urlscan.io logo urlscan.io
SecurityTrails logo

btah.xyz Open in urlscan Pro
72.11.140.229  Public Scan

Go To Rescan Add Verdict Report
URL: http://btah.xyz/
Submission: On August 14 via api from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 33 HTTP transactions. The main IP is 72.11.140.229, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US. The main domain is btah.xyz.
This is the only time btah.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 72.11.140.229 8100 (ASN-QUADR...)
15 23.224.158.178 40065 (CNSERVERS)
8 9 103.135.20.70 10103 (HKBN-AS-A...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
1 163.171.128.16 54994 (QUANTILNE...)
1 183.131.207.66 136190 (CHINATELE...)
2 202.5.19.18 7489 (HOSTUS-GL...)
33 7
5    72.11.140.229 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US)
PTR: 72.11.140.229.static.quadranet.com
btah.xyz
15    23.224.158.178 (Los Angeles, United States)

ASN40065 (CNSERVERS - CNSERVERS LLC, US)
PTR: josephine.aakkj.com
lajiaopic.com
9    103.135.20.70 (Taiwan)

ASN10103 (HKBN-AS-AP HK Broadband Network Ltd., HK)
zhibo.16g5.com
api.16g5.com
8    2606:4700::6810:3037 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
roomimg.stream.highwebmedia.com
1    163.171.128.16 (Germany)

ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US)
js.users.51.la
1    183.131.207.66 (China)

ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN)
ia.51.la
2    202.5.19.18 (Los Angeles, United States)

ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK)
a.5288av.xyz
Domain Requested by
15 lajiaopic.com btah.xyz
8 roomimg.stream.highwebmedia.com btah.xyz
8 zhibo.16g5.com 8 redirects
5 btah.xyz btah.xyz
2 a.5288av.xyz btah.xyz
1 ia.51.la btah.xyz
1 js.users.51.la api.16g5.com
1 api.16g5.com btah.xyz
33 8

This site contains links to these domains. Also see Links.

Domain
www.1234vu.com
Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh
*.lajiaopic.com
AlphaSSL CA - SHA256 - G2		 2019-04-29 -
2020-04-29		 a year crt.sh
*.stream.highwebmedia.com
DigiCert ECC Secure Server CA		 2016-08-24 -
2019-10-28		 3 years crt.sh

This page contains 1 frames:

Primary Page: http://btah.xyz/
Frame ID: 2125B80F765A5B7130E07A426EB1776F
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

33
Requests

70 %
HTTPS

14 %
IPv6

6
Domains

8
Subdomains

7
IPs

4
Countries

1610 kB
Transfer

1873 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=eevee_bee HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/eevee_bee.jpg?1565806218
Request Chain 19
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=ashlyeroberts HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/ashlyeroberts.jpg?1565806218
Request Chain 20
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=yummmylicious HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/yummmylicious.jpg?1565806218
Request Chain 21
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=psychedelicariaa HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/psychedelicariaa.jpg?1565806218
Request Chain 22
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=sweet_katarina_x HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/sweet_katarina_x.jpg?1565806218
Request Chain 23
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=milkykandy HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/milkykandy.jpg?1565806218
Request Chain 24
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=isabeyferrec HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/isabeyferrec.jpg?1565806218
Request Chain 25
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=sex_bean HTTP 302
  • https://roomimg.stream.highwebmedia.com/ri/sex_bean.jpg?1565806218

33 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
btah.xyz/ 		51 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://btah.xyz/
Protocol
HTTP/1.1
Server
72.11.140.229 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US),
Reverse DNS
72.11.140.229.static.quadranet.com
Software
nginx /
Resource Hash
fc6f2c44727696d08c04a5dd85f13be60bff25d995e749626fafdbd3309bd79d

Request headers

Host
btah.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Wed, 14 Aug 2019 18:10:17 GMT
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Content-Encoding
gzip
style.css
btah.xyz/template/002juzi/css/ 		153 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://btah.xyz/template/002juzi/css/style.css
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
72.11.140.229 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US),
Reverse DNS
72.11.140.229.static.quadranet.com
Software
nginx /
Resource Hash
c25e5ea29a70831117e3cb207dc6d62410b108bd3d6f6f11f9f21bc23dd0d872

