| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash8d2e6150f7d0845dc26f5bd5cd6f28dd 6aad5091620585a5f76065c1888456ee70b88257 ed538ea400323f4c987f91c0b0afc79a8526b62f7aa317dd62bd107cb37850a2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "ED538EA400323F4C987F91C0B0AFC79A8526B62F7AA317DD62BD107CB37850A2"
Last-Modified: Tue, 03 Sep 2024 09:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4932
Expires: Thu, 05 Sep 2024 05:47:05 GMT
Date: Thu, 05 Sep 2024 04:24:53 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash66fbf7f95cb55f388373a20d4b1a736e afc34259758a563362367848629ff7639982e1fb 41c00088afc20571f6a0c6998324d9517346256ac33696dc706192ec606fe7a7
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "41C00088AFC20571F6A0C6998324D9517346256AC33696DC706192EC606FE7A7"
Last-Modified: Mon, 02 Sep 2024 12:20:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3626
Expires: Thu, 05 Sep 2024 05:25:19 GMT
Date: Thu, 05 Sep 2024 04:24:53 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash3b182d2525d361002ced8590b8a9ce07 12cd4e482375e47fdc8cde29fe98a6e3498260df 62ed97a3678824305419366056fd0bee73359522822ca42a16fabdcc3ad982be
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "62ED97A3678824305419366056FD0BEE73359522822CA42A16FABDCC3AD982BE"
Last-Modified: Mon, 02 Sep 2024 14:37:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3550
Expires: Thu, 05 Sep 2024 05:24:04 GMT
Date: Thu, 05 Sep 2024 04:24:54 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hashcabaaa7c3e6a621cc5836be05eee4924 c4bc6288aed0597ff7ae2dbc5aea340b6c9636b8 2b2a41201a3881bd029ab7161be291b23128d5952e5959092607b98c951fa18c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "2B2A41201A3881BD029AB7161BE291B23128D5952E5959092607B98C951FA18C"
Last-Modified: Mon, 02 Sep 2024 14:33:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13616
Expires: Thu, 05 Sep 2024 08:11:50 GMT
Date: Thu, 05 Sep 2024 04:24:54 GMT
Connection: keep-alive
|
|
| img.sedoparking.com/templates/bg/multi-arrows.png | 205.234.175.175 | 200 OK | 2.5 kB |
URL GET HTTP/2img.sedoparking.com/templates/bg/multi-arrows.png IP205.234.175.175:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGlobalSign nv-sa Subject*.cachefly.net Fingerprint0F:4E:B2:D7:96:B9:94:D0:35:66:76:6C:4B:16:18:49:DE:42:80:71 ValidityMon, 13 Nov 2023 19:46:02 GMT - Sat, 14 Dec 2024 19:46:01 GMT
File typePNG image data, 150 x 699, 8-bit colormap, non-interlaced Hash53f75042704429bbc0e7b7f6e85bcb1d f5f38bd2b62556831782ee4c28456c33323926ce bdb38096f60e6d8afd62265287852a6c82a818ec048e0288a88f2b96b4b8f475
GET /templates/bg/multi-arrows.png HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 05 Sep 2024 04:24:54 GMT
content-type: image/png
content-length: 2531
access-control-allow-origin: *
x-cff: B
last-modified: Mon, 19 Dec 2022 10:23:48 GMT
x-cf3: H
cf4age: 83049
x-cf-tsc: 1711123655
cf4ttl: 31452950.000
x-cf2: H
server: CFS 1124
x-cf-reqid: 1c5d928ee61931bf04a63312191e02a0
x-cf1: 11696:fD.arn1:nom:cacheN.arn1-01:H
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 471 B |
IP142.250.74.131:0
Hashd6875ab4d1f40fdd82800bb2916ffdaa 08e6c7376a94fff8a2f866e618ccf0e3c77ec95f 93239f8b1fa17d7455695a59fb32d1b65245bd4977a603f51bd99081d9875068
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true | 142.250.74.132 | 200 OK | 56 kB |
URL GET HTTP/2www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true IP142.250.74.132:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectwww.google.com FingerprintE5:F5:76:67:A7:F7:FE:5F:BF:24:ED:E2:9A:3C:07:64:0E:70:74:AA ValidityMon, 05 Aug 2024 07:19:58 GMT - Mon, 28 Oct 2024 07:19:57 GMT
File typegzip compressed data, max compression Hash86ee868d6edc48ae341ce103240fff1c 5c3678dec1bdc9aa6e777a7ca3442c350f483156 4905ab3b3789139410497b9faad96a2cf4e184b23163edb37e608dea11587a8b
GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 05 Sep 2024 04:24:55 GMT
expires: Thu, 05 Sep 2024 04:24:55 GMT
cache-control: private, max-age=3600
