Report - visit.keznews.com/

Report Overview

Submitted URL
visit.keznews.com/
IP
46.8.8.100
ASN
#60592 Gransy s.r.o.
Submitted
2024-04-25 14:06:12
Access
public
Website Title
iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue
Final URL
iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
visit.keznews.com	587993	2006-08-24	2017-04-03	2023-05-09	740 B	466 B	46.8.8.100
ww82.keznews.com	733178	2006-08-24	2021-03-02	2023-09-20	1.5 kB	38 kB	199.59.243.225
www.google.com	7	1997-09-15	2015-05-10	2024-03-23	428 B	75 kB	142.250.74.164
iyfbodn.com	147548	2020-09-22	2021-06-29	2024-04-18	1.7 kB	1.2 kB	208.91.196.46
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-24	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	iyfbodn.com	Sinkholed
2024-04-25	medium	iyfbodn.com	Sinkholed
2024-04-25	medium	iyfbodn.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (11)

URL IP Response Size

visit.keznews.com/

46.8.8.100

59 B

URL
visit.keznews.com/
IP
46.8.8.100:0
ASN
#60592 Gransy s.r.o.

File type
HTML document, ASCII text
Size
59 B (59 bytes)
Hash
fc147d39794a704f411c366352938c4a
cfc5b4d85218fc94ce9eeaab31d51b3170e93c03
3a1e5d4edc353b4338e69099893b7969c01b38bb98a424404819edc7820b4987

HTTP Headers

GET / HTTP/1.1
Host: visit.keznews.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-type: text/html; charset=utf-8
location: http://ww82.keznews.com/
content-length: 59
date: Thu, 25 Apr 2024 14:05:51 GMT
X-Firefox-Spdy: h2

ww82.keznews.com/

199.59.243.225

1.1 kB

URL
ww82.keznews.com/
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
HTML document, ASCII text, with very long lines (318)
Size
1.1 kB (1050 bytes)
Hash
a7ef90ccb78a6ab138f4d2bee82cd302
ad514337f7f128b9b77c005985ceb2c3a00e2acf
6fa29f5e6c7a1cd397e6c758bd6f4b71eda909bac0da036268c809661e4df324

HTTP Headers

GET / HTTP/1.1
Host: ww82.keznews.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Thu, 25 Apr 2024 14:05:51 GMT
content-type: text/html; charset=utf-8
content-length: 1050
x-request-id: e146d9de-113d-4489-be12-73c16e7fe56f
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_rkfQqHNSCCrmeergc5sBI/niiP7cGVNGJH6FG8531WBlso/MHUi5BcupMIVrk0EuvLehULhilz4EpO9ED8q0oA==
set-cookie: parking_session=e146d9de-113d-4489-be12-73c16e7fe56f; expires=Thu, 25 Apr 2024 14:20:51 GMT; path=/

ww82.keznews.com/boZYWlrDh.js

199.59.243.225

34 kB

URL
ww82.keznews.com/boZYWlrDh.js
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (33788)
Size
34 kB (33791 bytes)
Hash
f48baec69cc4dc0852d118259eff2d56
e64c6e4423421da5b35700154810cb67160bc32b
463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c

HTTP Headers

GET /boZYWlrDh.js HTTP/1.1
Host: ww82.keznews.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww82.keznews.com/
Cookie: parking_session=e146d9de-113d-4489-be12-73c16e7fe56f
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Thu, 25 Apr 2024 14:05:51 GMT
content-type: application/javascript; charset=utf-8
content-length: 33791
x-request-id: 532b44fc-92c3-46ec-97d4-8016233bd96b
set-cookie: parking_session=e146d9de-113d-4489-be12-73c16e7fe56f; expires=Thu, 25 Apr 2024 14:20:51 GMT

ww82.keznews.com/_fd

199.59.243.225

478 B

URL
ww82.keznews.com/_fd
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (629), with no line terminators
Size
478 B (478 bytes)
Hash
ed76a407e0334a3f705e55e2f97af689
91ea70c911dc79dbe2510aef51aaed13abd8d1cb
b0dec8e5ef93fd174813ebfefcbcc990c2b525e850a7a8355661f9964e4d9574

HTTP Headers

POST /_fd HTTP/1.1
Host: ww82.keznews.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww82.keznews.com/
Content-Type: application/json
Origin: http://ww82.keznews.com
DNT: 1
Connection: keep-alive
Cookie: parking_session=e146d9de-113d-4489-be12-73c16e7fe56f
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
server: openresty
date: Thu, 25 Apr 2024 14:05:51 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 478
x-version: 2.118.0
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=e146d9de-113d-4489-be12-73c16e7fe56f; expires=Thu, 25 Apr 2024 14:20:51 GMT; Max-Age=900; path=/; httponly

visit.keznews.com/

46.8.8.100

59 B

URL
visit.keznews.com/
IP
46.8.8.100:0
ASN
#60592 Gransy s.r.o.

