urlscan.io logo urlscan.io
SecurityTrails logo

y0utube.live Open in urlscan Pro
2606:4700:3030::6815:6027  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://scan.security-suite.com/b/0006-mafe/?bb=1&lpkey=1662131758d005e959&trk=trkssl.com&tg=549e5320xoa4a0a9c8e&uclick=xoa4a0a9...
Effective URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Submission: On February 18 via manual from TW
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 5 countries across 16 domains to perform 23 HTTP transactions. The main IP is 2606:4700:3030::6815:6027, located in United States and belongs to CLOUDFLARENET, US. The main domain is y0utube.live.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 1st 2020. Valid for: a year.
This is the only time y0utube.live was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 167.172.33.55 14061 (DIGITALOC...)
1 116.202.184.246 24940 (HETZNER-AS)
1 2 2a05:d018:483... 16509 (AMAZON-02)
1 2a05:d018:483... 16509 (AMAZON-02)
1 3 108.163.203.126 32475 (SINGLEHOP...)
1 1 172.64.199.26 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
8 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 46.4.91.20 24940 (HETZNER-AS)
1 205.185.216.10 20446 (HIGHWINDS3)
1 139.45.196.195 9002 (RETN-AS)
6 213.174.135.2 39572 (ADVANCEDH...)
1 168.119.25.22 24940 (HETZNER-AS)
23 10
1    167.172.33.55 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
scan.security-suite.com
1    116.202.184.246 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.246.184.202.116.clients.your-server.de
trkssl.com
2    2a05:d018:483:6120:438a:c949:194a:dbd2 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
cd-down.com
1    2a05:d018:483:6120:813f:12dd:7e10:98e6 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
gdmconvtrck.com
3    108.163.203.126 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi
now.bestflowingstuff.co
1    172.64.199.26 (United States)

ASN13335 (CLOUDFLARENET, US)
tracking.armorads.com
1    2606:4700:3037::6815:56a2 (United States)

ASN13335 (CLOUDFLARENET, US)
adtrackingflow.com
8    2606:4700:3030::6815:6027 (United States)

ASN13335 (CLOUDFLARENET, US)
y0utube.live
1    46.4.91.20 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.20.91.4.46.clients.your-server.de
cst.wpu.sh
1    205.185.216.10 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net
cst.cstwpush.com
1    139.45.196.195 (United Kingdom)

ASN9002 (RETN-AS, GB)
ciksolre.net
6    213.174.135.2 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
na.nawpush.com
sw.wpush.org
sw.swwpush.com
sw.wpu.sh
vasgenerete.site
1    168.119.25.22 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.22.25.119.168.clients.your-server.de
ntvpwpush.com
Domain Requested by
8 y0utube.live now.bestflowingstuff.co
y0utube.live
3 now.bestflowingstuff.co 1 redirects gdmconvtrck.com
now.bestflowingstuff.co
2 vasgenerete.site sw.wpu.sh
2 cd-down.com 1 redirects
1 ntvpwpush.com sw.swwpush.com
1 sw.wpu.sh sw.wpush.org
1 sw.swwpush.com cst.wpu.sh
1 sw.wpush.org y0utube.live
1 na.nawpush.com cst.wpu.sh
1 ciksolre.net y0utube.live
1 cst.cstwpush.com y0utube.live
1 cst.wpu.sh 1 redirects
1 adtrackingflow.com 1 redirects
1 tracking.armorads.com 1 redirects
1 gdmconvtrck.com cd-down.com
1 trkssl.com
1 scan.security-suite.com
23 17

This site contains no links.

Subject Issuer Validity Valid
scan.security-suite.com
R3		 2021-02-10 -
2021-05-11		 3 months crt.sh
trkssl.com
R3		 2021-02-05 -
2021-05-06		 3 months crt.sh
cd-down.com
Amazon		 2020-04-22 -
2021-05-22		 a year crt.sh
gdmconvtrck.com
Amazon		 2020-03-21 -
2021-04-21		 a year crt.sh
now.bestflowingstuff.co
R3		 2021-01-12 -
2021-04-12		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-01 -
2021-08-01		 a year crt.sh
cstwpush.com
R3		 2021-01-22 -
2021-04-22		 3 months crt.sh
ciksolre.net
R3		 2020-12-13 -
2021-03-13		 3 months crt.sh
na.nawpush.com
R3		 2020-12-23 -
2021-03-23		 3 months crt.sh
sw.wpush.org
R3		 2021-01-22 -
2021-04-22		 3 months crt.sh
sw.swwpush.com
R3		 2020-12-22 -
2021-03-22		 3 months crt.sh
sw.wpu.sh
R3		 2021-01-29 -
2021-04-29		 3 months crt.sh
notification.tubecup.net
R3		 2020-12-21 -
2021-03-21		 3 months crt.sh
vasgenerete.site
R3		 2020-12-31 -
2021-03-31		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Frame ID: F6E16347B28DAA63D5FFD215F55B95E9
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://scan.security-suite.com/b/0006-mafe/?bb=1&lpkey=1662131758d005e959&trk=trkssl.com&tg=549e5320xoa4a0a... Page URL
  2. https://trkssl.com/nlp/index.php?a=57311&c=211636&url_bnm_redirect=https://cd-down.com Page URL
  3. https://cd-down.com/?a=57311&c=211636 Page URL
  4. https://cd-down.com/?a=57311&c=110642&oc=27570&sr=t&so=77072&sc=10839625&rc=3_77072&ref=https%3A... HTTP 302
    https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream... Page URL
  5. https://now.bestflowingstuff.co/?utm_term=6930429253989171512&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
  6. https://now.bestflowingstuff.co/proc.php?7661ea9da7b6bf1e6e187a6bc1e72ac4c8111d3f HTTP 302
    http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6930429253989171512&sub2=951&sub3... HTTP 302
    https://adtrackingflow.com/click.php?key=6y43fijdm5dsc1q8ocm6&cid=602dd4b1edf1c80001a9d9c2&sid=4 HTTP 302
    https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

