mexa.sh Open in urlscan Pro
2606:4700:3035::6812:2c63 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mx-sh.net/7esqgekx2lm6/RUP554-RJ254647.rar.html
Effective URL:
https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Submission Tags: falconsandbox
Submission: On November 12 via api (November 12th 2020, 10:26:43 pm UTC) from US

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 22 HTTP transactions. The main IP is 2606:4700:3035::6812:2c63, located in United States and belongs to CLOUDFLARENET, US. The main domain is mexa.sh.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 25th 2020. Valid for: a year.

This is the only time mexa.sh was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3035::6818:61f9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	2606:4700:303... 2606:4700:3035::6812:2c63	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:820::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
22	4

1 2606:4700:3035::6818:61f9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

mx-sh.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2606:4700:3035::6812:2c63 (United States)

ASN13335 (CLOUDFLARENET, US)

mexa.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	mexa.sh mexa.sh	295 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	mx-sh.net 1 redirects mx-sh.net	614 B
22	4

	Domain	Requested by
19	mexa.sh	mexa.sh
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	www.googletagmanager.com	mexa.sh
1	mx-sh.net	1 redirects
22	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-25` - `2021-07-25`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Frame ID: 9D18841AB3F8D33C91340675AA7F74A3
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mx-sh.net/7esqgekx2lm6/RUP554-RJ254647.rar.html HTTP 302
https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

22
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

352 kB
Transfer

566 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mx-sh.net/7esqgekx2lm6/RUP554-RJ254647.rar.html HTTP 302
https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request RUP554-RJ254647.rar.html Show response
mexa.sh/7esqgekx2lm6/
Redirect Chain

https://mx-sh.net/7esqgekx2lm6/RUP554-RJ254647.rar.html
https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html

7 KB
8 KB

89ms
66ms

Document
text/html

2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b43ea2df5e137f66896d9b323913847d4a22cac95901f543a58b53038976f96c

Request headers

:method: GET
:authority: mexa.sh
:scheme: https
:path: /7esqgekx2lm6/RUP554-RJ254647.rar.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 12 Nov 2020 22:26:28 GMT
content-type: text/html ; charset=UTF-8
set-cookie: __cfduid=defe12f68e64ddd08b0fde0903133eed01605219988; expires=Sat, 12-Dec-20 22:26:28 GMT; path=/; domain=.mexa.sh; HttpOnly; SameSite=Lax lang=english; domain=mexa.sh; path=/
expires: Wed, 11 Nov 2020 22:26:28 GMT
cf-cache-status: DYNAMIC
cf-request-id: 06602a4a7f0000d705762ed000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hk9CWB6INhiO8MGfnubmqEh%2BsDeB0uW1kD1Rt7xUUVGYe88F9eGlaYzZzZDa0S5Nryg0tVD2Cczt1J22p0vTnLb7qcTpk5cgvxlo8OCuo%2BXvQXUn"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5f13acbd9cbbd705-FRA

Redirect headers

status: 302
date: Thu, 12 Nov 2020 22:26:28 GMT
content-type: text/html; charset=iso-8859-1
set-cookie: __cfduid=df5c337b0f8c5589a8d62f2272159b8721605219988; expires=Sat, 12-Dec-20 22:26:28 GMT; path=/; domain=.mx-sh.net; HttpOnly; SameSite=Lax
location: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
cf-cache-status: DYNAMIC
cf-request-id: 06602a4a460000d6dd2d3a9000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LNqjfYUF82Sq7PSFBbYZ2%2BC5nfZrfCe%2F%2F6zcsF%2BTolVsIuWg4uwmHWSqR7LfKVttCzk4WZJR6XKRLMayRYbze3C4QopMmK0yzhMhEcodk%2FVwzcfMbmM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5f13acbd3c9bd6dd-FRA

GET
H2 200 style.css
mexa.sh/css_newTheme/ 39 KB
8 KB 15ms
13ms Stylesheet
text/css 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/css_newTheme/style.css
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3688ad50ef9e8944e982c4e017363d2454b84814b3a289af6dc9a341988180e7

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 196
status: 200
cf-request-id: 06602a4ac60000d7053f273000000001
last-modified: Wed, 09 Aug 2017 05:59:44 GMT
server: cloudflare
etag: W/"9b82-5564bc95d8162"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=N7U%2BBExbIX%2FXqS3%2Fx1fOfOwfOlU45sRni0YCnVAn70P3Yf3T86hddyasCrkWrGmHKS6WBko%2BPR9MWQ9Bdo5KsdzijPrH6hpmYirAzX1m2LXpvIi2"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5f13acbe0db7d705-FRA

