd b4 1b c3 7d f2 f7 80 83 a4 f7 9d 49 d3 b8 e7 e2 3d 00 ed 61 70 cf c1 7b 15 ed d6 70 9f bc 80 1d 24 bb cf 4f 5a c7 3d 07 ef 41 68 0f 85 7b 6a de ab 69 37 87 3b d7 99 48 76 b7 4f 16 80 fb 8e 1d a7 Data Ascii: {^w=[}I=ap{p$OZ=Ah{ji7;HvO+=)yD=9I{gS}@pOA{W;Ij&K=Ai{d/$$Y\k}{`Eo?GVqGwvq{-$OO
Oct 1, 2024 20:10:38.820310116 CEST	1236	IN	Data Raw: cc 5b 42 69 af c7 fb 04 b6 13 a1 7b 34 dc 23 d1 1e 86 f7 f5 b4 6f c4 bd c3 7b cb a3 33 f1 68 af c3 bb 45 dc 19 39 40 e8 2e 03 f7 be f7 f3 24 f1 be 91 f6 7e dc db 9d 8c 8c 4b fb 68 de 27 b0 9d 28 51 af 16 86 fb 2d b3 d1 79 f3 e7 fd be ef 2d f5 49 Data Ascii: [Bi{4#o{3hE9@.$~Kh'(Q-y-I^7<a}6MIx;h/^\| ^~^M@\|OG0Te}NF}sMNAqOL{yCp{znw Y=y? SK&=2\K
Oct 1, 2024 20:10:38.820322037 CEST	1120	IN	Data Raw: 5f da f5 e2 8e ee 84 ed 7a 71 6f c0 7b 3a da 93 e2 5e 93 77 7f da 15 e3 8e ee 64 a7 87 4f 16 87 7b 4d de 53 d2 9e 18 f7 1a bc b7 a1 5d 33 ee f0 4e 7c b6 6b c6 bd 06 ef 69 69 4f 8e fb 70 de b7 3e d7 8a 76 dd b8 73 68 86 f8 6e d7 8c fb 70 de 9f 7d Data Ascii: _zqo{:^wdO{MS]3N\|kiiOp>vshnp}\|jk>ow]7y@{y@v]7g=]=N~3]?Fo<vN\|[i2i;}g75}m
Oct 1, 2024 20:10:38.820334911 CEST	892	IN	Data Raw: cb bc 3f 24 1b 77 46 0e 10 f5 7a 51 36 ee d2 68 bf 3a 53 ac 21 ed cd 71 ef f2 2e 8f f6 1e ef f7 3f 24 18 77 b6 64 88 56 fa 48 30 ee 12 69 ef f1 de 98 76 1f dc 9f 5a 3a 33 b6 5f 28 ef ff 84 ed 44 e8 ee db b7 85 d2 be 7f ec cc d2 53 d1 71 7f 6a a9 Data Ascii: ?$wFzQ6h:S!q.?$wdVH0ivZ:3_(DSqjEcya\*LPO;Y}qq7Kk{,;Q2,"Rio]=D6l_]ho]+gL~w)}/JWi;Y}w>x_C{
Oct 1, 2024 20:10:38.820785999 CEST	1236	IN	Data Raw: b3 e0 3e 98 f7 96 b4 cb c4 1d dd 89 2a 7a 73 d1 1c ee 03 79 cf 41 7b 26 dc ab 79 6f 4d bb 50 dc d1 9d 48 85 ed ed 71 af e4 3d 0f ed d9 70 ef e7 3d 00 ed 52 71 47 77 a2 0d c9 5c a9 0b 21 14 1a 8f f1 cc 92 2a dc d7 f3 1e 84 76 b1 b8 a3 3b 91 02 db Data Ascii: >zsyA{&yoMPHq=p=RqGw\!v;\|g}@=3KKcw]0N$pxK{v:w?aE-I?tn[G;2D\|=zGDwB{fw'`sHGV/1w
Oct 1, 2024 20:10:38.820797920 CEST	652	IN	Data Raw: 15 ef ce 10 ed 31 71 47 77 22 19 fd e7 74 4e dc 15 f1 ee 0c d1 1e 15 77 0e cd 10 49 e8 ab d3 99 71 ef f0 2e f7 35 be 27 ab 70 37 40 7b 5c dc f9 78 27 32 bc 25 d3 00 77 25 bc 3b 43 b4 c7 c6 9d 6f 77 22 cb b6 d7 c7 7d 4a f2 63 ab 4f ae c5 dd 08 ed Data Ascii: 1qGw"tNwIq.5'p7@{\x'2%w%;Cow"}JcOqGw&wxw3Gw;?1Np3D{K](3>'`qbG"qD6mG&pGw"O#wgTQ:-w59C'R\|
Oct 1, 2024 20:10:38.910501957 CEST	1236	IN	Data Raw: ee ef a5 a7 3d 32 ee d8 4e 64 5b f7 23 e9 cd 8a c8 7b 24 dc e3 0d 7e cc 86 3b b6 13 19 d7 fd 48 0e b5 a2 f1 ee 0c d1 1e 17 77 56 15 91 71 dd 8f e4 71 2b 12 ef ce 10 ed 51 71 67 4d 11 c9 c8 1c ee 91 9e 6b 72 86 68 8f 88 3b 23 07 88 c4 74 ad 39 dc Data Ascii: =2Nd[#{$~;HwVqq+QqgMkrh;#t9wl'e{G=&vf+HghJ=7ay{Q3J"*B}JBG5 c8"]6{(>#;BwF1=8NT8{b&#h;

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://yx62415.fyi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Windows Analysis Report
http://yx62415.fyi

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:38.435098886 CEST	479	OUT	GET /track.php?domain=oamdikaljka0918471781.com&toggle=browserjs&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:39.029855013 CEST	599	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:38 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Custom-Track: browserjs Transfer-Encoding: chunked Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Oct 1, 2024 20:10:41.311811924 CEST	598	OUT	GET /track.php?domain=oamdikaljka0918471781.com&caf=1&toggle=answercheck&answer=yes&uid=MTcyNzgwNjIzNi4zMTA5OjEzYjg1ZTE3MzZlMWMzNTlkMWU4YTk1YjcwOTUzM2Q4ODg5Yjk1OWQzNmM5ZmU4YmY3NjAzNjg5ZDRiODRlYzY6NjZmYzNiMWM0YmU5MQ%3D%3D HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Oct 1, 2024 20:10:41.548161983 CEST	601	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue, 01 Oct 2024 18:10:41 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Custom-Track: answercheck Transfer-Encoding: chunked Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Oct 1, 2024 20:11:26.610618114 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:38.935993910 CEST	333	OUT	GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1 Host: d38psrni17bvxu.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:39.596147060 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 11375 Connection: keep-alive Server: nginx Date: Tue, 01 Oct 2024 11:04:53 GMT Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT Accept-Ranges: bytes ETag: "65fc1e7b-2c6f" X-Cache: Hit from cloudfront Via: 1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P2 X-Amz-Cf-Id: MOJAlyINJJi9_OpTUP7Di5ljmwMQpw9d9HQuDXbdOYXCii0B8IgocQ== Age: 25546 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 dc 00 00 02 58 08 03 00 00 00 4f 6d d4 16 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 00 50 4c 54 45 00 00 00 ff ff ff 63 64 74 49 4b 5e 49 4b 5d 49 4b 5c 30 33 49 48 4b 5f 61 63 73 63 65 75 62 64 74 63 65 74 15 19 30 3d 40 53 48 4b 5d 49 4c 5d 48 4b 5c 4d 50 62 4e 51 62 4f 52 63 12 17 2e 14 19 30 22 26 3b 28 2c 40 2b 2f 42 30 34 49 2e 32 46 2f 33 47 2d 31 44 30 34 48 2e 32 45 30 34 47 31 35 48 32 36 49 35 39 4c 38 3c 50 36 3a 4d 39 3d 51 37 3b 4e 3a 3e 52 3a 3e 51 3b 3f 52 3c 40 53 49 4c 5c 62 65 75 61 64 74 62 65 74 63 66 74 62 65 73 13 18 2d 15 1a 30 1b 20 35 1c 21 36 1d 22 37 1e 23 38 1d 22 36 1f 24 39 20 25 3a 21 26 3b 22 27 3c 22 27 3b 24 29 3e 23 28 3c 25 2a 3f 24 29 3d 26 2b 40 25 2a 3e 27 2c 41 26 2b 3f 28 2d 42 29 2e 43 28 2d 41 29 2e 42 2a 2f 43 2b 30 44 2c 31 45 30 35 49 31 35 47 3c 40 52 3d 41 53 49 4d 5f 48 4c 5d 4b 4f 60 48 4c 5c 4d 51 62 61 65 75 11 17 [TRUNCATED] Data Ascii: PNGIHDRXOmtEXtSoftwareAdobe ImageReadyqe<PLTEcdtIK^IK]IK\03IHK_acsceubdtcet0=@SHK]IL]HK\MPbNQbORc.0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes-0 5!6"7#8"6$9 %:!&;"'<"';$)>#(<%?$)=&+@%>',A&+?(-B).C(-A).B/C+0D,1E05I15G<@R=ASIM_HL]KO`HL\MQbaeu.-/.0/.0/11234 5!6#8$9%: &;"':$)<&+>',?(-@).A/B+0C,1D/A-2E.3F/4G05H16I/4F05G38K6;N49K;@S;@R<ASGL^bfuaetbft.0!5"6#7$8%9 &:!';"(<!':#)=#)<$=&,@&,?+1E)/B06IGL]GL\HM]bfs-.01 4!5"6#7$8 '< ';*0B.4F06H06G-0!5 (< (;
Oct 1, 2024 20:10:39.596230030 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 15 de 74 00 00 00 b1 74 52 4e 53 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ttRNS
Oct 1, 2024 20:10:39.596241951 CEST	1236	IN	Data Raw: 4a 68 6f 86 3b bc 13 11 b4 e7 ea e5 53 8d b8 6e 86 bb 74 de ff ea 9a 92 62 21 52 fc 8a 5a 52 7f 28 9a f6 6d 0d b1 6e 8a bb 6c de 37 ef 2d a9 af 20 0f c5 ee 2b 45 2d a9 cd 86 68 f7 c1 5d 32 ef 65 e1 be 77 2f f6 50 e4 ef f6 bd e0 ae 94 76 3f dc e5 Data Ascii: Jho;Sntb!RZR(mnl7- +E-h]2ew/Pv?^NQ+m=}y1Tm{O}q{y;aaioD}Abvwyc2qoG{[;37HD^pM{{e^&x'KP!hKP
Oct 1, 2024 20:10:39.596560001 CEST	1236	IN	Data Raw: 88 bb 52 de cb c5 9d 6b a9 14 ac 6b c0 dd 00 ed 43 70 3f 78 f0 9b bf 52 c7 fb 66 6c 27 42 f7 a0 b8 bf ac 93 f6 a1 b8 2b e4 bd 54 dc e1 88 c2 06 ee 57 69 df a6 94 f6 11 b8 ab e3 bd 4c dc ef c4 22 0a dd 9d e0 ae 9c f6 91 b8 2b e3 7d 33 b6 13 a1 7b Data Ascii: RkkCp?xRfl'B+TWiL"+}3{ U^R{s-nnk~!-ov"to'^w5ov"tokpgEgen}w3rvG}_w49@LiP../k.!.K:?