23
Requests

100 %
HTTPS

31 %
IPv6

16
Domains

17
Subdomains

10
IPs

5
Countries

246 kB
Transfer

551 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://scan.security-suite.com/b/0006-mafe/?bb=1&lpkey=1662131758d005e959&trk=trkssl.com&tg=549e5320xoa4a0a9c8e&uclick=xoa4a0a9&uclickhash=xoa4a0a9-xoa4a0a9-1n3y-2tib-ojus-gx5m8n-17qqi4-235d96 Page URL
  2. https://trkssl.com/nlp/index.php?a=57311&c=211636&url_bnm_redirect=https://cd-down.com Page URL
  3. https://cd-down.com/?a=57311&c=211636 Page URL
  4. https://cd-down.com/?a=57311&c=110642&oc=27570&sr=t&so=77072&sc=10839625&rc=3_77072&ref=https%3A%2F%2Ftrkssl.com%2Fnlp%2Findex.php%3Fa%3D57311%26c%3D211636%26url_bnm_redirect%3Dhttps%3A%2F%2Fcd-down.com&vt=1613616304200&h=ca6258886b5016b60c23a7f46e1358231ae70728&req=https%3A%2F%2Fcd-down.com%2F%3Fa%3D57311%26c%3D211636&mt=7&sip=2a01:4f8:192:5414::2&us=58e49f89a80a4241b78a4720fa191300 HTTP 302
    https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862 Page URL
  5. https://now.bestflowingstuff.co/?utm_term=6930429253989171512&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f Page URL
  6. https://now.bestflowingstuff.co/proc.php?7661ea9da7b6bf1e6e187a6bc1e72ac4c8111d3f HTTP 302
    http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6930429253989171512&sub2=951&sub3=951-dd98dc7e HTTP 302
    https://adtrackingflow.com/click.php?key=6y43fijdm5dsc1q8ocm6&cid=602dd4b1edf1c80001a9d9c2&sid=4 HTTP 302
    https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://cd-down.com/?a=57311&c=110642&oc=27570&sr=t&so=77072&sc=10839625&rc=3_77072&ref=https%3A%2F%2Ftrkssl.com%2Fnlp%2Findex.php%3Fa%3D57311%26c%3D211636%26url_bnm_redirect%3Dhttps%3A%2F%2Fcd-down.com&vt=1613616304200&h=ca6258886b5016b60c23a7f46e1358231ae70728&req=https%3A%2F%2Fcd-down.com%2F%3Fa%3D57311%26c%3D211636&mt=7&sip=2a01:4f8:192:5414::2&us=58e49f89a80a4241b78a4720fa191300 HTTP 302
  • https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
Request Chain 13
  • https://cst.wpu.sh/static/adManager.js HTTP 301
  • https://cst.cstwpush.com/static/adManager.js

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
scan.security-suite.com/b/0006-mafe/ 		130 B
345 B 		Document
General
Check archive.org
Download Go to
Full URL
https://scan.security-suite.com/b/0006-mafe/?bb=1&lpkey=1662131758d005e959&trk=trkssl.com&tg=549e5320xoa4a0a9c8e&uclick=xoa4a0a9&uclickhash=xoa4a0a9-xoa4a0a9-1n3y-2tib-ojus-gx5m8n-17qqi4-235d96
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
167.172.33.55 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
d6b6998c07ea0eb1f8991335d4bdc89fcc146457b7142c5663968b37b2478f31

Request headers

Host
scan.security-suite.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx/1.14.0 (Ubuntu)
Date
Thu, 18 Feb 2021 02:45:03 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Content-Encoding
gzip
index.php
trkssl.com/nlp/ 		81 B
222 B 		Document
General
Check archive.org
Download Go to
Full URL
https://trkssl.com/nlp/index.php?a=57311&c=211636&url_bnm_redirect=https://cd-down.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
116.202.184.246 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.246.184.202.116.clients.your-server.de
Software
nginx/1.18.0 /
Resource Hash
560b61f3c439ca7cb8c0c2f5ddd5be4bbd94dee97bbd71e59d5a5c0a6c0fb65e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
trkssl.com
:scheme
https
:path
/nlp/index.php?a=57311&c=211636&url_bnm_redirect=https://cd-down.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://scan.security-suite.com/b/0006-mafe/?bb=1&lpkey=1662131758d005e959&trk=trkssl.com&tg=549e5320xoa4a0a9c8e&uclick=xoa4a0a9&uclickhash=xoa4a0a9-xoa4a0a9-1n3y-2tib-ojus-gx5m8n-17qqi4-235d96
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://scan.security-suite.com/b/0006-mafe/?bb=1&lpkey=1662131758d005e959&trk=trkssl.com&tg=549e5320xoa4a0a9c8e&uclick=xoa4a0a9&uclickhash=xoa4a0a9-xoa4a0a9-1n3y-2tib-ojus-gx5m8n-17qqi4-235d96