GET
H2 200 main.css
mexa.sh/css_newTheme/ 34 KB
8 KB 14ms
13ms Stylesheet
text/css 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/css_newTheme/main.css
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb10cdca88afebbb0b6af470c50a76cbabfc864193b0c535d93dcea81321c49e

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 4437
status: 200
cf-request-id: 06602a4ac60000d7052c9bd000000001
last-modified: Sun, 13 Jan 2019 07:31:45 GMT
server: cloudflare
etag: W/"89fe-57f51eba051d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hjHOz0Eo6vdcoz6jAOXo9DQ%2Fusdp2F94fU%2Bp0ZQPNU0WSK5oEsD6cG%2FL8rkq81DEsC%2BuwBusg7KISA4St5T6KWh6Sc%2FnoD24JuDza%2Bgtl9fpsx1t"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5f13acbe0db8d705-FRA

GET
H2 200 jquery-1.9.1.min.js Show response
mexa.sh/js/ 90 KB
31 KB 19ms
18ms Script
application/javascript 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/js/jquery-1.9.1.min.js
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 6702
status: 200
cf-request-id: 06602a4ac70000d70545b10000000001
last-modified: Tue, 30 May 2017 04:42:32 GMT
server: cloudflare
etag: W/"169d5-550b66e89c0d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9jVIaO9jXMM%2BtGbh4AGsbUu8T3GIfS1Tr0ZqExvBfX3ukBmVBOAAhctn67MriYuAsv30FGEy3wb%2BXzi0k7dYaQNkXGmASquUzLNsatyU6SFx%2Bs1E"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5f13acbe0db9d705-FRA

GET
H2 200 jquery.paging.js Show response
mexa.sh/js/ 19 KB
4 KB 15ms
14ms Script
application/javascript 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/js/jquery.paging.js
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8ecfe747c979fbd87624913200a9237343679923b495885bced089b80fc84f6

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3309
status: 200
cf-request-id: 06602a4ac70000d7054893b000000001
last-modified: Tue, 30 May 2017 04:42:32 GMT
server: cloudflare
etag: W/"4ba5-550b66e8af953"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2E%2BksjUq7aHVd7s%2FcQu%2B0Rya7nVE2sHezdZHe6Ekc9B%2F0LEZsf4c7hE7Jt%2BRmB04MzhPSSWuBDPfmXZGGCzpOrMTjtQ37Jf5k4GemJp1frsl%2F7y6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5f13acbe0dbcd705-FRA

GET
H2 200 jquery.cookie.js Show response
mexa.sh/js/ 3 KB
1 KB 15ms
15ms Script
application/javascript 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/js/jquery.cookie.js
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4fb91befcf134b81ecfa1c586e1f9d6426c8f4fc1f6c130ac1fddb49ab5df96

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5558
status: 200
cf-request-id: 06602a4ac70000d7050e8bc000000001
last-modified: Tue, 30 May 2017 04:42:32 GMT
server: cloudflare
etag: W/"c31-550b66e8b244b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZzuNrcWAYfnh29DT6QTtS0r0AYSz8ZtOh7YtbDeDM7YIQ01n8RBYxGJHcDQemmNFvDHVSNHafBLyisn4marrorsV7hTiL2uGG7sj%2Bv34RAifyqhq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5f13acbe0dbfd705-FRA

GET
H2 200 paging.js Show response
mexa.sh/js/ 2 KB
844 B 18ms
17ms Script
application/javascript 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mexa.sh/js/paging.js
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8a4ec002545486fb475c977fc9d53ac48a77cfb3d36ac91042c14dc688d5657

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 614
status: 200
cf-request-id: 06602a4aca0000d70522a65000000001
last-modified: Tue, 30 May 2017 04:42:32 GMT
server: cloudflare
etag: W/"6ad-550b66e89d071"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=j2T5aEIVgPCEDilyJokwkgOWWG8vMkweB%2FORQBqJl4SkFONiE0%2BQcFQ0HQFIXoCHbPY59Jp425nCK%2B4WStLz5M6YRuzSFmYniTCFIz8K%2FkSHZhJz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5f13acbe0dc0d705-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-79936000-1