Oct 1, 2024 20:10:39.596573114 CEST	1236	IN	Data Raw: bc bb fc b4 07 e4 7d 82 ef 76 a2 e0 3d 0a ee cd f6 da 8f af e7 ed 70 41 b8 6f a4 3d 18 ef 13 d8 4e 84 ee 39 71 bf 65 b6 82 b7 c3 85 e0 fe cb 63 d5 05 e0 7d 02 db 89 d0 3d 1f ee 37 cd 0e e0 ed 70 01 b8 0f a2 3d 08 ef 65 e0 0e 35 c4 3f ab 8a c4 fd Data Ascii: }v=pAo=N9qec}=7p=e5?q};(KxwhI`{+(uho}J.Z'IZpM{poB{7{EmiOMi8$t{sS<6ruq_
Oct 1, 2024 20:10:39.596811056 CEST	1236	IN	Data Raw: 18 f7 46 b4 27 e7 bd 9a 76 25 b8 9f fc 1f 56 3a 95 d6 8d 27 d5 e2 9e 98 f7 b7 17 1b d2 3b 90 77 17 86 f6 a4 bc 1f 7f 7e 76 56 33 ee 7c bb 13 df ed 9a 70 4f c8 fb db 0b 1e f4 0e e0 dd 85 a2 3d 19 ef 83 69 57 83 3b 1b ef c4 76 bb 2a dc 13 f1 ee 45 Data Ascii: F'v%V:';w~vV3\|pO=iW;v*E{3p=hW;=wH[k=2h}=gL}wvewx?.~saZx;pQO{wt'lW{w7dwt'l{`
Oct 1, 2024 20:10:39.596823931 CEST	1236	IN	Data Raw: b8 b4 8f e6 7d 0e db 89 e4 65 02 f7 b8 b4 f7 78 f7 1b 19 b9 7f ac 5a f1 01 b8 7b f1 1e 9f f6 51 bc 2b c1 9d 91 03 54 58 2f aa c7 3d 3e ed 9e bc f7 2e a3 36 c3 bd 31 ef 69 68 1f ce bb 0e dc d9 6e a7 e2 fa 48 37 ee 69 68 6f ce fb d9 c1 b4 0f c5 bd Data Ascii: }exZ{Q+TX/=>.61ihnH7ihoh{`\J1wy?+a;=1yAHkA+"3^}$s\|n{&G^Z*rSi{->.w)6
Oct 1, 2024 20:10:39.596836090 CEST	1236	IN	Data Raw: 03 79 cf 41 7b 26 dc ab 79 6f 4d bb 50 dc d1 9d 48 85 ed ed 71 af e4 3d 0f ed d9 70 ef e7 3d 00 ed 52 71 47 77 a2 0d c9 5c a9 0b 21 14 1a 8f f1 cc 92 2a dc d7 f3 1e 84 76 b1 b8 a3 3b 91 02 db c3 e0 be 8e f7 7c b4 67 c5 7d 95 f7 40 b4 cb c5 1d dd Data Ascii: yA{&yoMPHq=p=RqGw\!*v;\|g}@=3KKcw]0N$pxK{v:w?aE-I?tn[G;2D\|=zGDwB{fw'`sHGV/1w?.>"t{
Oct 1, 2024 20:10:39.597187996 CEST	634	IN	Data Raw: ee 0c d1 1e 15 77 0e cd 10 49 e8 ab d3 99 71 ef f0 2e f7 35 be 27 ab 70 37 40 7b 5c dc f9 78 27 32 bc 25 d3 00 77 25 bc 3b 43 b4 c7 c6 9d 6f 77 22 cb b6 d7 c7 7d 4a f2 63 ab 4f ae c5 dd 08 ed b1 71 47 77 a2 bc bd 26 06 77 d1 13 81 9f fc 78 05 77 Data Ascii: wIq.5'p7@{\x'2%w%;Cow"}JcOqGw&wxw3Gw;?1Np3D{K](3>'`qbG"qD6mG&pGw"O#wgTQ:-w59C'R\|wfm])q
Oct 1, 2024 20:10:39.686542034 CEST	1236	IN	Data Raw: ee ef a5 a7 3d 32 ee d8 4e 64 5b f7 23 e9 cd 8a c8 7b 24 dc e3 0d 7e cc 86 3b b6 13 19 d7 fd 48 0e b5 a2 f1 ee 0c d1 1e 17 77 56 15 91 71 dd 8f e4 71 2b 12 ef ce 10 ed 51 71 67 4d 11 c9 c8 1c ee 91 9e 6b 72 86 68 8f 88 3b 23 07 88 c4 74 ad 39 dc Data Ascii: =2Nd[#{$~;HwVqq+QqgMkrh;#t9wl'e{G=&vf+HghJ=7ay{Q3J"*B}JBG5 c8"]6{(>#;BwF1=8NT8{b&#h;
Oct 1, 2024 20:10:39.686667919 CEST	59	IN	Data Raw: 11 b8 13 11 11 b8 13 11 81 3b 11 11 81 3b 11 11 81 3b 11 11 81 3b 11 11 81 3b 11 11 b8 f3 13 10 11 d9 eb ff 05 18 00 7f b6 1d fa 08 34 f3 8d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: ;;;;;4IENDB`

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:41.541030884 CEST	394	OUT	GET /favicon.ico HTTP/1.1 Host: ww12.oamdikaljka0918471781.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=36f8b879dde3ffa7:T=1727806240:RT=1727806240:S=ALNI_MbO0kKxWHjE5CDYw4UzS9T8y_MRjA
Oct 1, 2024 20:10:42.345618010 CEST	221	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 0 Content-Type: image/x-icon Date: Tue, 01 Oct 2024 18:10:42 GMT Etag: "66e18132-0" Last-Modified: Wed, 11 Sep 2024 11:38:26 GMT Server: Caddy Server: nginx
Oct 1, 2024 20:10:42.371284962 CEST	221	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 0 Content-Type: image/x-icon Date: Tue, 01 Oct 2024 18:10:42 GMT Etag: "66e18132-0" Last-Modified: Wed, 11 Sep 2024 11:38:26 GMT Server: Caddy Server: nginx
Oct 1, 2024 20:11:27.409486055 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:10:44.276788950 CEST	429	OUT	GET / HTTP/1.1 Host: sds82215go.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:45.180480003 CEST	234	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 01 Oct 2024 18:10:44 GMT Content-Type: text/html Content-Length: 130 Last-Modified: Thu, 05 Sep 2024 08:59:34 GMT Connection: keep-alive ETag: "66d972f6-82" Accept-Ranges: bytes
Oct 1, 2024 20:10:45.316082001 CEST	130	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body>
Oct 1, 2024 20:10:46.011796951 CEST	372	OUT	GET /favicon.ico HTTP/1.1 Host: sds82215go.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://sds82215go.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:10:46.326112032 CEST	704	IN	HTTP/1.1 404 Not Found Server: openresty Date: Tue, 01 Oct 2024 18:10:45 GMT Content-Type: text/html Content-Length: 552 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:09:56 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 18:09:57 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=167753 Date: Tue, 01 Oct 2024 18:09:57 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:09:58 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 18:09:58 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=167696 Date: Tue, 01 Oct 2024 18:09:58 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 18:09:58 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:09:58 UTC	523	OUT	GET /TCaptcha.js HTTP/1.1 Host: ssl.captcha.qq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://yx62415.fyi/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:09:58 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 18:09:58 GMT Content-Type: text/javascript Content-Length: 91588 Connection: close P3P: CP=CAO PSA OUR Server: Trpc httpd Server: tencent http server Accept-Ranges: bytes Cache-Control: max-age=600