etag: "5000624163598899228"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ww16.vofycot.com/search/tsc.php?ses=ogcdssBp-aBUPGVZ7yECHjc_1X41EM-HbvXdooSCpkziYsLcTPfcbm5D_ITnrzsXoY3gwcKt1NDtuEsk0WHu4sZqwcbGZbDFsyWaXhY27u86QQImAAD21nImIdEEskrrfKOIt_YekBcsoyxKsHXBerEatqUWqvdRNeoLQC4t0j8NgzVEHbPdBisXuTAXnvuhHHjZohXOpriwkDgETK2gwTYOSAvVqNWiOI0I7PJS4JuBdW86X7yxWmBkMSV7ROPn44xinL23yMyVJcRvUCKeU9Xw2Im8drHOeFj3sxEa9PZRYdFHSxsgsk4NemREx0Q6zewBSTNr6drTf91KWC1d0YwA1zG9GvlqK0k-Yh6jeaYyZzqC6falZ7vyS4JSg&cv=2 | 64.190.63.136 | 200 OK | 0 B |
URL GET HTTP/2ww16.vofycot.com/search/tsc.php?ses=ogcdssBp-aBUPGVZ7yECHjc_1X41EM-HbvXdooSCpkziYsLcTPfcbm5D_ITnrzsXoY3gwcKt1NDtuEsk0WHu4sZqwcbGZbDFsyWaXhY27u86QQImAAD21nImIdEEskrrfKOIt_YekBcsoyxKsHXBerEatqUWqvdRNeoLQC4t0j8NgzVEHbPdBisXuTAXnvuhHHjZohXOpriwkDgETK2gwTYOSAvVqNWiOI0I7PJS4JuBdW86X7yxWmBkMSV7ROPn44xinL23yMyVJcRvUCKeU9Xw2Im8drHOeFj3sxEa9PZRYdFHSxsgsk4NemREx0Q6zewBSTNr6drTf91KWC1d0YwA1zG9GvlqK0k-Yh6jeaYyZzqC6falZ7vyS4JSg&cv=2 IP64.190.63.136:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerDigiCert Inc Subjectww16.vofycot.com Fingerprint77:E9:D4:A2:BA:16:65:DB:42:BE:75:37:14:8C:76:AC:69:F6:79:69 ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 02 Nov 2024 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /search/tsc.php?ses=ogcdssBp-aBUPGVZ7yECHjc_1X41EM-HbvXdooSCpkziYsLcTPfcbm5D_ITnrzsXoY3gwcKt1NDtuEsk0WHu4sZqwcbGZbDFsyWaXhY27u86QQImAAD21nImIdEEskrrfKOIt_YekBcsoyxKsHXBerEatqUWqvdRNeoLQC4t0j8NgzVEHbPdBisXuTAXnvuhHHjZohXOpriwkDgETK2gwTYOSAvVqNWiOI0I7PJS4JuBdW86X7yxWmBkMSV7ROPn44xinL23yMyVJcRvUCKeU9Xw2Im8drHOeFj3sxEa9PZRYdFHSxsgsk4NemREx0Q6zewBSTNr6drTf91KWC1d0YwA1zG9GvlqK0k-Yh6jeaYyZzqC6falZ7vyS4JSg&cv=2 HTTP/1.1
Host: ww16.vofycot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 05 Sep 2024 04:24:55 GMT
server: Parking/1.0
x-cache-miss-from: parking-fb7ffd9b7-4t4x4
content-length: 0
X-Firefox-Spdy: h2
|
|
| img.sedoparking.com/templates/logos/sedo_logo.png | 205.234.175.175 | 200 OK | 15 kB |
URL GET HTTP/2img.sedoparking.com/templates/logos/sedo_logo.png IP205.234.175.175:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGlobalSign nv-sa Subject*.cachefly.net Fingerprint0F:4E:B2:D7:96:B9:94:D0:35:66:76:6C:4B:16:18:49:DE:42:80:71 ValidityMon, 13 Nov 2023 19:46:02 GMT - Sat, 14 Dec 2024 19:46:01 GMT
File typeMS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel Hashdef00c11b1596db4efee6a9fbe64fc27 bd298981e6d8d7e4ffa18abcf687041f4246672d 95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4
GET /templates/logos/sedo_logo.png HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Sep 2024 04:24:55 GMT
content-type: image/png
content-length: 15086
access-control-allow-origin: *
cache-control: max-age=604800
expires: Thu, 12 Sep 2024 04:24:55 GMT
x-cfhash: "def00c11b1596db4efee6a9fbe64fc27"
x-cff: B
last-modified: Mon, 11 Jan 2021 07:44:34 GMT
x-cf3: H
cf4age: 21299
x-cf-tsc: 1711144658
cf4ttl: 31514700.000
x-cf2: H
server: CFS 1124
x-cf-reqid: 4fabbb66df75929f83ffd2b8b4ae35de
x-cf1: 11696:fD.arn1:cf:nom:cacheN.arn1-01:H
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 472 B |
IP142.250.74.131:0
Hash1ac1d5b146c70db6ae03ff6462c6f44d 259beab043004a9c549375a59c6e15e5d06b64b2 937adb716430d12600166e69ec70e202be5f7ab83319452de4e9a94af2aaedb9
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 472 B |
IP142.250.74.131:0
Hash1ac1d5b146c70db6ae03ff6462c6f44d 259beab043004a9c549375a59c6e15e5d06b64b2 937adb716430d12600166e69ec70e202be5f7ab83319452de4e9a94af2aaedb9
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| syndicatedsearch.goog/afs/ads/i/iframe.html | 142.250.74.142 | 200 OK | 729 B |
URL GET HTTP/2syndicatedsearch.goog/afs/ads/i/iframe.html IP142.250.74.142:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDE:8D:5C:FE:24:EB:DA:BC:82:53:9F:0F:0E:84:76:6B:17:A1:29:52 ValidityMon, 05 Aug 2024 07:28:52 GMT - Mon, 28 Oct 2024 07:28:51 GMT