Requested by

Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b46b22dcde89da2f0b96721df323714116397162c77acd640ba06113bbae73c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38702
x-xss-protection: 0
last-modified: Thu, 12 Nov 2020 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 12 Nov 2020 22:26:28 GMT

GET
H2 200 logo1_1x.png
mexa.sh/images/ 37 KB
38 KB 11ms
11ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/logo1_1x.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30ef46dd068df61a603fa7a022c1aecd1a841c58d98fd1ceceea80ba342e8408

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 6576
status: 200
content-length: 38035
cf-request-id: 06602a4adc0000d705462cf000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "9493-550b66ea9f333"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wbBpX0s0RXsU%2Br4twkZaZfePFGT5FazZvqhRSa8fmgYmNxSu7SPYzRTjnttAVUKrTjuvzAkVHpAkJitlBYMi9AA2xTToMVDroy%2B4%2F8fa204vke32"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe2e10d705-FRA

GET
H2 200 navicon1.png
mexa.sh/images/ 18 KB
18 KB 13ms
11ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navicon1.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f570af26ff118159a429ef1f0add1fa3431fe4ab22e15e80da0407e5bbac2125

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5551
status: 200
content-length: 18288
cf-request-id: 06602a4ae70000d7055cb14000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "4770-550b66eaf6d94"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=r%2Fzc%2F2gIQGYRQlkaKvSsuAKrb9ufokMc3fKN3ed3pTGJY4%2Bi3DcixIyQSf76Ne7bniTDz20TXtjyNkpOnLH%2F2olxgrrWSHuPEmBKVbmLmwK%2BF%2Bm8"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e24d705-FRA

GET
H2 200 navicon2.png
mexa.sh/images/ 16 KB
16 KB 14ms
13ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navicon2.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee6d96bdbf6cffc4e603a1845255d94861452f9132d400388c10c2b3d6fb3db1

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3545
status: 200
content-length: 16374
cf-request-id: 06602a4ae70000d705263f9000000001
last-modified: Tue, 30 May 2017 04:42:33 GMT
server: cloudflare
etag: "3ff6-550b66ea24267"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Y9z3ldmGTxSi23BmHdU0OxYOvDn0BlyW5jmBHM7rFd2XyDyCoBT7zAeGIpCG%2F2wlriW%2FGSbtuNqNnix0XpsLkLdaVRcuBtRYV7sX8wCof8oIEFFl"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e28d705-FRA

GET
H2 200 navicon3.png
mexa.sh/images/ 16 KB
16 KB 13ms
12ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navicon3.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aed030aceb42be1e4b98b63eaac7064b3cd6a08fa4806d967be6bd47c449b76f

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3064
status: 200
content-length: 15889
cf-request-id: 06602a4ae70000d7050b359000000001
last-modified: Tue, 30 May 2017 04:42:35 GMT
server: cloudflare
etag: "3e11-550b66eb4305b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lxqniObd195NhiB2NKCb0KKcrEIemCUilwf73Fh4i5VcFkDx6krA3RiIWp8bnpnGrdl1KmJnHRDcXVW1eSy3aDQ7ep2K53sH6mPeFp6rl8UuRTTk"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e29d705-FRA

GET
H2 200 navicon4.png
mexa.sh/images/ 16 KB
16 KB 16ms
15ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navicon4.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b14fc741b24eacfebddc328000e669b7974791f9f25cd78324925d31ddbb5b06

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5507
status: 200
content-length: 16109
cf-request-id: 06602a4ae70000d7053f275000000001
last-modified: Tue, 30 May 2017 04:42:35 GMT
server: cloudflare
etag: "3eed-550b66eba3375"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ynv6wlCESQ9huIudhHLNtwz67Feyiyv%2BZrnhFg491RiNYYa3TzU7qh88jpvwwm1QCu5GyFlD6aFQtX2fK2BxWiUfbWj7Z6FaKvUcnB19MWpArKIe"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e2bd705-FRA

GET
H2 200 navicon5.png
mexa.sh/images/ 15 KB
15 KB 15ms
14ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navicon5.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de5ce08ee842e8f12bfcc0c14dde4bb1e3c2fb695d32a36122b859c7f42b39d3

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 457
status: 200
content-length: 15551
cf-request-id: 06602a4ae80000d705362d1000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "3cbf-550b66ea3adb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HrPju46uEWt%2FcoAZPZ9hxKEJ9cc9CdTU5YGNlaF4AeoptgLl%2FIifNAxN2okLg2UBQ6Cfr%2BNggOFrKiNkY%2BZCJ9am2dgMMEWLKj54Xgc90gtrIyRN"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e2cd705-FRA