2024-10-01 18:09:58 UTC	1156	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6e 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 5f 5f 65 73 4d 6f 64 75 6c 65 3a 20 75 6e 64 65 66 69 6e 65 64 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 6e 2e 65 78 70 6f 72 74 73 2c 6e 2c 6e 2e 65 78 70 6f 72 74 73 2c 69 29 2c 6e 2e 6c 3d 21 30 2c 6e 2e 65 78 70 6f 72 74 73 7d 69 2e 6d 3d 65 2c 69 2e 63 3d 74 2c 69 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 69 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c Data Ascii: !function(e){var t={};function i(r){if(t[r])return t[r].exports;var n=t[r]={i:r,l:!1,exports:{__esModule: undefined}};return e[r].call(n.exports,n,n.exports,i),n.l=!0,n.exports}i.m=e,i.c=t,i.d=function(e,t,r){i.o(e,t)\|\|Object.defineProperty(e,t,{enumerabl
2024-10-01 18:09:58 UTC	4096	IN	Data Raw: 64 26 26 28 72 3d 69 29 2c 65 5b 72 5d 3d 74 5b 69 5d 7d 29 2c 6e 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 65 78 70 6f 72 74 53 74 61 72 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 69 20 69 6e 20 65 29 22 64 65 66 61 75 6c 74 22 3d 3d 3d 69 7c 7c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 69 29 7c 7c 72 28 74 2c 65 2c 69 29 7d 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 6e 28 69 28 31 29 2c 74 29 2c 6e 28 69 28 34 29 2c 74 29 2c 6e 28 69 28 33 29 2c 74 29 2c 6e 28 69 28 31 33 29 2c 74 29 2c 6e 28 69 28 31 34 29 2c 74 29 2c 6e 28 69 28 31 35 29 2c 74 29 2c 6e 28 69 28 32 29 2c 74 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 Data Ascii: d&&(r=i),e[r]=t[i]}),n=this&&this.__exportStar\|\|function(e,t){for(var i in e)"default"===i\|\|Object.prototype.hasOwnProperty.call(t,i)\|\|r(t,e,i)};t.__esModule=!0,n(i(1),t),n(i(4),t),n(i(3),t),n(i(13),t),n(i(14),t),n(i(15),t),n(i(2),t)},function(e,t,i){"use
2024-10-01 18:09:58 UTC	4096	IN	Data Raw: 6e 22 2c 22 74 72 75 65 22 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 75 6e 68 69 64 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 2c 22 66 61 6c 73 65 22 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 7d 2c 74 2e 73 65 74 56 6f 69 63 65 4f 76 65 72 46 6f 63 75 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 30 22 29 2c 65 2e 62 6c 75 72 28 29 3b 76 61 72 20 74 3d 30 2c 69 3d 77 69 6e 64 6f 77 2e 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 66 6f 63 75 73 28 29 2c 28 74 2b 3d 31 29 3e 3d 31 30 26 26 77 69 6e 64 6f 77 2e 63 6c 65 61 72 49 Data Ascii: n","true")}catch(e){}},unhide:function(){try{document.body.setAttribute("aria-hidden","false")}catch(e){}}},t.setVoiceOverFocus=function(e){e.setAttribute("tabindex","0"),e.blur();var t=0,i=window.setInterval(function(){e.focus(),(t+=1)>=10&&window.clearI
2024-10-01 18:09:58 UTC	4096	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3b 69 66 28 65 2e 6d 61 74 63 68 28 2f 61 6e 64 72 6f 69 64 2f 69 29 29 7b 76 61 72 20 74 3d 65 2e 6d 61 74 63 68 28 2f 51 51 5c 2f 28 5c 64 2b 5c 2e 5c 64 2b 5c 2e 5c 64 2b 29 2f 29 3b 69 66 28 74 26 26 32 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 69 3d 74 5b 31 5d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 72 65 74 75 72 6e 20 65 5b 69 5d 7c 7c 74 5b 69 5d 3f 65 5b 69 5d 3d 3d 3d 74 5b 69 5d 3f 72 28 65 2c 74 2c 69 2b 31 29 3a 4e 75 6d 62 65 72 28 65 5b 69 5d 29 2d 4e 75 6d 62 65 72 28 74 5b 69 5d 29 3a 30 7d 3b 69 66 28 72 28 69 2e 73 70 6c 69 74 28 22 2e 22 29 2c 22 38 2e 39 2e 32 38 22 2e 73 70 6c 69 74 Data Ascii: unction(){var e=window.navigator.userAgent;if(e.match(/android/i)){var t=e.match(/QQ\/(\d+\.\d+\.\d+)/);if(t&&2===t.length){var i=t[1],r=function(e,t,i){return e[i]\|\|t[i]?e[i]===t[i]?r(e,t,i+1):Number(e[i])-Number(t[i]):0};if(r(i.split("."),"8.9.28".split
2024-10-01 18:09:58 UTC	528	IN	Data Raw: 6c 6c 3d 3d 3d 69 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 73 74 61 63 6b 3b 69 66 28 21 65 29 72 65 74 75 72 6e 3b 76 61 72 20 74 3d 28 22 22 2b 65 29 2e 6d 61 74 63 68 28 2f 28 68 74 74 70 73 3f 3a 5c 2f 5c 2f 2e 2a 5c 2e 6a 73 29 2f 29 3b 72 65 74 75 72 6e 7b 75 72 6c 3a 6e 75 6c 6c 3d 3d 3d 74 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 5b 31 5d 2c 73 74 61 63 6b 3a 65 7d 7d 7d 3b 74 2e 69 73 49 66 72 61 6d 65 53 75 70 70 6f 72 74 43 64 6e 44 6f 6d 61 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 72 2e 67 65 74 49 45 56 65 72 73 69 6f 6e 28 29 3b 69 66 28 2d 31 21 3d 3d 65 26 26 65 3c 3d 39 29 72 65 74 75 72 6e 21 31 3b 69 66 28 6e 2e 63 68 65 63 6b 57 65 63 68 61 74 4d 69 6e 69 50 72 6f 67 72 Data Ascii: ll===i\|\|void 0===i?void 0:i.stack;if(!e)return;var t=(""+e).match(/(https?:\/\/.*\.js)/);return{url:null===t\|\|void 0===t?void 0:t[1],stack:e}}};t.isIframeSupportCdnDomain=function(){var e=r.getIEVersion();if(-1!==e&&e<=9)return!1;if(n.checkWechatMiniProgr
2024-10-01 18:09:59 UTC	2848	IN	Data Raw: 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6e 29 26 26 28 65 5b 6e 5d 3d 74 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 2e 69 73 49 6f 73 3d 74 2e 67 65 74 49 45 56 65 72 73 69 6f 6e 3d 74 2e 69 73 4c 6f 77 49 45 3d 74 2e 68 65 78 54 6f 52 67 62 3d 74 2e 73 65 74 49 6d 61 67 65 55 72 6c 3d 74 2e 67 65 74 53 70 72 69 74 65 45 6c 3d 74 2e 73 65 74 53 70 72 69 74 65 55 72 6c 3d 74 2e 67 65 74 53 70 72 69 74 65 53 74 79 6c 65 53 74 72 3d 74 2e 67 65 74 53 70 72 69 74 65 53 74 79 6c 65 3d 76 6f 69 64 20 30 3b 76 61 72 20 6e 3d 69 28 31 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b Data Ascii: rototype.hasOwnProperty.call(t,n)&&(e[n]=t[n]);return e}).apply(this,arguments)};t.__esModule=!0,t.isIos=t.getIEVersion=t.isLowIE=t.hexToRgb=t.setImageUrl=t.getSpriteEl=t.setSpriteUrl=t.getSpriteStyleStr=t.getSpriteStyle=void 0;var n=i(1);function a(e,t){