File typeHTML document, ASCII text, with very long lines (1559) Hashda2960c0e30939c9476210d06c16063b f630cdfb1d4477561b1fdddbf8dec3ccb9d882a3 be3d3dd5b840e7eddde5da96310672cfa5a0badd6508b2641f06efd9782ad560
GET /afs/ads/i/iframe.html HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy: script-src 'nonce-_MIda8a43AqQMDAzZyQZzQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-length: 729
date: Thu, 05 Sep 2024 04:24:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Tue, 12 Mar 2024 06:00:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=4449419535&channel=exp-0046%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjU1MTAyOTQmdGNpZD13dzE2LnZvZnljb3QuY29tNjZkOTMyOTY5YzMyNTEuODc4NDQ1MTgmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPUc1Z3gySVFpRmQyZHlwV1N4LVdx&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5141725510295225&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1725510295239&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=1479&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=667606770&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20240905-1419-507b-a130-7445afcf7de5 | 142.250.74.142 | 200 OK | 3.1 kB |
URL GET HTTP/2syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=4449419535&channel=exp-0046%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjU1MTAyOTQmdGNpZD13dzE2LnZvZnljb3QuY29tNjZkOTMyOTY5YzMyNTEuODc4NDQ1MTgmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPUc1Z3gySVFpRmQyZHlwV1N4LVdx&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5141725510295225&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1725510295239&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=1479&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=667606770&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20240905-1419-507b-a130-7445afcf7de5 IP142.250.74.142:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDE:8D:5C:FE:24:EB:DA:BC:82:53:9F:0F:0E:84:76:6B:17:A1:29:52 ValidityMon, 05 Aug 2024 07:28:52 GMT - Mon, 28 Oct 2024 07:28:51 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (13779) Hashb2c6373042faad551565e65a3bd9494c b3e945f496db5271d3fc020180c7c40bfb667473 18697d9a2a48df9b09faee892ce8eaa1cf489bb475cb1f6941df0b1163cdd29a
GET /afs/ads?adsafe=low&adtest=off&psid=4449419535&channel=exp-0046%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjU1MTAyOTQmdGNpZD13dzE2LnZvZnljb3QuY29tNjZkOTMyOTY5YzMyNTEuODc4NDQ1MTgmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPUc1Z3gySVFpRmQyZHlwV1N4LVdx&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5141725510295225&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1725510295239&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=1479&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=667606770&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20240905-1419-507b-a130-7445afcf7de5 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Thu, 05 Sep 2024 04:24:55 GMT
expires: Thu, 05 Sep 2024 04:24:55 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-7P7wlLyoDzfWAa0lt-RzGg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 3072
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 472 B |
IP142.250.74.131:0
Hash1ac1d5b146c70db6ae03ff6462c6f44d 259beab043004a9c549375a59c6e15e5d06b64b2 937adb716430d12600166e69ec70e202be5f7ab83319452de4e9a94af2aaedb9
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 472 B |
IP142.250.74.131:0
Hash07b513c36c651c31e209c138dc2e2df4 ad48d12abf234e45aabb676048f3f95f9439ff92 552ce487b838e981ca1e2cbccaf0da79dc8525776fb1cea4a64d29c47af6696a
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 472 B |
IP142.250.74.131:0
Hash07b513c36c651c31e209c138dc2e2df4 ad48d12abf234e45aabb676048f3f95f9439ff92 552ce487b838e981ca1e2cbccaf0da79dc8525776fb1cea4a64d29c47af6696a
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23000000 | 142.250.74.97 | 200 OK | 270 B |