Response headers

server
nginx/1.18.0
date
Thu, 18 Feb 2021 02:45:04 GMT
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=31536000
content-encoding
gzip
/
cd-down.com/ 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cd-down.com/?a=57311&c=211636
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:483:6120:438a:c949:194a:dbd2 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b18ee8ff603981891d29f1d7636cb3d868826cb985a46c9dbb5e5df8a47a0576

Request headers

:method
GET
:authority
cd-down.com
:scheme
https
:path
/?a=57311&c=211636
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://trkssl.com/nlp/index.php?a=57311&c=211636&url_bnm_redirect=https://cd-down.com
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://trkssl.com/nlp/index.php?a=57311&c=211636&url_bnm_redirect=https://cd-down.com

Response headers

date
Thu, 18 Feb 2021 02:45:04 GMT
content-type
text/html;charset=utf-8
server
nginx
vary
Accept-Encoding
cache-control
no-cache, must-revalidate
pragma
no-cache
expires
Sat, 1 May 2020 12:00:00 GMT
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
content-encoding
gzip
user
gdmconvtrck.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gdmconvtrck.com/user?a=57311&c=110642
Requested by
Host: cd-down.com
URL: https://cd-down.com/?a=57311&c=211636
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:483:6120:813f:12dd:7e10:98e6 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://cd-down.com/?a=57311&c=211636
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Feb 2021 02:45:04 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*, *
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
expires
Sat, 1 May 2020 12:00:00 GMT
/
now.bestflowingstuff.co/
Redirect Chain
  • https://cd-down.com/?a=57311&c=110642&oc=27570&sr=t&so=77072&sc=10839625&rc=3_77072&ref=https%3A%2F%2Ftrkssl.com%2Fnlp%2Findex.php%3Fa%3D57311%26c%3D211636%26url_bnm_redirect%3Dhttps%3A%2F%2Fcd-dow...
  • https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
Requested by
Host: gdmconvtrck.com
URL: https://gdmconvtrck.com/user?a=57311&c=110642
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.163.203.126 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/7.4.10
Resource Hash
3210338a9286cfa2898ca2df2bc0f4d4b3298bf2f66661acab14e078dbf97c81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

:method
GET
:authority
now.bestflowingstuff.co
:scheme
https
:path
/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://cd-down.com/?a=57311&c=211636
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://cd-down.com/?a=57311&c=211636

Response headers

server
nginx
date
Thu, 18 Feb 2021 02:45:04 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-powered-by
PHP/7.4.10
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
set-cookie
u=23d289321cea3581c1bc809d3fd1e92b; expires=Fri, 18-Feb-2022 02:45:04 GMT; Max-Age=31536000; path=/
strict-transport-security
max-age=31536000; includeSubdomains;
content-encoding
gzip