2024-10-01 18:09:59 UTC	2848	IN	Data Raw: 39 3a 31 30 3d 3d 3d 72 3f 31 30 3a 36 7d 72 65 74 75 72 6e 20 69 3f 31 31 3a 2d 31 7d 3b 74 2e 69 73 49 6f 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 2f 69 70 68 6f 6e 65 7c 69 70 61 64 7c 69 70 6f 64 2f 67 69 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 3b 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 7b 61 64 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 65 26 26 28 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 69 2c 21 31 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 65 2e 61 74 74 61 Data Ascii: 9:10===r?10:6}return i?11:-1};t.isIos=function(){return!!/iphone\|ipad\|ipod/gi.test(navigator.userAgent)}},function(e,t,i){"use strict";t.__esModule=!0;t["default"]={add:function(e,t,i){e&&(e.addEventListener?e.addEventListener(t,i,!1):e.attachEvent?e.atta
2024-10-01 18:09:59 UTC	2848	IN	Data Raw: 37 5c 75 38 62 34 39 22 2c 22 5c 75 39 35 64 63 5c 75 39 35 38 39 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 35 32 30 37 5c 75 36 33 64 62 5c 75 37 30 62 61 5c 75 35 65 33 38 5c 75 38 39 38 66 5c 75 39 61 35 37 5c 75 38 62 34 39 5c 75 36 35 62 39 5c 75 35 66 30 66 22 2c 22 5c 75 36 32 31 31 5c 75 34 65 30 64 5c 75 36 37 30 33 5c 75 66 66 30 63 5c 75 36 33 64 62 5c 75 34 65 30 30 5c 75 37 61 32 65 5c 75 39 61 35 37 5c 75 38 62 34 39 5c 75 36 35 62 39 5c 75 35 66 30 66 22 2c 22 5c 75 36 31 30 66 5c 75 38 39 38 62 5c 75 35 33 63 64 5c 75 36 36 32 30 22 2c 22 5c 75 35 32 33 37 5c 75 36 35 62 30 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 37 31 32 31 5c 75 36 63 64 35 5c 75 35 32 61 30 5c 75 38 66 30 39 5c 75 35 37 31 36 5c 75 37 32 34 37 5c 75 Data Ascii: 7\u8b49","\u95dc\u9589\u9a57\u8b49","\u5207\u63db\u70ba\u5e38\u898f\u9a57\u8b49\u65b9\u5f0f","\u6211\u4e0d\u6703\uff0c\u63db\u4e00\u7a2e\u9a57\u8b49\u65b9\u5f0f","\u610f\u898b\u53cd\u6620","\u5237\u65b0\u9a57\u8b49","\u7121\u6cd5\u52a0\u8f09\u5716\u7247\u
2024-10-01 18:09:59 UTC	2848	IN	Data Raw: 61 64 5c 75 33 30 37 66 5c 75 38 66 62 63 5c 75 33 30 37 66 22 2c 22 5c 75 37 35 33 62 5c 75 35 30 63 66 5c 75 33 30 36 65 5c 75 38 61 61 64 5c 75 33 30 37 66 5c 75 38 66 62 63 5c 75 33 30 37 66 5c 75 33 30 36 62 5c 75 35 39 33 31 5c 75 36 35 35 37 5c 75 33 30 35 37 5c 75 33 30 37 65 5c 75 33 30 35 37 5c 75 33 30 35 66 5c 75 33 30 30 32 5c 75 33 30 61 66 5c 75 33 30 65 61 5c 75 33 30 63 33 5c 75 33 30 61 66 5c 75 33 30 35 37 5c 75 33 30 36 36 5c 75 36 36 66 34 5c 75 36 35 62 30 5c 75 33 30 35 37 5c 75 33 30 36 36 5c 75 33 30 34 66 5c 75 33 30 36 30 5c 75 33 30 35 35 5c 75 33 30 34 34 22 2c 22 5c 75 38 61 38 64 5c 75 38 61 33 63 5c 75 33 30 36 62 5c 75 36 32 31 30 5c 75 35 32 39 66 5c 75 33 30 35 37 5c 75 33 30 37 65 5c 75 33 30 35 37 5c 75 33 30 35 66 22 Data Ascii: ad\u307f\u8fbc\u307f","\u753b\u50cf\u306e\u8aad\u307f\u8fbc\u307f\u306b\u5931\u6557\u3057\u307e\u3057\u305f\u3002\u30af\u30ea\u30c3\u30af\u3057\u3066\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044","\u8a8d\u8a3c\u306b\u6210\u529f\u3057\u307e\u3057\u305f"
2024-10-01 18:09:59 UTC	4096	IN	Data Raw: 78 65 37 5c 78 65 33 6f 22 2c 22 4d 75 64 61 72 20 70 61 72 61 20 6f 20 6d 6f 64 6f 20 70 61 64 72 5c 78 65 33 6f 22 2c 22 4d 75 69 74 6f 20 64 69 66 5c 78 65 64 63 69 6c 3f 20 4d 75 64 65 20 70 61 72 61 20 6f 20 6d 6f 64 6f 20 73 69 6d 70 6c 65 73 22 2c 22 46 65 65 64 62 61 63 6b 22 2c 22 54 65 6e 74 61 72 20 6f 75 74 72 6f 20 63 61 70 74 63 68 61 22 2c 22 46 61 6c 68 61 20 6e 6f 20 63 61 72 72 65 67 61 6d 65 6e 74 6f 20 64 61 20 69 6d 61 67 65 6d 2e 20 43 6c 69 71 75 65 20 70 61 72 61 20 61 74 75 61 6c 69 7a 61 72 22 2c 22 56 65 72 69 66 69 63 61 5c 78 65 37 5c 78 65 33 6f 20 63 6f 6e 63 6c 75 5c 78 65 64 64 61 22 2c 22 41 20 72 65 64 65 20 65 78 70 69 72 6f 75 2e 20 54 65 6e 74 65 20 6e 6f 76 61 6d 65 6e 74 65 2e 22 2c 22 46 61 6c 68 61 20 6e 61 20 76 Data Ascii: xe7\xe3o","Mudar para o modo padr\xe3o","Muito dif\xedcil? Mude para o modo simples","Feedback","Tentar outro captcha","Falha no carregamento da imagem. Clique para atualizar","Verifica\xe7\xe3o conclu\xedda","A rede expirou. Tente novamente.","Falha na v

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:10:01 UTC	353	OUT	GET /TCaptcha.js HTTP/1.1 Host: ssl.captcha.qq.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:10:02 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 18:10:02 GMT Content-Type: text/javascript Content-Length: 91588 Connection: close P3P: CP=CAO PSA OUR Server: Trpc httpd Server: tencent http server Accept-Ranges: bytes Cache-Control: max-age=600
2024-10-01 18:10:02 UTC	2580	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6e 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 5f 5f 65 73 4d 6f 64 75 6c 65 3a 20 75 6e 64 65 66 69 6e 65 64 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 6e 2e 65 78 70 6f 72 74 73 2c 6e 2c 6e 2e 65 78 70 6f 72 74 73 2c 69 29 2c 6e 2e 6c 3d 21 30 2c 6e 2e 65 78 70 6f 72 74 73 7d 69 2e 6d 3d 65 2c 69 2e 63 3d 74 2c 69 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 69 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c Data Ascii: !function(e){var t={};function i(r){if(t[r])return t[r].exports;var n=t[r]={i:r,l:!1,exports:{__esModule: undefined}};return e[r].call(n.exports,n,n.exports,i),n.l=!0,n.exports}i.m=e,i.c=t,i.d=function(e,t,r){i.o(e,t)\|\|Object.defineProperty(e,t,{enumerabl