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 01 Apr 2019 03:37:52 GMT
Server
nginx
ETag
W/"5ca18790-2653a"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=43200
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 15 Aug 2019 06:10:18 GMT
home.js
btah.xyz/template/002juzi/js/ 		102 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://btah.xyz/template/002juzi/js/home.js
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
72.11.140.229 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US),
Reverse DNS
72.11.140.229.static.quadranet.com
Software
nginx /
Resource Hash
7fb5d39d1ffc2163615263fccecc662964fa86288690ae093ef3b7dd00328f41

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:18 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Mar 2019 03:26:02 GMT
Server
nginx
ETag
W/"5c91b2ca-199a4"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 15 Aug 2019 06:10:18 GMT
logo.png
btah.xyz/template/lajiaoCMSPC/images/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://btah.xyz/template/lajiaoCMSPC/images/logo.png
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
72.11.140.229 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US),
Reverse DNS
72.11.140.229.static.quadranet.com
Software
nginx /
Resource Hash
0ba4b4d14697445e510b5fc19426e54a78d819680db6219ee4d5f6a35a082b47

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:18 GMT
Last-Modified
Sun, 11 Aug 2019 09:55:01 GMT
Server
nginx
ETag
"5d4fe5f5-803a"
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
32826
Expires
Fri, 13 Sep 2019 18:10:18 GMT
0e4c853b183ee83fea12859d12dd619e.jpg
lajiaopic.com/upload/vod/20190517-1/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190517-1/0e4c853b183ee83fea12859d12dd619e.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
cbce95d7d6eb1403aab2a37e411275acf172dc13314a9e88ed54a9a6e4f23d8b

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d21afb2-7be4"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
31716
expires
Thu, 13 Aug 2020 18:10:18 GMT
dd887b9f7549a2673351414c48dff925.jpg
lajiaopic.com/upload/vod/20190522-1/ 		117 KB
117 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190522-1/dd887b9f7549a2673351414c48dff925.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
a60cad61f2aa4bb93481d5cfe7c26e5935836fd68ab9c40236b12fe7222da356

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d21b030-1d427"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
119847
expires
Thu, 13 Aug 2020 18:10:18 GMT
0e5067981a58b21b3318f50d334ffb1c.jpg
lajiaopic.com/upload/vod/20190602-1/ 		99 KB
99 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190602-1/0e5067981a58b21b3318f50d334ffb1c.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
88e9731d80ce9b32b6f3b615882ac982208bd890ebf85dce0da516e63d128419

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d21b10e-18cce"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
101582
expires
Thu, 13 Aug 2020 18:10:18 GMT
9fb873489d975fb507b64769f6589dc9.jpg
lajiaopic.com/upload/vod/20190517-1/ 		33 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190517-1/9fb873489d975fb507b64769f6589dc9.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
e3ab502e5acafd2cb8d1adcd735dc13e86500c7a2dd182ad776fe7dc2b457772

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d21afb8-85c6"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
34246
expires
Thu, 13 Aug 2020 18:10:18 GMT
5064b52d846ed21b63f0819868cdefee.jpg
lajiaopic.com/upload/vod/20190722-1/ 		99 KB
99 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190722-1/5064b52d846ed21b63f0819868cdefee.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
d1040c0ba1dabb2145b13343a1aa30205f2faf428d8b3ddd382c283924aef789

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d351e48-18cc7"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
101575
expires
Thu, 13 Aug 2020 18:10:18 GMT
100dfb9df841b46a916af66c208fa9ea.jpg
lajiaopic.com/upload/vod/20190723-1/ 		142 KB
143 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190723-1/100dfb9df841b46a916af66c208fa9ea.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
608a8ce0f433494140f3b505ad8997c6321e8e9c0a119b16832b7540591b9508

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d368747-2392c"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
145708
expires
Thu, 13 Aug 2020 18:10:18 GMT
39f58c6b9c572d355f0c3844b0052b5b.jpg
lajiaopic.com/upload/vod/20190723-1/ 		118 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190723-1/39f58c6b9c572d355f0c3844b0052b5b.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
8ba45158c400ffd12f76d0417618da87fec2c8fa736dc097ca54225c7fb98e86