Redirect headers

date
Thu, 18 Feb 2021 02:45:04 GMT
content-type
text/html;charset=ISO-8859-1
location
https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
server
nginx
set-cookie
gdm_click_adv_freq_v1_1_001=9aM1XGpWxsbm63MOQbJksBfYEaaLZvTD+QPabFzsIBtpNwgFdNI0ryrXAkqfuMzY; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/ gdm_click_adv_freq_v2_1_001=9aM1XGpWxsbm63MOQbJksBfYEaaLZvTD+QPabFzsIBtpNwgFdNI0ryrXAkqfuMzY; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/; Secure; SameSite=None gdm_uid_v1_1_001=5tkMQCWZIYROOCsdafyp8N51DI8BHjzxvmw4ASwO36ZSD93TvRjtg1hoj4nR57NA; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/ gdm_suid_v1_1_001=5tkMQCWZIYROOCsdafyp8N51DI8BHjzxvmw4ASwO36ZSD93TvRjtg1hoj4nR57NA; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/ gdm_sid_v2_3_001=RMCZdzwCXcaPuWmLYc09QsyMUwQqr8ntHuDywIFEGy5fVZFxS08ns6ZuwvNwV5DsF8Di+a93bFrLfx5OqmjEX604SILtxK8/ipBCRwO/xXAzT0dxNJ9Pk2Xol+/LdoJlk+hWSq4g3UUUydK/Ad5DakOpf08itUn+h4zFJSXpyWpquOsyyhpOEHpqgGUwIYmAIx79ZtZUATZxnX7+o1g6B5fSMwF/T+WJCnlSeLOaYG157vew7QtPQLYL00woq+XQGAw3RXuqV3naWJ2BMcUylmExTQjp24pe7IaFS37jAf88aSz1NmBeVlC/2z7Tsf8ZxJK6bZoN9R5Qul8Fv9+ZKe4pdfo/Xy53mhhh3zuZS5lGrtZuZzagQNPOwlGleMFksh7xeo1iYp+FnIIiS1DaulVTTteKAFSuHmyQI2ZqCUME+nawxl71cuS4+djBYqd6DzcjUdxDZDqovw1J2IT/l8GHNDLQIQpFl/K+7qZTluxRhoHLe9jmryA5I8k0uih2LnjJ39RXbB3Hk0xy7EgMt3RTxqox5yXWYF9rJHwXtuDHgo7XHz8obJBuwTdoXpFkrEDS8+Ef9q2IDc2bLMiL7jek4sMWE0AKepqyVxssJmEFwPZoeN9fCOF1P7MdNDGUQjExlp2WWiIysKKVngWTy4xVmYpIlwZ66oP1/2hQiwHEVrmL099Wng36e+h1l4jRkiw3X1tJlCA1/q7ay/TVcHHpUZ/nRnC+RZqe9jEV58c91pY3nA3s4vgj6qBmfYOt9Z+reLoqRuk5zLFDfz+YZUIJxdWOftC2hqXDradU6n7o2jtM28RpaPyq4d2XDfky43EtVz8oq/B1bDZqC/k/qYZqDzItJEyF0jV3x3GxaONGz/ZZYj7HQryZmcogf3ymtVk7auwLmxgFYe00LgBBks4DL0tKshhzU8yp2gUITf7VNJTS2x7U8xzVozkeK82xXVao2A6kNZgJDIVVHBUAUjYSYZVytVcJPtoi5q5KSdjJcx48vjTZUVG8Ygpg3Sy5X7mdkzqGXCvKW8SjIkSMv1PT0IhFYpXw1caQAoszEPb9zLS6HzkU1B6zn8tP17ACfXlXzgDDseCAdwkDXclLSgpxe/Gwy1hlDlo/QNDBcf6byaW1E6TcsAy23BccupE0yY+2Col2w8fJloKXyaJ4AA+8GvZd1pdM90MIgdi2+ug=; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/; Secure; SameSite=None gdm_click_freq_v2_1_001=ZN91LejuLkZ9iB7yXVgpmov8f0U3zJW+h/CSYkKwfkcGy4dachNopy4OACPsEyRE; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/; Secure; SameSite=None gdm_click_freq_v1_1_001=ZN91LejuLkZ9iB7yXVgpmov8f0U3zJW+h/CSYkKwfkcGy4dachNopy4OACPsEyRE; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/ gdm_sid_v1_3_001=RMCZdzwCXcaPuWmLYc09QsyMUwQqr8ntHuDywIFEGy5fVZFxS08ns6ZuwvNwV5DsF8Di+a93bFrLfx5OqmjEX604SILtxK8/ipBCRwO/xXAzT0dxNJ9Pk2Xol+/LdoJlk+hWSq4g3UUUydK/Ad5DakOpf08itUn+h4zFJSXpyWpquOsyyhpOEHpqgGUwIYmAIx79ZtZUATZxnX7+o1g6B5fSMwF/T+WJCnlSeLOaYG157vew7QtPQLYL00woq+XQGAw3RXuqV3naWJ2BMcUylmExTQjp24pe7IaFS37jAf88aSz1NmBeVlC/2z7Tsf8ZxJK6bZoN9R5Qul8Fv9+ZKe4pdfo/Xy53mhhh3zuZS5lGrtZuZzagQNPOwlGleMFksh7xeo1iYp+FnIIiS1DaulVTTteKAFSuHmyQI2ZqCUME+nawxl71cuS4+djBYqd6DzcjUdxDZDqovw1J2IT/l8GHNDLQIQpFl/K+7qZTluxRhoHLe9jmryA5I8k0uih2LnjJ39RXbB3Hk0xy7EgMt3RTxqox5yXWYF9rJHwXtuDHgo7XHz8obJBuwTdoXpFkrEDS8+Ef9q2IDc2bLMiL7jek4sMWE0AKepqyVxssJmEFwPZoeN9fCOF1P7MdNDGUQjExlp2WWiIysKKVngWTy4xVmYpIlwZ66oP1/2hQiwHEVrmL099Wng36e+h1l4jRkiw3X1tJlCA1/q7ay/TVcHHpUZ/nRnC+RZqe9jEV58c91pY3nA3s4vgj6qBmfYOt9Z+reLoqRuk5zLFDfz+YZUIJxdWOftC2hqXDradU6n7o2jtM28RpaPyq4d2XDfky43EtVz8oq/B1bDZqC/k/qYZqDzItJEyF0jV3x3GxaONGz/ZZYj7HQryZmcogf3ymtVk7auwLmxgFYe00LgBBks4DL0tKshhzU8yp2gUITf7VNJTS2x7U8xzVozkeK82xXVao2A6kNZgJDIVVHBUAUjYSYZVytVcJPtoi5q5KSdjJcx48vjTZUVG8Ygpg3Sy5X7mdkzqGXCvKW8SjIkSMv1PT0IhFYpXw1caQAoszEPb9zLS6HzkU1B6zn8tP17ACfXlXzgDDseCAdwkDXclLSgpxe/Gwy1hlDlo/QNDBcf6byaW1E6TcsAy23BccupE0yY+2Col2w8fJloKXyaJ4AA+8GvZd1pdM90MIgdi2+ug=; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/ gdm_suid_v2_1_001=5tkMQCWZIYROOCsdafyp8N51DI8BHjzxvmw4ASwO36ZSD93TvRjtg1hoj4nR57NA; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/; Secure; SameSite=None gdm_uid_v2_1_001=5tkMQCWZIYROOCsdafyp8N51DI8BHjzxvmw4ASwO36ZSD93TvRjtg1hoj4nR57NA; Expires=Wed, 19-May-2021 02:45:04 GMT; Path=/; Secure; SameSite=None
content-language
en-US
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
/
now.bestflowingstuff.co/ 		9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://now.bestflowingstuff.co/?utm_term=6930429253989171512&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
Requested by
Host: now.bestflowingstuff.co
URL: https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.163.203.126 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/7.4.10
Resource Hash
55a3620b3e1dd7f28109603bd36dfb12dddd14df599489404cb0d2cf2d295eba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