2024-10-01 18:10:02 UTC	4096	IN	Data Raw: 72 65 6e 74 53 74 79 6c 65 5b 74 5d 3a 77 69 6e 64 6f 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 5b 74 5d 7d 3b 74 2e 73 65 74 43 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 26 26 74 26 26 6e 2e 69 73 4f 62 6a 65 63 74 28 74 29 29 7b 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 29 74 72 79 7b 65 2e 73 74 79 6c 65 5b 69 5d 3d 74 5b 69 5d 7d 63 61 74 63 68 28 72 29 7b 7d 72 65 74 75 72 6e 20 74 7d 7d 3b 74 2e 61 64 64 4d 79 43 6c 61 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 2e 63 6c 61 73 73 4c 69 73 74 29 65 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 74 29 3b 65 6c 73 65 7b 76 61 72 20 69 3d 65 2e 63 6c 61 73 73 4e 61 6d 65 2c 72 3d 69 2b 28 22 22 21 3d 3d 69 3f 22 20 22 3a 22 22 29 Data Ascii: rentStyle[t]:window.getComputedStyle(e,null)[t]};t.setCss=function(e,t){if(e&&t&&n.isObject(t)){for(var i in t)try{e.style[i]=t[i]}catch(r){}return t}};t.addMyClass=function(e,t){if(e.classList)e.classList.add(t);else{var i=e.className,r=i+(""!==i?" ":"")
2024-10-01 18:10:02 UTC	4096	IN	Data Raw: 6d 3a 65 2e 67 65 74 4f 53 28 29 2e 6e 61 6d 65 2c 63 6c 69 65 6e 74 3a 65 2e 67 65 74 42 72 6f 77 73 65 72 28 29 2e 6e 61 6d 65 7d 7d 74 2e 67 65 74 54 6f 6b 65 6e 49 44 3d 73 2c 74 2e 67 65 74 44 65 76 69 63 65 49 6e 66 6f 3d 63 2c 74 2e 67 65 74 4c 6f 67 43 6f 6d 6d 6f 6e 50 61 72 61 6d 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 7c 7c 22 75 6e 6b 6e 6f 77 6e 22 2c 74 3d 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 7c 7c 64 6f 63 75 6d 65 6e 74 2e 55 52 4c 2c 69 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3b 65 3d 65 2e 6c 65 6e 67 74 68 3e 35 31 32 3f 65 2e 73 75 62 73 74 72 28 30 2c 35 31 32 29 3a 65 2c 74 3d 74 2e 6c 65 6e 67 74 68 3e 31 30 32 34 3f 74 2e 73 75 62 Data Ascii: m:e.getOS().name,client:e.getBrowser().name}}t.getTokenID=s,t.getDeviceInfo=c,t.getLogCommonParams=function(){try{var e=document.referrer\|\|"unknown",t=location.href\|\|document.URL,i=navigator.userAgent;e=e.length>512?e.substr(0,512):e,t=t.length>1024?t.sub
2024-10-01 18:10:02 UTC	3200	IN	Data Raw: 75 72 6e 20 65 7d 3b 74 2e 61 64 64 55 72 6c 50 61 72 61 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 69 3b 66 6f 72 28 69 20 69 6e 20 74 29 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 5b 69 5d 26 26 28 65 3d 72 28 65 2c 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 69 29 2c 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 22 22 2b 74 5b 69 5d 29 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 2e 69 73 41 72 72 61 79 3d 74 2e 69 73 4f 62 6a 65 63 74 3d 76 6f 69 64 20 30 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 Data Ascii: urn e};t.addUrlParam=function(e,t){var i;for(i in t)"undefined"!=typeof t[i]&&(e=r(e,encodeURIComponent(i),encodeURIComponent(""+t[i])));return e}},function(e,t,i){"use strict";t.__esModule=!0,t.isArray=t.isObject=void 0;var r=function(e){return function(
2024-10-01 18:10:02 UTC	1424	IN	Data Raw: 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6e 29 26 26 28 65 5b 6e 5d 3d 74 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 2e 69 73 49 6f 73 3d 74 2e 67 65 74 49 45 56 65 72 73 69 6f 6e 3d 74 2e 69 73 4c 6f 77 49 45 3d 74 2e 68 65 78 54 6f 52 67 62 3d 74 2e 73 65 74 49 6d 61 67 65 55 72 6c 3d 74 2e 67 65 74 53 70 72 69 74 65 45 6c 3d 74 2e 73 65 74 53 70 72 69 74 65 55 72 6c 3d 74 2e 67 65 74 53 70 72 69 74 65 53 74 79 6c 65 53 74 72 3d 74 2e 67 65 74 53 70 72 69 74 65 53 74 79 6c 65 3d 76 6f 69 64 20 30 3b 76 61 72 20 6e 3d 69 28 31 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b Data Ascii: rototype.hasOwnProperty.call(t,n)&&(e[n]=t[n]);return e}).apply(this,arguments)};t.__esModule=!0,t.isIos=t.getIEVersion=t.isLowIE=t.hexToRgb=t.setImageUrl=t.getSpriteEl=t.setSpriteUrl=t.getSpriteStyleStr=t.getSpriteStyle=void 0;var n=i(1);function a(e,t){
2024-10-01 18:10:02 UTC	4096	IN	Data Raw: 29 22 7d 2c 6f 28 74 2c 69 29 29 29 2c 63 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 6e 2e 73 65 74 43 73 73 28 6c 2c 7b 7a 49 6e 64 65 78 3a 22 22 2b 63 7d 29 2c 6c 7d 74 2e 67 65 74 53 70 72 69 74 65 53 74 79 6c 65 3d 61 2c 74 2e 67 65 74 53 70 72 69 74 65 53 74 79 6c 65 53 74 72 3d 6f 2c 74 2e 73 65 74 53 70 72 69 74 65 55 72 6c 3d 73 2c 74 2e 67 65 74 53 70 72 69 74 65 45 6c 3d 73 2c 74 2e 73 65 74 49 6d 61 67 65 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 2c 72 29 7b 24 28 65 29 2e 63 68 69 6c 64 72 65 6e 28 29 2e 72 65 6d 6f 76 65 28 29 3b 76 61 72 20 61 3d 6e 2e 73 75 70 70 6f 72 74 73 43 53 53 28 22 62 61 63 6b 67 72 6f 75 6e 64 53 69 7a 65 22 2c 22 31 30 70 78 20 31 30 70 78 22 29 2c 6f 3d 22 22 2b 77 69 6e 64 6f 77 2e 54 43 61 70 74 63 Data Ascii: )"},o(t,i))),c!==undefined&&n.setCss(l,{zIndex:""+c}),l}t.getSpriteStyle=a,t.getSpriteStyleStr=o,t.setSpriteUrl=s,t.getSpriteEl=s,t.setImageUrl=function(e,t,i,r){$(e).children().remove();var a=n.supportsCSS("backgroundSize","10px 10px"),o=""+window.TCaptc