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d36875d-1d63e"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
120382
expires
Thu, 13 Aug 2020 18:10:18 GMT
8b4c425714ec549e4ebe200522d6c411.jpg
lajiaopic.com/upload/vod/20190517-1/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190517-1/8b4c425714ec549e4ebe200522d6c411.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
ae7469b110d4b04a6202e0c80505bca56a7dfb3f2c7bf92a6fbde6b048213cbb

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d21afb8-8f56"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
36694
expires
Thu, 13 Aug 2020 18:10:18 GMT
64fb648158b9bdd17cfc3aa84078c8a2.jpg
lajiaopic.com/upload/vod/20190809-1/ 		101 KB
101 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190809-1/64fb648158b9bdd17cfc3aa84078c8a2.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
ba14f2be6aaae08503e6b23a91fabec68694a81c6728965c3a5b8c2e3e787843

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d4d2e6b-193aa"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
103338
expires
Thu, 13 Aug 2020 18:10:18 GMT
24bdc794096a4bc15f1005829d9636d7.jpg
lajiaopic.com/upload/vod/20190730-1/ 		76 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190730-1/24bdc794096a4bc15f1005829d9636d7.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
28753c9da0c94ca9a5cdd6dc47b975f72de1958331c0c52c518a2e7737fc5e68

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d3ff023-12ebe"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
77502
expires
Thu, 13 Aug 2020 18:10:18 GMT
e1ff58dcf45087b293256f3c4e50a269.jpg
lajiaopic.com/upload/vod/20190726-1/ 		77 KB
77 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190726-1/e1ff58dcf45087b293256f3c4e50a269.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
953db3139e21a25057f95ec72881ad51f286231f649b40f3e79e631f513ad4f0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d3a6262-13372"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
78706
expires
Thu, 13 Aug 2020 18:10:18 GMT
070c106116161499948d7be8de2445cf.jpg
lajiaopic.com/upload/vod/20190809-1/ 		126 KB
126 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190809-1/070c106116161499948d7be8de2445cf.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
c35d4b028c9d922c330215886759c97e9ce2a308c17368e584717759bc5e98b0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d4d2e9f-1f755"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
128853
expires
Thu, 13 Aug 2020 18:10:18 GMT
088da780ec9c22f386b8f58f2e408d1b.jpg
lajiaopic.com/upload/vod/20190813-1/ 		118 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190813-1/088da780ec9c22f386b8f58f2e408d1b.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
5470ae6db091e8c2204992b17565277c5af7cf2a134597ded6c6fbfd5053e2aa

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d52729c-1d790"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
120720
expires
Thu, 13 Aug 2020 18:10:18 GMT
f157e1298c29d688d3cea595a880ee83.jpg
lajiaopic.com/upload/vod/20190728-1/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190728-1/f157e1298c29d688d3cea595a880ee83.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
cd8ade8a500e68245055798f0a83ca0ddef0f90f183725a96ac6a0661b6d1fb3

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d3d14a8-19831"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
104497
expires
Thu, 13 Aug 2020 18:10:18 GMT
15c59550b7d2670090c4304810750f1e.jpg
lajiaopic.com/upload/vod/20190726-1/ 		99 KB
99 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lajiaopic.com/upload/vod/20190726-1/15c59550b7d2670090c4304810750f1e.jpg
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.224.158.178 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US),
Reverse DNS
josephine.aakkj.com
Software
cloudfile /
Resource Hash
d300d8c62c92930c52dc8779d34cdcc7723be95734f7e42b3ecd165ee7f13790