:method
GET
:authority
now.bestflowingstuff.co
:scheme
https
:path
/?utm_term=6930429253989171512&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
u=23d289321cea3581c1bc809d3fd1e92b
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://now.bestflowingstuff.co/?utm_medium=5cdf3f2e9bdd0f598699b1eebac2dca497745ad9&utm_campaign=mainstream&1=57311&cid=b0888de09b2d41dbb8369ee3dc5a90c05862

Response headers

server
nginx
date
Thu, 18 Feb 2021 02:45:04 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
x-powered-by
PHP/7.4.10
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security
max-age=31536000; includeSubdomains;
content-encoding
gzip
Primary Request /
y0utube.live/arm1/
Redirect Chain
  • https://now.bestflowingstuff.co/proc.php?7661ea9da7b6bf1e6e187a6bc1e72ac4c8111d3f
  • http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6930429253989171512&sub2=951&sub3=951-dd98dc7e
  • https://adtrackingflow.com/click.php?key=6y43fijdm5dsc1q8ocm6&cid=602dd4b1edf1c80001a9d9c2&sid=4
  • https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
28 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Requested by
Host: now.bestflowingstuff.co
URL: https://now.bestflowingstuff.co/?utm_term=6930429253989171512&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5529b6337d0f1edbfc8777209bd3f3f0f4907983a871bdcadcc80c07ad9cd21a

Request headers

:method
GET
:authority
y0utube.live
:scheme
https
:path
/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://now.bestflowingstuff.co/?utm_term=6930429253989171512&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f#

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
content-type
text/html
set-cookie
__cfduid=d42b9dd7c01d3beba2afcb39b5b7f0dba1613616305; expires=Sat, 20-Mar-21 02:45:05 GMT; path=/; domain=.y0utube.live; HttpOnly; SameSite=Lax
vary
Accept-Encoding
last-modified
Mon, 16 Nov 2020 08:19:04 GMT
cf-cache-status
DYNAMIC
cf-request-id
08549fed5c00000c71eb8b2000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pzJusikfQrIojw%2Fi%2FnQzePv2m8xOXSTAghw%2BHv5D8nu9etwMyQHMMYGbiiJ%2FlmaSXaxH%2BSOQkZkOFBiOJkJBnrSmg8VhuJydYUM4i4nP72VTxY9qG1f8XRc%3D"}],"group":"cf-nel","max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
cf-ray
623468f55a030c71-AMS
content-encoding
br

Redirect headers

date
Thu, 18 Feb 2021 02:45:05 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d92eac7eac500337a916ac8f67e84f6531613616305; expires=Sat, 20-Mar-21 02:45:05 GMT; path=/; domain=.adtrackingflow.com; HttpOnly; SameSite=Lax uclick=8rftus7s9z; expires=Fri, 19-Feb-2021 02:45:05 GMT; Max-Age=86400; path=/; SameSite=None; Secure; uclickhash=8rftus7s9z-8rftus7s9z-fnoc-fnsl-e246-he5m3y-he5m6o-ad1629; expires=Fri, 19-Feb-2021 02:45:05 GMT; Max-Age=86400; path=/; SameSite=None; Secure; __cf_bm=ab59ea361bbfd7fd993ea97f56dba73a7cc4f9f3-1613616305-1800-Aa1qFOEt64NAb7Ld2gEd3Scw/EJEaW45kxeB3PdAcBvBptNv8N+swSQQJj4GmK4rrPqMI9piLAsqacAToUZujoI=; path=/; expires=Thu, 18-Feb-21 03:15:05 GMT; domain=.adtrackingflow.com; HttpOnly; Secure; SameSite=None
location
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
cf-cache-status
DYNAMIC
cf-request-id
08549feca600004c7460348000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Cq%2Bc15uV%2BcAPjvtXeXmNLm7VCaFXZHjUPTZP%2FXGqET5FHGeLq0B6gEuMV9r%2FhD%2BNDDGkDZD1r9ODoY9c6Z2UEphd7Od1mWxvif5oUcRqld0UmawMq2SKrEooIRHOO7Q%3D"}],"group":"cf-nel","max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
cf-ray
623468f438fc4c74-AMS
icon1.png
y0utube.live/arm1/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon1.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0515ddd9185d263874e7b66bb6d521fcd63b857aac5fed51c08df98026dafe27