2024-10-01 18:10:02 UTC	176	IN	Data Raw: 7a 68 2d 68 6b 22 3a 5b 22 5c 75 35 62 38 39 5c 75 35 31 36 38 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 38 66 64 34 5c 75 35 36 64 65 22 2c 22 5c 75 37 31 32 31 5c 75 39 36 39 63 5c 75 37 39 31 39 5c 75 36 35 62 39 5c 75 35 66 30 66 22 2c 22 5c 75 35 65 33 38 5c 75 38 39 38 66 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 37 38 62 61 5c 75 35 62 39 61 22 2c 22 5c 75 37 31 32 31 5c 75 39 36 39 63 5c 75 37 39 31 39 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 35 65 33 38 5c 75 38 39 38 66 5c 75 39 61 35 Data Ascii: zh-hk":["\u5b89\u5168\u9a57\u8b49","\u8fd4\u56de","\u7121\u969c\u7919\u65b9\u5f0f","\u5e38\u898f\u9a57\u8b49","\u78ba\u5b9a","\u7121\u969c\u7919\u9a57\u8b49","\u5e38\u898f\u9a5
2024-10-01 18:10:02 UTC	4096	IN	Data Raw: 37 5c 75 38 62 34 39 22 2c 22 5c 75 39 35 64 63 5c 75 39 35 38 39 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 35 32 30 37 5c 75 36 33 64 62 5c 75 37 30 62 61 5c 75 35 65 33 38 5c 75 38 39 38 66 5c 75 39 61 35 37 5c 75 38 62 34 39 5c 75 36 35 62 39 5c 75 35 66 30 66 22 2c 22 5c 75 36 32 31 31 5c 75 34 65 30 64 5c 75 36 37 30 33 5c 75 66 66 30 63 5c 75 36 33 64 62 5c 75 34 65 30 30 5c 75 37 61 32 65 5c 75 39 61 35 37 5c 75 38 62 34 39 5c 75 36 35 62 39 5c 75 35 66 30 66 22 2c 22 5c 75 36 31 30 66 5c 75 38 39 38 62 5c 75 35 33 63 64 5c 75 36 36 32 30 22 2c 22 5c 75 35 32 33 37 5c 75 36 35 62 30 5c 75 39 61 35 37 5c 75 38 62 34 39 22 2c 22 5c 75 37 31 32 31 5c 75 36 63 64 35 5c 75 35 32 61 30 5c 75 38 66 30 39 5c 75 35 37 31 36 5c 75 37 32 34 37 5c 75 Data Ascii: 7\u8b49","\u95dc\u9589\u9a57\u8b49","\u5207\u63db\u70ba\u5e38\u898f\u9a57\u8b49\u65b9\u5f0f","\u6211\u4e0d\u6703\uff0c\u63db\u4e00\u7a2e\u9a57\u8b49\u65b9\u5f0f","\u610f\u898b\u53cd\u6620","\u5237\u65b0\u9a57\u8b49","\u7121\u6cd5\u52a0\u8f09\u5716\u7247\u
2024-10-01 18:10:02 UTC	1600	IN	Data Raw: 38 31 66 34 5c 75 33 30 35 37 5c 75 33 30 37 65 5c 75 33 30 35 62 5c 75 33 30 39 33 5c 75 33 30 30 32 43 61 70 74 63 68 61 5c 75 33 30 63 31 5c 75 33 30 66 63 5c 75 33 30 65 30 5c 75 33 30 36 62 5c 75 33 30 34 61 5c 75 35 35 34 66 5c 75 33 30 34 34 5c 75 35 34 30 38 5c 75 33 30 38 66 5c 75 33 30 35 62 5c 75 33 30 34 66 5c 75 33 30 36 30 5c 75 33 30 35 35 5c 75 33 30 34 34 22 5d 2c 6b 6f 3a 5b 22 5c 75 62 63 66 34 5c 75 63 35 34 38 20 5c 75 63 37 37 38 5c 75 63 39 39 64 22 2c 22 5c 75 62 33 63 63 5c 75 63 35 34 34 5c 75 61 63 30 30 5c 75 61 65 33 30 22 2c 22 5c 75 62 31 30 38 5c 75 62 62 33 34 20 5c 75 63 35 62 34 5c 75 62 38 33 35 5c 75 63 32 62 35 5c 75 62 32 63 38 5c 75 62 32 65 34 2e 22 2c 22 5c 75 63 37 37 63 5c 75 62 63 31 38 20 5c 75 63 37 37 38 5c Data Ascii: 81f4\u3057\u307e\u305b\u3093\u3002Captcha\u30c1\u30fc\u30e0\u306b\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044"],ko:["\ubcf4\uc548 \uc778\uc99d","\ub3cc\uc544\uac00\uae30","\ub108\ubb34 \uc5b4\ub835\uc2b5\ub2c8\ub2e4.","\uc77c\ubc18 \uc778\
2024-10-01 18:10:02 UTC	2848	IN	Data Raw: 78 65 37 5c 78 65 33 6f 22 2c 22 4d 75 64 61 72 20 70 61 72 61 20 6f 20 6d 6f 64 6f 20 70 61 64 72 5c 78 65 33 6f 22 2c 22 4d 75 69 74 6f 20 64 69 66 5c 78 65 64 63 69 6c 3f 20 4d 75 64 65 20 70 61 72 61 20 6f 20 6d 6f 64 6f 20 73 69 6d 70 6c 65 73 22 2c 22 46 65 65 64 62 61 63 6b 22 2c 22 54 65 6e 74 61 72 20 6f 75 74 72 6f 20 63 61 70 74 63 68 61 22 2c 22 46 61 6c 68 61 20 6e 6f 20 63 61 72 72 65 67 61 6d 65 6e 74 6f 20 64 61 20 69 6d 61 67 65 6d 2e 20 43 6c 69 71 75 65 20 70 61 72 61 20 61 74 75 61 6c 69 7a 61 72 22 2c 22 56 65 72 69 66 69 63 61 5c 78 65 37 5c 78 65 33 6f 20 63 6f 6e 63 6c 75 5c 78 65 64 64 61 22 2c 22 41 20 72 65 64 65 20 65 78 70 69 72 6f 75 2e 20 54 65 6e 74 65 20 6e 6f 76 61 6d 65 6e 74 65 2e 22 2c 22 46 61 6c 68 61 20 6e 61 20 76 Data Ascii: xe7\xe3o","Mudar para o modo padr\xe3o","Muito dif\xedcil? Mude para o modo simples","Feedback","Tentar outro captcha","Falha no carregamento da imagem. Clique para atualizar","Verifica\xe7\xe3o conclu\xedda","A rede expirou. Tente novamente.","Falha na v

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:10:18 UTC	703	OUT	GET /crossStorage.html HTTP/1.1 Host: tgonly-image-hk.tgchat111.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: http://yx62415.fyi/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:10:18 UTC	431	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 01 Oct 2024 18:10:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 358 Connection: close X-Request-ID: d8303ccdc4a448eeac2cc2d0967aa834 X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Accept-Ranges: bytes ETag: W/"358-1663519268000" Last-Modified: Sun, 18 Sep 2022 16:41:08 GMT Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
2024-10-01 18:10:18 UTC	358	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 69 74 6c 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 63 72 6f 73 73 53 74 6f 72 61 67 65 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 48 69 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 63 72 6f 73 73 53 74 6f 72 61 67 65 2e 69 6e 69 74 28 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Title</title> <script src="/js/crossStorage.js" type="text/javascript"></script></head><body>Hi<script type="text/javascript"> crossStorage.init([ {

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:10:29 UTC	650	OUT	GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://gopayjc984717.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:10:29 UTC	845	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 153198 Date: Tue, 01 Oct 2024 18:10:29 GMT Expires: Tue, 01 Oct 2024 18:10:29 GMT Cache-Control: private, max-age=3600 ETag: "16155903164772261079" X-Content-Type-Options: nosniff Link: <https://syndicatedsearch.goog>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 18:10:29 UTC	545	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 31 37 33 38 33 36 33 33 34 36 34 33 37 30 36 31 35 35 35 33 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 31 34 33 37 2c 31 37 33 30 31 34 33 39 2c 31 37 33 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,173