File type
HTML document, ASCII text
Size
59 B (59 bytes)
Hash
fc147d39794a704f411c366352938c4a
cfc5b4d85218fc94ce9eeaab31d51b3170e93c03
3a1e5d4edc353b4338e69099893b7969c01b38bb98a424404819edc7820b4987

HTTP Headers

GET / HTTP/1.1
Host: visit.keznews.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=utf-8
Location: http://ww82.keznews.com/
Date: Thu, 25 Apr 2024 14:05:51 GMT
Content-Length: 59

ww82.keznews.com/

199.59.243.225

1.1 kB

URL
ww82.keznews.com/
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
HTML document, ASCII text, with very long lines (318)
Size
1.1 kB (1050 bytes)
Hash
e3f2b10cec94f47c6b5d58e58cd4d590
79ef0daee7d23af12be94982a3998768161263fb
bc44ceb5c173720f8955d40dab90344259dd7f91a0455b20e9634a75eda602a9

HTTP Headers

GET / HTTP/1.1
Host: ww82.keznews.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Thu, 25 Apr 2024 14:05:51 GMT
content-type: text/html; charset=utf-8
content-length: 1050
x-request-id: 0c710c62-550b-4513-abed-1398944716ec
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_rkfQqHNSCCrmeergc5sBI/niiP7cGVNGJH6FG8531WBlso/MHUi5BcupMIVrk0EuvLehULhilz4EpO9ED8q0oA==
set-cookie: parking_session=0c710c62-550b-4513-abed-1398944716ec; expires=Thu, 25 Apr 2024 14:20:52 GMT; path=/

www.google.com/adsense/domains/caf.js?abp=1&bodis=true

142.250.74.164

74 kB

URL
www.google.com/adsense/domains/caf.js?abp=1&bodis=true
IP
142.250.74.164:0
ASN
#15169 GOOGLE

File type
JavaScript source, ASCII text, with very long lines (2247)
Size
74 kB (74323 bytes)
Hash
1e24f1623784fabe438b208a03db8e89
a0b53f75fb64fa722b4738a810a0fe079cfd5e73
ef23aabe22a75dc63316662faa9474bd81438fe75040254ee74c6c59e95b65db

HTTP Headers

GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww82.keznews.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 25 Apr 2024 14:05:51 GMT
expires: Thu, 25 Apr 2024 14:05:51 GMT
cache-control: private, max-age=3600
etag: "106029448407162011"
x-content-type-options: nosniff
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue

208.91.196.46

403 Forbidden

300 B

URL User Request GET HTTP/1.1
iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue
IP
208.91.196.46:80
ASN
#40034 CONFLUENCE-NETWORK-INC

File type
HTML document, ASCII text, with CRLF line terminators
Size
300 B (300 bytes)
Hash
dfca6c9521a05229a88b57be32312d30
074cf063361923f7593e794848b9b7c6c2569069
c13dbafe6761fe525bd139e82e4839283525db1755569646b19947a61cfefb80

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue HTTP/1.1
Host: iyfbodn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ww82.keznews.com/
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Thu, 25 Apr 2024 14:05:52 GMT
Server: Apache
Content-Length: 300
Keep-Alive: timeout=5, max=111
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue

208.91.196.46

403 Forbidden

300 B

URL User Request GET HTTP/1.1
iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue
IP
208.91.196.46:80
ASN
#40034 CONFLUENCE-NETWORK-INC

File type
HTML document, ASCII text, with CRLF line terminators
Size
300 B (300 bytes)
Hash
a510cef1d8cb2c106efa9f59257e8c48
d05f6a48f70ae401c3832ed284ec079efaad89dc
52dd2d6ae16744df7b65b21bde21c0cb08a909640f3407df60c773943ee15e5e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue HTTP/1.1
Host: iyfbodn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww82.keznews.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Thu, 25 Apr 2024 14:05:52 GMT
Server: Apache
Content-Length: 300
Keep-Alive: timeout=5, max=126
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

iyfbodn.com/favicon.ico

208.91.196.46

404 Not Found

10 B

URL GET HTTP/1.1
iyfbodn.com/favicon.ico
IP
208.91.196.46:80
ASN
#40034 CONFLUENCE-NETWORK-INC

Requested by
http://iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue

File type
ASCII text, with no line terminators
Size
10 B (10 bytes)
Hash
6608dd3e21ca3beabd4bdfa625a0b221
e926d0f8694a4bc4013308afaca7af51e4c9fd9f
c75eb01138771bfb2a5517aeae882356733782767c4560cc9601c34d2591ca75

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: iyfbodn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://iyfbodn.com/?dn=keznews.com&pid=9POT3387I&pbsubid=e146d9de-113d-4489-be12-73c16e7fe56f&noads=http%3A%2F%2Fiyfbodn.com%2F%3Fdn%3Dkeznews.com%26skipskenzo%3Dtrue
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 14:05:52 GMT
Server: Apache
Content-Length: 10
Keep-Alive: timeout=5, max=128
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=ywg4EEY7amNvnNxQpdvSMaVv8ja5Q-zavvPO7YGueJyipuZy1x4R0XltqzvqmuEDiEsYSavy_6DgwyARXwM5pwAedcGD3kZJZxVL1MZdEcKF-JJuSoKHfGJS8Tx9OUdf
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
date: Thu, 25 Apr 2024 14:04:42 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 85
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (11)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type