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
43
content-length
7252
cf-request-id
08549feed700000c71263aa000000001
last-modified
Sun, 22 Nov 2020 10:50:15 GMT
server
cloudflare
etag
"1c54-5b4afd7c55b78"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EHXj%2F9%2BnuDP43mbTN%2Byny4OOqvp09CaJ2d5y%2FKbsZBRvmDJv4FBTbZ9kS4NSeM%2BRt1xthghe6A8sAaCwX9UxZxnslrBWBZKr4hJq7WOEDNJ341GcRPfzdIo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd850c71-AMS
icon2.png
y0utube.live/arm1/img/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon2.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aab564e67c47df65ddcb9c4eaa62cd798a51624a3fded9f9b3a1197b460a79c2

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6287
content-length
4576
cf-request-id
08549feed700000c7105880000000001
last-modified
Sun, 22 Nov 2020 10:50:15 GMT
server
cloudflare
etag
"11e0-5b4afd7c55b78"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qwVovns%2BlygC8lyX5fwDv5%2BXm3E5MOuF3sfHS4Rcs6cvZyjK42gfgVKCvNnH36JZlBdXaiFREY5MexCw4L5l0ECZaxWXa3UqAruYE%2FSO8HELsIq5QbUn0ts%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd880c71-AMS
icon3.png
y0utube.live/arm1/img/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon3.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea3698c32039a115b03c2528cbb29c3ff97bbd49ad1345d5095e98d1fd0ea8ba

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
43
content-length
7847
cf-request-id
08549feed800000c7168910000000001
last-modified
Sun, 22 Nov 2020 10:50:16 GMT
server
cloudflare
etag
"1ea7-5b4afd7c7ad33"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WZfO%2B%2FJLQcnyWPxhhgvXjswrcFx4Uf7Sb6kRBJoO0nXR%2Bb1OwXAj7DDiB%2Bwvl%2Fh5a8cMA9wDnbiuPBEjFY3%2F64xlbr5KyiHbzAFwGy8SHSplZBIn8f05D%2Bw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd890c71-AMS
icon4.png
y0utube.live/arm1/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon4.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0af6cb2280bba97d235dfad7c72d22353a0d2cf277733ce9fc4701df7ed1d5f

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
43
content-length
7032
cf-request-id
08549feed800000c71f7a37000000001
last-modified
Sun, 22 Nov 2020 10:50:16 GMT
server
cloudflare
etag
"1b78-5b4afd7c7bcd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cdL9zotabXLYySSa3eCIZec%2FaKCNoW9fO5wJglm39kP7ntstqZwIort0xtzAta3LFSS0Nillu1r2XRZdxWs9ydF5FLBsZ%2B44dL7IrJsw%2BS1eWPGab%2FchE7U%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd8a0c71-AMS
icon5.png
y0utube.live/arm1/img/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon5.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
196083352a09a19cf2d4364e3ad406606fedb562f2096c1bef373ff2c485b503

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6069
content-length
3264
cf-request-id
08549feed900000c71aa109000000001
last-modified
Sun, 22 Nov 2020 10:50:16 GMT
server
cloudflare
etag
"cc0-5b4afd7ca0e8e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=guYxccnxbj3N%2B4690GzfqDfiVGvOkKG1fiaNMs6eBdf8WunCCPAX1yj7UQhKAyhQGxfSQmWeed7S6aMTGD5AVOfRQXpkN7EipDE5vB%2BKxevdXerqchKEZJE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd8c0c71-AMS
icon7.png
y0utube.live/arm1/img/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon7.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9c661cc8adbaa1b9cd4cf65f0ba93a1c24211cb5f94ed0950e0fbc973781718

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6069
content-length
3283
cf-request-id
08549feed900000c71609da000000001
last-modified
Sun, 22 Nov 2020 10:50:16 GMT
server
cloudflare
etag
"cd3-5b4afd7ca1e2e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UMplMwGhq6VfrvZ%2B1kcwYW2F4fBQ%2BEXJ%2BG3Fq%2BTMvT7eMxkCp4zXvZK2ZhnqZhSys1OwzFElJGFn6FuD4GBKH%2BkKzJDTnK%2FbQBBySZvuY%2BIxaAaakjO%2BNL4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd8e0c71-AMS
icon8.png
y0utube.live/arm1/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://y0utube.live/arm1/img/icon8.png
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:6027 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a7abff293d71fd8c5a58deacb964b50fe074a6f458575d37abbd367a3a930a1