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Wed, 14 Aug 2019 18:10:18 GMT
server
cloudfile
etag
"5d3a625f-18afa"
content-type
image/jpeg
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
101114
expires
Thu, 13 Aug 2020 18:10:18 GMT
eevee_bee.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=eevee_bee
  • https://roomimg.stream.highwebmedia.com/ri/eevee_bee.jpg?1565806218
8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/eevee_bee.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
65e37442f3f72455663885e2f76b499b7e00ade947b0a08c29d5868412989309
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
18
cf-polished
origSize=8038
status
200
vary
Accept-Encoding
content-length
7969
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e281ae07c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/eevee_bee.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
ashlyeroberts.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=ashlyeroberts
  • https://roomimg.stream.highwebmedia.com/ri/ashlyeroberts.jpg?1565806218
12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/ashlyeroberts.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2d27b860f3047a04a50d6ae0f26ed8429a47e4900315250c36798b82bca89b6
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
16
cf-polished
status=not_needed
status
200
vary
Accept-Encoding
content-length
12045
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e281ce83c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/ashlyeroberts.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
yummmylicious.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=yummmylicious
  • https://roomimg.stream.highwebmedia.com/ri/yummmylicious.jpg?1565806218
10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/yummmylicious.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ea398cba1f4f047b1b6676af35d1c47963f43a66eeff7153661cc1526ad8ac2
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
status=not_needed
status
200
vary
Accept-Encoding
content-length
10477
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e282a95cc2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/yummmylicious.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
psychedelicariaa.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=psychedelicariaa
  • https://roomimg.stream.highwebmedia.com/ri/psychedelicariaa.jpg?1565806218
10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/psychedelicariaa.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b2ac7e52d4f74ae86836e767afb8ab054c17a66953f83835b7b4e236c0fbfca
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
17
cf-polished
origSize=9791
status
200
vary
Accept-Encoding
content-length
9734
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e2834b51c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/psychedelicariaa.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
sweet_katarina_x.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=sweet_katarina_x
  • https://roomimg.stream.highwebmedia.com/ri/sweet_katarina_x.jpg?1565806218
8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/sweet_katarina_x.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
802348fa71f2fe4c59a2d290cb8f9337c3e462d86efa7a0c84892869e743f8de
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
15
cf-polished
origSize=8337
status
200
vary
Accept-Encoding
content-length
8267
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e283ccf8c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/sweet_katarina_x.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
milkykandy.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=milkykandy
  • https://roomimg.stream.highwebmedia.com/ri/milkykandy.jpg?1565806218
9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/milkykandy.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b0ae30246c1db9f7b8b89b392b43688b6dbd85cbec5eb27ef80eb95286c4bf3
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
19
cf-polished
origSize=9300
status
200
vary
Accept-Encoding
content-length
9216
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e283dd57c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/milkykandy.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
isabeyferrec.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=isabeyferrec
  • https://roomimg.stream.highwebmedia.com/ri/isabeyferrec.jpg?1565806218
7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/isabeyferrec.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ce44ff9fd615e143aa99f0cca298911d36189b81c835ca41d05784b52087661
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:18 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origSize=7726
status
200
vary
Accept-Encoding
content-length
7611
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e2847800c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:48 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/isabeyferrec.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
sex_bean.jpg
roomimg.stream.highwebmedia.com/ri/
Redirect Chain
  • http://zhibo.16g5.com/zhibo/curl_pic.php?token=sex_bean
  • https://roomimg.stream.highwebmedia.com/ri/sex_bean.jpg?1565806218
9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://roomimg.stream.highwebmedia.com/ri/sex_bean.jpg?1565806218
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b67ceccd727416f202afae741b36c91fe0293a37987c83d884ba2f261b9cb38
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src data:; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 18:10:19 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
16
cf-polished
origSize=9278
status
200
vary
Accept-Encoding
content-length
9197
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=30
content-security-policy
default-src 'none'; img-src data:; style-src 'unsafe-inline'
accept-ranges
bytes
cf-ray
5064e284b913c2fe-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Wed, 14 Aug 2019 18:10:49 GMT

Redirect headers

Location
https://roomimg.stream.highwebmedia.com/ri/sex_bean.jpg?1565806218
Date
Wed, 14 Aug 2019 18:10:18 GMT
Server
nginx
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
text/html
20190218.js
api.16g5.com//SQL/ 		96 B
408 B 		Script
General
Check archive.org
Download Go to
Full URL
http://api.16g5.com//SQL/20190218.js
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
103.135.20.70 , Taiwan, ASN10103 (HKBN-AS-AP HK Broadband Network Ltd., HK),
Reverse DNS
Software
nginx /
Resource Hash
b4c8d1923ce3e561b9222d69429a4df5ac47f0cf774fb7001e15f98e028520e3