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 69 35 75 5a 58 51 73 64 48 4a 68 62 6e 4e 73 59 Data Ascii: omain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsY
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 71 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 Data Ascii: a;c.prototype.toString=function(){return this.ne};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Arr
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 70 61 3d 6c 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 71 61 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6b 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 70 61 29 70 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 63 21 3d 22 70 72 6f 74 6f 74 79 70 65 22 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 Data Ascii: t extensible");return a}:null}var pa=la;function qa(a,b){a.prototype=ka(b.prototype);a.prototype.constructor=a;if(pa)pa(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProp
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 55 66 28 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 55 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 65 6e 7d 63 61 74 63 68 28 6b 29 7b 74 68 69 73 2e 62 64 28 6b 29 3b 72 65 74 75 72 6e 7d 74 79 70 65 6f 66 20 68 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 74 68 69 73 2e 67 67 28 68 2c 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 63 65 28 32 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4c 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 Data Ascii: ion":h=!0;break a;default:h=!1}h?this.Uf(g):this.Ld(g)}};b.prototype.Uf=function(g){var h=void 0;try{h=g.then}catch(k){this.bd(k);return}typeof h=="function"?this.gg(h,g):this.Ld(g)};b.prototype.bd=function(g){this.ce(2,g)};b.prototype.Ld=function(g){thi
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 6d 3d 74 7d 29 3b 74 68 69 73 2e 69 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 6d 29 29 3b 72 65 74 75 72 6e 20 70 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 0a 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6c 2e 42 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 Data Ascii: new b(function(r,t){l=r;m=t});this.ib(k(g,l),k(h,m));return p};b.prototype.catch=function(g){return this.then(void 0,g)};b.prototype.ib=function(g,h){function k(){switch(l.B){case 1:g(l.Xa);break;case 2:h(l.Xa);break;default:throw Error("Unexpected state
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 69 66 28 21 73 61 28 6b 2c 67 29 29 7b 76 61 72 20 6c 3d 6e 65 77 20 63 3b 63 61 28 6b 2c 67 2c 7b 76 61 6c 75 65 3a 6c 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6b 29 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6c 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 69 66 28 6d 20 69 6e 73 74 61 6e 63 65 6f 66 20 63 29 72 65 74 75 72 6e 20 6d 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 65 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f Data Ascii: unction e(k){if(!sa(k,g)){var l=new c;ca(k,g,{value:l})}}function f(k){var l=Object[k];l&&(Object[k]=function(m){if(m instanceof c)return m;Object.isExtensible(m)&&e(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=O
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 3a 68 2c 49 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 0a 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 2d 31 2c 49 3a 76 6f 69 64 20 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 68 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 62 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 68 29 7b 68 3d 75 28 68 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 68 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d Data Ascii: :h,I:p}}return{id:l,list:m,index:-1,I:void 0}}function e(h){this[0]={};this[1]=b();this.size=0;if(h){h=u(h);for(var k;!(k=h.next()).done;)k=k.value,this.set(k[0],k[1])}}if(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!=
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 79 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 67 3d 30 3b 72 Data Ascii: y})};e.prototype.values=function(){return c(this,function(h){return h.value})};e.prototype.forEach=function(h,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,h.call(k,m[1],m[0],this)};e.prototype[Symbol.iterator]=e.prototype.entries;var g=0;r
2024-10-01 18:10:29 UTC	1390	IN	Data Raw: 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 65 3c 3d 30 7d 7d 29 3b 0a 71 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 73 61 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 5b 64 2c 62 5b 64 5d 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 71 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 61 3a 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 Data Ascii: ]!=b[--e])return!1;return e<=0}});q("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)sa(b,d)&&c.push([d,b[d]]);return c}});q("Array.prototype.find",function(a){return a?a:function(b,c){a:{var d=this;d instanceof String&&(d=String