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:05 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6287
content-length
4064
cf-request-id
08549feed900000c71811f5000000001
last-modified
Sun, 22 Nov 2020 10:50:16 GMT
server
cloudflare
etag
"fe0-5b4afd7cc6fe9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=f3Iy0J7TVBRZTHElU8y1J22nWmHsNYwecB8pkzsm%2FG%2FdPRfQTswY3IBhVsRriXzmGKyYcJL0SsHSRJpfD%2B9aaIW2ulg7Wm5TTty0PyKot9gjzr7KX9y9XUw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
623468f7bd8f0c71-AMS
adManager.js
cst.cstwpush.com/static/
Redirect Chain
  • https://cst.wpu.sh/static/adManager.js
  • https://cst.cstwpush.com/static/adManager.js
39 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cst.cstwpush.com/static/adManager.js
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
1759c7be725e88d3b517a94fa444f083fc24cc92e961c1f2d3ce4c8af1787fbf
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 18 Feb 2021 02:45:06 GMT
Connection
Keep-Alive
Last-Modified
Fri, 05 Feb 2021 10:57:06 GMT
x-amz-meta-s3cmd-attrs
atime:1612522612/ctime:1612522612/gid:0/gname:root/md5:0a25a7f5a397ade1149c4bf41f8ab35d/mode:33188/mtime:1612522398/uid:0/uname:root
x-amz-request-id
tx000000000000016fa470c-00602dcab8-a4c9942-fra1a
ETag
"0a25a7f5a397ade1149c4bf41f8ab35d"
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1613616306.dop218.sk1.t,1613616306.cds003.sk1.shn,1613616306.dop218.sk1.t,1613616306.cds225.sk1.c
Content-Type
text/plain
X-Amz-Storage-Class
STANDARD
Cache-Control
max-age=1046
x-rgw-object-type
Normal
Strict-Transport-Security
max-age=15552000; includeSubDomains; preload
Accept-Ranges
bytes
Content-Length
39828

Redirect headers

location
https://cst.cstwpush.com/static/adManager.js
date
Thu, 18 Feb 2021 02:45:05 GMT
server
nginx/1.18.0
content-length
169
content-type
text/html
micro.tag.min.js
ciksolre.net/pfe/current/ 		76 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ciksolre.net/pfe/current/micro.tag.min.js?z=3176204&ymid=f12198rftus7s9z098&var=1890
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.196.195 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
8a0449a1b23f4c77427d90d4662fa79351bbbec5cbf97c6e922f99528f427fa4

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 18 Feb 2021 02:44:57 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Feb 2021 13:34:05 GMT
Server
nginx
ETag
W/"602bc9cd-130c3"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
408
na.nawpush.com/tags/ 		275 B
427 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://na.nawpush.com/tags/408
Requested by
Host: cst.wpu.sh
URL: https://cst.wpu.sh/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
0abaef383501a977b2ae834197f0ce45ef6ffbf342ecaadbe2cc018aa5b18e7d

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 18 Feb 2021 02:45:06 GMT
cache-control
max-age=300, public
server
nginx/1.18.0
content-type
application/json
x-proxy-cache
EXPIRED
main.js
sw.wpush.org/script/ 		76 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sw.wpush.org/script/main.js?promo=24247&tcid=4991&src=479876918
Requested by
Host: y0utube.live
URL: https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
e616d7845c979aea81925ab5abce47640f385fc189ac57d29357a818e289c422

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:06 GMT
content-encoding
gzip
server
nginx/1.16.1
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Thu, 18 Feb 2021 03:45:06 GMT
cache-control
max-age=3600
x-proxy-cache
EXPIRED
npush.js
sw.swwpush.com/npc/sdk/wpu/ 		137 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sw.swwpush.com/npc/sdk/wpu/npush.js
Requested by
Host: cst.wpu.sh
URL: https://cst.wpu.sh/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 / PHP/7.1.28
Resource Hash
a4260dc6e4eb6dda49ccdb40b3a9807b5f558acb69643b7840ac23b7bfe9c963

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:06 GMT
content-encoding
gzip
server
nginx/1.16.1
x-powered-by
PHP/7.1.28
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Thu, 18 Feb 2021 03:45:06 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
natpsdk.js
sw.wpu.sh/ps/ 		138 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sw.wpu.sh/ps/natpsdk.js
Requested by
Host: sw.wpush.org
URL: https://sw.wpush.org/script/main.js?promo=24247&tcid=4991&src=479876918
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
339602aa2d8d42be3fa31a0b611e843ad501d351781698b6a75b588aa2f5c366

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:06 GMT
content-encoding
gzip
server
nginx/1.16.1
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Thu, 18 Feb 2021 03:45:06 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
multy
ntvpwpush.com/in/ 		0
102 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ntvpwpush.com/in/multy?sid=3440046863&spot_id=157&subid=0&created_at=2021-02-18&site=native-push&timezone_offset=1&wl=0&is_native=1&ver=2.14.5
Requested by
Host: sw.swwpush.com
URL: https://sw.swwpush.com/npc/sdk/wpu/npush.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
168.119.25.22 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.22.25.119.168.clients.your-server.de
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 18 Feb 2021 02:45:07 GMT
cache-control
no-transform
server
nginx/1.18.0
vary
Origin
cis.js
vasgenerete.site/npc/sdk/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vasgenerete.site/npc/sdk/cis.js
Requested by
Host: sw.wpu.sh
URL: https://sw.wpu.sh/ps/natpsdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
537ab909e8f26426c823f991694d721d1b191cb1261ac408296d87c1d08ed058