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:18 GMT
Last-Modified
Tue, 02 Jul 2019 12:08:10 GMT
Server
nginx
ETag
"5d1b492a-60"
Content-Type
application/javascript
Cache-Control
max-age=43200
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
96
Expires
Thu, 15 Aug 2019 06:10:18 GMT
glyphicons-halflings-regular.woff2
btah.xyz/template/002juzi/css/img/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://btah.xyz/template/002juzi/css/img/glyphicons-halflings-regular.woff2
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
72.11.140.229 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US),
Reverse DNS
72.11.140.229.static.quadranet.com
Software
nginx /
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://btah.xyz/template/002juzi/css/style.css
Origin
http://btah.xyz

Response headers

Date
Wed, 14 Aug 2019 18:10:18 GMT
Last-Modified
Wed, 20 Mar 2019 03:28:16 GMT
Server
nginx
ETag
"5c91b350-466c"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
18028
20161449.js
js.users.51.la/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://js.users.51.la/20161449.js
Requested by
Host: api.16g5.com
URL: http://api.16g5.com//SQL/20190218.js
Protocol
HTTP/1.1
Security
, ,
Server
163.171.128.16 , Germany, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
7e960186a491c318436c3689a8fe57ac9d7612934eea95765db4f39f72a40499

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-id
20161449
Date
Wed, 14 Aug 2019 18:10:19 GMT
Content-Encoding
gzip
Age
62486
Transfer-Encoding
chunked
X-Via
1.1 PStwzhdxmm215:2 (Cdn Cache Server V2.0)[0 200 0], 1.1 ld93:2 (Cdn Cache Server V2.0)[536 200 2], 1.1 VMdgflkfFRA1ow64:1 (Cdn Cache Server V2.0)[0 200 0]
Content-Disposition
inline;filename=f.txt
Connection
keep-alive
Request-Id
0000016BBBDA494A90065C871C6A5417
x-reserved
amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc
id-2
32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSshETeikCgrjNxpCNhv8FxWHGPOc+7H
Last-Modified
Tue Jul 02 20:07:20 CST 2019
Server
nginx/1.14.0
ETag
"8941a8b44f7cfa22b62401b6aa6ec8a6"
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
version-id
G001116BB29508F3FFFF90470974E804
go1
ia.51.la/ 		0
255 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ia.51.la/go1?id=20161449&rt=1565806219051&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E4%25BA%259A%25E6%25B4%25B2%25E6%2583%2585%25E8%2589%25B2&ing=1&ekc=&sid=1565806219051&tt=%25E4%25BA%259A%25E6%25B4%25B2%25E4%25B8%2593%25E5%258C%25BA&kw=%25E4%25BA%259A%25E6%25B4%25B2%25E6%2598%25A5%25E8%2589%25B2&cu=http%253A%252F%252Fbtah.xyz%252F&pu=
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
183.131.207.66 , China, ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
CloudWAF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:20 GMT
Server
CloudWAF
Connection
keep-alive
Content-Length
0
Content-Type
application/octet-stream
matomo.js
a.5288av.xyz/ 		66 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://a.5288av.xyz/matomo.js
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
202.5.19.18 Los Angeles, United States, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK),
Reverse DNS
Software
nginx /
Resource Hash
e05cfc8ee6c159882251c45f74d6bdab570f14ed43ece74e2153b77c2dde277f

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:19 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Aug 2019 22:39:27 GMT
Server
nginx
ETag
W/"5d51ea9f-106e0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 15 Aug 2019 06:10:19 GMT
matomo.php
a.5288av.xyz/ 		43 B
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://a.5288av.xyz/matomo.php?action_name=%E4%BA%9A%E6%B4%B2%E4%B8%93%E5%8C%BA&idsite=16&rec=1&r=358781&h=20&m=10&s=19&url=http%3A%2F%2Fbtah.xyz%2F&_id=30490807fc6effb0&_idts=1565806220&_idvc=1&_idn=0&_refts=0&_viewts=1565806220&send_image=1&cookie=1&res=1600x1200&gt_ms=958&pv_id=Ghrr7G
Requested by
Host: btah.xyz
URL: http://btah.xyz/
Protocol
HTTP/1.1
Security
, ,
Server
202.5.19.18 Los Angeles, United States, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK),
Reverse DNS
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
http://btah.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 18:10:19 GMT
Cache-Control
no-store
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| toggle_sidebar function| $ function| jQuery object| _paq object| dom object| style string| propaHTML number| num object| jQuery111306295181776243253 object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log