GET
H2 200 userin.png
mexa.sh/images/ 18 KB
18 KB 14ms
13ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/userin.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71657baf0148a08ee00ee4b43ab8106c192c670b34f853817a64dcff40fe1eba

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 6919
status: 200
content-length: 18182
cf-request-id: 06602a4ae80000d705622a8000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "4706-550b66eae15d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mWuvVk4KZtSzDU2qhDb6NZHN1Y76ZK1obZP3oe0EQWb8wA%2FzZLjWgZ%2Bi0kv5zzrrdeGeHdE3PERNXjdaJ3V2Y5f6MQijDxICzto45aqgJ%2BnPgyRb"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e2dd705-FRA

GET
H2 200 regicon.png
mexa.sh/images/ 19 KB
19 KB 15ms
14ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/regicon.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 012602b63f0fb6df165120eddb63fd137f160b56be0185cbe59aa6731f994779

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1857
status: 200
content-length: 19508
cf-request-id: 06602a4ae80000d7050fb97000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "4c34-550b66eae63f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=A2FlzUB7jWV47HQWQ0AYXLRiaYcEnENG%2BNXzs%2Fj1spiz7ApVPXtSqjdiDT7l2V2ZfiRQ4p4ZVGXwUjzLyx15BBkrU%2F8Qgp3ukYGafUjcATNT7SmZ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe3e2fd705-FRA

GET
H2 404 .png
mexa.sh/images/ 3 KB
3 KB 32ms
30ms Image
text/html 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/css_newTheme/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e9e4b1516efd000e0f4b2ce737cb6b418c14f8b6029733c23853db1ed532f14

Request headers

Referer: https://mexa.sh/css_newTheme/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 17 Dec 2019 16:49:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=crpnbYhxY0P9BFMVAS8yK7rd0ATLiu0k%2Bosdo4HukV0N7X5IfkXfJKdLDUE6b9qka3NoImUNAfp4O9JnsLUMq%2Bqg0sUv2B6xIlKyWlyJk2DpyrSu"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
status: 404
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5f13acbe4e38d705-FRA
cf-request-id: 06602a4aea0000d7052c9c0000000001

GET
H2 200 navbar.png
mexa.sh/images/ 22 KB
22 KB 16ms
14ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navbar.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/css_newTheme/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34785757170123855e1669c212f2987c30f2714200d8d5e8738ca3418f79e4c9

Request headers

Referer: https://mexa.sh/css_newTheme/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 4765
status: 200
content-length: 22290
cf-request-id: 06602a4aea0000d7053f276000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "5712-550b66eada489"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8KudlSZSGA3e%2FRBqbFPvQvqJtc07KPBqJehAuwI6YHw0h70LnW8Z7KsLHr2qsdU%2F3jeBk%2FsQyfXmxebKuxHuUHILkBmEthN6AvrQT%2F0gjp3rEMcl"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe4e39d705-FRA

GET
H2 200 flags.png
mexa.sh/images/ 29 KB
29 KB 14ms
12ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/flags.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/css_newTheme/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a38e9ae7d0318307be9b3c7aaccaf64e484d775fe9a507f850b9e4bfa314cf03

Request headers

Referer: https://mexa.sh/css_newTheme/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 6575
status: 200
content-length: 29723
cf-request-id: 06602a4aea0000d7053086a000000001
last-modified: Tue, 30 May 2017 04:42:34 GMT
server: cloudflare
etag: "741b-550b66ea518fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6UI94Ano6kcY9k4H%2BwIZj8IazqANSexLxNwt898JddSAeMs%2FHckyOWvAlVgsufDxPr58s52jVDEjLfQ6O4Lx5Z0%2BPE0jnF5jiqgGtGTlJj8EFq8G"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe4e3cd705-FRA

GET
H2 200 navbara.png
mexa.sh/images/ 22 KB
22 KB 16ms
14ms Image
image/png 2606:4700:3035::6812:2c63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mexa.sh/images/navbara.png
Requested by: Host: mexa.sh
URL: https://mexa.sh/css_newTheme/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34785757170123855e1669c212f2987c30f2714200d8d5e8738ca3418f79e4c9