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:06 GMT
content-encoding
gzip
last-modified
Thu, 24 Dec 2020 13:03:33 GMT
server
nginx/1.16.1
etag
W/"5fe491a5-1652"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Thu, 18 Feb 2021 03:45:06 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
4991.php
vasgenerete.site/npc/anpc/ 		4 B
211 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://vasgenerete.site/npc/anpc/4991.php
Requested by
Host: sw.wpu.sh
URL: https://sw.wpu.sh/ps/natpsdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 / PHP/7.1.28
Resource Hash
d7793d4cf596bc12fd217b5ab3e8a9e7d0266c65c7a1154bd22cebf405ffb582

Request headers

Referer
https://y0utube.live/arm1/?clickid=f12198rftus7s9z098&trafficsource=1890
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 02:45:06 GMT
server
nginx/1.16.1
x-powered-by
PHP/7.1.28
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
expires
Thu, 18 Feb 2021 03:45:06 GMT
cache-control
max-age=3600
content-length
4
x-proxy-cache
EXPIRED

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| pci string| ppi object| ntfcSDK function| setImmediate function| clearImmediate object| button object| edPushSDK object| regeneratorRuntime function| tcpusher object| __core-js_shared__ object| core function| __fp-init

1 Cookies

Domain/Path Name / Value
.y0utube.live/ Name: __cfduid
Value: d42b9dd7c01d3beba2afcb39b5b7f0dba1613616305

3 Console Messages

Source Level URL
Text
console-api info URL: https://cst.wpu.sh/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan version 1.3.0
console-api info URL: https://cst.wpu.sh/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan run tag spots
console-api info URL: https://cst.wpu.sh/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan init spot [object Object]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adtrackingflow.com
cd-down.com
ciksolre.net
cst.cstwpush.com
cst.wpu.sh
gdmconvtrck.com
na.nawpush.com
now.bestflowingstuff.co
ntvpwpush.com
scan.security-suite.com
sw.swwpush.com
sw.wpu.sh
sw.wpush.org
tracking.armorads.com
trkssl.com
vasgenerete.site
y0utube.live
108.163.203.126
116.202.184.246
139.45.196.195
167.172.33.55
168.119.25.22
172.64.199.26
205.185.216.10
213.174.135.2
2606:4700:3030::6815:6027
2606:4700:3037::6815:56a2
2a05:d018:483:6120:438a:c949:194a:dbd2
2a05:d018:483:6120:813f:12dd:7e10:98e6
46.4.91.20
0515ddd9185d263874e7b66bb6d521fcd63b857aac5fed51c08df98026dafe27
0abaef383501a977b2ae834197f0ce45ef6ffbf342ecaadbe2cc018aa5b18e7d
1759c7be725e88d3b517a94fa444f083fc24cc92e961c1f2d3ce4c8af1787fbf
196083352a09a19cf2d4364e3ad406606fedb562f2096c1bef373ff2c485b503
3210338a9286cfa2898ca2df2bc0f4d4b3298bf2f66661acab14e078dbf97c81
339602aa2d8d42be3fa31a0b611e843ad501d351781698b6a75b588aa2f5c366
3a7abff293d71fd8c5a58deacb964b50fe074a6f458575d37abbd367a3a930a1
537ab909e8f26426c823f991694d721d1b191cb1261ac408296d87c1d08ed058
5529b6337d0f1edbfc8777209bd3f3f0f4907983a871bdcadcc80c07ad9cd21a
55a3620b3e1dd7f28109603bd36dfb12dddd14df599489404cb0d2cf2d295eba
560b61f3c439ca7cb8c0c2f5ddd5be4bbd94dee97bbd71e59d5a5c0a6c0fb65e
8a0449a1b23f4c77427d90d4662fa79351bbbec5cbf97c6e922f99528f427fa4
a4260dc6e4eb6dda49ccdb40b3a9807b5f558acb69643b7840ac23b7bfe9c963
aab564e67c47df65ddcb9c4eaa62cd798a51624a3fded9f9b3a1197b460a79c2
b18ee8ff603981891d29f1d7636cb3d868826cb985a46c9dbb5e5df8a47a0576
c0af6cb2280bba97d235dfad7c72d22353a0d2cf277733ce9fc4701df7ed1d5f
d6b6998c07ea0eb1f8991335d4bdc89fcc146457b7142c5663968b37b2478f31
d7793d4cf596bc12fd217b5ab3e8a9e7d0266c65c7a1154bd22cebf405ffb582
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e616d7845c979aea81925ab5abce47640f385fc189ac57d29357a818e289c422
e9c661cc8adbaa1b9cd4cf65f0ba93a1c24211cb5f94ed0950e0fbc973781718
ea3698c32039a115b03c2528cbb29c3ff97bbd49ad1345d5095e98d1fd0ea8ba