5 Cookies

Domain/Path Name / Value
btah.xyz/ Name: _pk_ses.16.86ce
Value: 1
btah.xyz/ Name: _pk_id.16.86ce
Value: 30490807fc6effb0.1565806220.1.1565806220.1565806220.
btah.xyz/ Name: __51cke__
Value:
btah.xyz/ Name: __51laig__
Value: 1
btah.xyz/ Name: __tins__20161449
Value: %7B%22sid%22%3A%201565806219051%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201565808019051%7D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.5288av.xyz
api.16g5.com
btah.xyz
ia.51.la
js.users.51.la
lajiaopic.com
roomimg.stream.highwebmedia.com
zhibo.16g5.com
103.135.20.70
163.171.128.16
183.131.207.66
202.5.19.18
23.224.158.178
2606:4700::6810:3037
72.11.140.229
0ba4b4d14697445e510b5fc19426e54a78d819680db6219ee4d5f6a35a082b47
1b67ceccd727416f202afae741b36c91fe0293a37987c83d884ba2f261b9cb38
28753c9da0c94ca9a5cdd6dc47b975f72de1958331c0c52c518a2e7737fc5e68
2b2ac7e52d4f74ae86836e767afb8ab054c17a66953f83835b7b4e236c0fbfca
2ce44ff9fd615e143aa99f0cca298911d36189b81c835ca41d05784b52087661
4ea398cba1f4f047b1b6676af35d1c47963f43a66eeff7153661cc1526ad8ac2
5470ae6db091e8c2204992b17565277c5af7cf2a134597ded6c6fbfd5053e2aa
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
608a8ce0f433494140f3b505ad8997c6321e8e9c0a119b16832b7540591b9508
65e37442f3f72455663885e2f76b499b7e00ade947b0a08c29d5868412989309
7e960186a491c318436c3689a8fe57ac9d7612934eea95765db4f39f72a40499
7fb5d39d1ffc2163615263fccecc662964fa86288690ae093ef3b7dd00328f41
802348fa71f2fe4c59a2d290cb8f9337c3e462d86efa7a0c84892869e743f8de
88e9731d80ce9b32b6f3b615882ac982208bd890ebf85dce0da516e63d128419
8ba45158c400ffd12f76d0417618da87fec2c8fa736dc097ca54225c7fb98e86
953db3139e21a25057f95ec72881ad51f286231f649b40f3e79e631f513ad4f0
9b0ae30246c1db9f7b8b89b392b43688b6dbd85cbec5eb27ef80eb95286c4bf3
a60cad61f2aa4bb93481d5cfe7c26e5935836fd68ab9c40236b12fe7222da356
ae7469b110d4b04a6202e0c80505bca56a7dfb3f2c7bf92a6fbde6b048213cbb
b4c8d1923ce3e561b9222d69429a4df5ac47f0cf774fb7001e15f98e028520e3
ba14f2be6aaae08503e6b23a91fabec68694a81c6728965c3a5b8c2e3e787843
c25e5ea29a70831117e3cb207dc6d62410b108bd3d6f6f11f9f21bc23dd0d872
c35d4b028c9d922c330215886759c97e9ce2a308c17368e584717759bc5e98b0
cbce95d7d6eb1403aab2a37e411275acf172dc13314a9e88ed54a9a6e4f23d8b
cd8ade8a500e68245055798f0a83ca0ddef0f90f183725a96ac6a0661b6d1fb3
d1040c0ba1dabb2145b13343a1aa30205f2faf428d8b3ddd382c283924aef789
d300d8c62c92930c52dc8779d34cdcc7723be95734f7e42b3ecd165ee7f13790
e05cfc8ee6c159882251c45f74d6bdab570f14ed43ece74e2153b77c2dde277f
e3ab502e5acafd2cb8d1adcd735dc13e86500c7a2dd182ad776fe7dc2b457772
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2d27b860f3047a04a50d6ae0f26ed8429a47e4900315250c36798b82bca89b6
fc6f2c44727696d08c04a5dd85f13be60bff25d995e749626fafdbd3309bd79d
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c