Request headers

Referer: https://mexa.sh/css_newTheme/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 22:26:28 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 621
status: 200
content-length: 22290
cf-request-id: 06602a4aeb0000d7057b93f000000001
last-modified: Tue, 30 May 2017 04:42:35 GMT
server: cloudflare
etag: "5712-550b66ebad39e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=C%2BHSZm11IsfqUwwzval3s8994cvyYBxMyCEPVkj0o%2BoJmRrrJNjuJJUvC9utqtNzjjeDQExIf9qhnWWp8%2B%2B0h0%2BPDCbzdXwCWb%2F8RyN9F0VIpN2q"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f13acbe4e3ed705-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-79936000-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 4240
date: Thu, 12 Nov 2020 21:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Thu, 12 Nov 2020 23:15:48 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
402 B 44ms
12ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=53316668&t=pageview&_s=1&dl=https%3A%2F%2Fmexa.sh%2F7esqgekx2lm6%2FRUP554-RJ254647.rar.html&ul=en-us&de=UTF-8&dt=Download&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=235848194&gjid=1154253459&cid=430468856.1605219988&tid=UA-79936000-1&_gid=122706026.1605219988&_r=1&gtm=2oub41&z=1801723921

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mexa.sh/7esqgekx2lm6/RUP554-RJ254647.rar.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 12 Nov 2020 22:26:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://mexa.sh
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mexa.sh/	1970-01-19 13:55:06	Name: _gid Value: GA1.2.122706026.1605219988
.mexa.sh/	1970-01-19 13:53:40	Name: _gat_gtag_UA_79936000_1 Value: 1
.mexa.sh/	1969-12-31 23:59:59	Name: lang Value: english
.mexa.sh/	1970-01-20 07:24:51	Name: _ga Value: GA1.2.430468856.1605219988
.mexa.sh/	1970-01-19 14:36:51	Name: __cfduid Value: defe12f68e64ddd08b0fde0903133eed01605219988

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mexa.sh
mx-sh.net
www.google-analytics.com
www.googletagmanager.com
2606:4700:3035::6812:2c63
2606:4700:3035::6818:61f9
2a00:1450:4001:801::200e
2a00:1450:4001:81a::200e
2a00:1450:4001:820::2008
012602b63f0fb6df165120eddb63fd137f160b56be0185cbe59aa6731f994779
30ef46dd068df61a603fa7a022c1aecd1a841c58d98fd1ceceea80ba342e8408
34785757170123855e1669c212f2987c30f2714200d8d5e8738ca3418f79e4c9
3688ad50ef9e8944e982c4e017363d2454b84814b3a289af6dc9a341988180e7
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e9e4b1516efd000e0f4b2ce737cb6b418c14f8b6029733c23853db1ed532f14
71657baf0148a08ee00ee4b43ab8106c192c670b34f853817a64dcff40fe1eba
a38e9ae7d0318307be9b3c7aaccaf64e484d775fe9a507f850b9e4bfa314cf03
aed030aceb42be1e4b98b63eaac7064b3cd6a08fa4806d967be6bd47c449b76f
b14fc741b24eacfebddc328000e669b7974791f9f25cd78324925d31ddbb5b06
b43ea2df5e137f66896d9b323913847d4a22cac95901f543a58b53038976f96c
b46b22dcde89da2f0b96721df323714116397162c77acd640ba06113bbae73c7
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c4fb91befcf134b81ecfa1c586e1f9d6426c8f4fc1f6c130ac1fddb49ab5df96
c8ecfe747c979fbd87624913200a9237343679923b495885bced089b80fc84f6
de5ce08ee842e8f12bfcc0c14dde4bb1e3c2fb695d32a36122b859c7f42b39d3
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e8a4ec002545486fb475c977fc9d53ac48a77cfb3d36ac91042c14dc688d5657
eb10cdca88afebbb0b6af470c50a76cbabfc864193b0c535d93dcea81321c49e
ee6d96bdbf6cffc4e603a1845255d94861452f9132d400388c10c2b3d6fb3db1
f570af26ff118159a429ef1f0add1fa3431fe4ab22e15e80da0407e5bbac2125

mexa.sh Open in urlscan Pro 2606:4700:3035::6812:2c63 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

352 kBTransfer

566 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

5 Cookies

Indicators

mexa.sh Open in urlscan Pro
2606:4700:3035::6812:2c63 Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

352 kB
Transfer

566 kB
Size

5
Cookies

22 HTTP transactions
0 data transactions