URL GET HTTP/2afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23000000 IP142.250.74.97:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=4449419535&channel=exp-0046%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjU1MTAyOTQmdGNpZD13dzE2LnZvZnljb3QuY29tNjZkOTMyOTY5YzMyNTEuODc4NDQ1MTgmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPUc1Z3gySVFpRmQyZHlwV1N4LVdx&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5141725510295225&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1725510295239&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=1479&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=667606770&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subject*.googleusercontent.com Fingerprint6C:DD:E8:38:9C:56:23:58:B5:BF:84:3B:D0:2B:24:C7:10:3E:89:C3 ValidityMon, 05 Aug 2024 07:15:31 GMT - Mon, 28 Oct 2024 07:15:30 GMT
File typeSVG Scalable Vector Graphics image Hash78d29b2362fcb5dee6fe8111c4f1c53b 5019bfbd17efb89c68be43d489ebf98d7d707119 008270530fe4a3f4bcbec41da05d40361aca8edf374a464c70d5cacfb8e06fd4
GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23000000 HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Sep 2024 15:23:55 GMT
expires: Thu, 05 Sep 2024 14:23:55 GMT
cache-control: public, max-age=82800
age: 46860
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23000000 | 142.250.74.97 | 200 OK | 173 B |
URL GET HTTP/2afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23000000 IP142.250.74.97:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=4449419535&channel=exp-0046%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjU1MTAyOTQmdGNpZD13dzE2LnZvZnljb3QuY29tNjZkOTMyOTY5YzMyNTEuODc4NDQ1MTgmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPUc1Z3gySVFpRmQyZHlwV1N4LVdx&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5141725510295225&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1725510295239&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=1479&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=667606770&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subject*.googleusercontent.com Fingerprint6C:DD:E8:38:9C:56:23:58:B5:BF:84:3B:D0:2B:24:C7:10:3E:89:C3 ValidityMon, 05 Aug 2024 07:15:31 GMT - Mon, 28 Oct 2024 07:15:30 GMT
File typeSVG Scalable Vector Graphics image Hasha12df2436667e359ab4623080d0a6fed e62f87b1d55545c0836af1cd8d849b41d9ed5f4f 245be54e1421d7f071cc82866858258d5be20e08b1ffaeb4d7f59106d1805fd6
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23000000 HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 173
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Sep 2024 21:18:26 GMT
expires: Thu, 05 Sep 2024 20:18:26 GMT
cache-control: public, max-age=82800
age: 25589
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| o.pki.goog/wr2 | 142.250.74.131 | | 472 B |
IP142.250.74.131:0
Hash07b513c36c651c31e209c138dc2e2df4 ad48d12abf234e45aabb676048f3f95f9439ff92 552ce487b838e981ca1e2cbccaf0da79dc8525776fb1cea4a64d29c47af6696a
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Sep 2024 04:24:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| r11.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hashc96a4972e341191f93e963880196f8e1 8318aa6dcbdababe8728023ec9ef3aaac10917a9 dd8f73d55d492ad4e3fc3915c05ecfc6883f124c050dded51f4e43292e6b8c2a
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DD8F73D55D492AD4E3FC3915C05ECFC6883F124C050DDED51F4E43292E6B8C2A"
Last-Modified: Mon, 02 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7576
Expires: Thu, 05 Sep 2024 06:31:12 GMT
Date: Thu, 05 Sep 2024 04:24:56 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hashc96a4972e341191f93e963880196f8e1 8318aa6dcbdababe8728023ec9ef3aaac10917a9 dd8f73d55d492ad4e3fc3915c05ecfc6883f124c050dded51f4e43292e6b8c2a
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DD8F73D55D492AD4E3FC3915C05ECFC6883F124C050DDED51F4E43292E6B8C2A"
Last-Modified: Mon, 02 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7576
Expires: Thu, 05 Sep 2024 06:31:12 GMT
Date: Thu, 05 Sep 2024 04:24:56 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hashc96a4972e341191f93e963880196f8e1 8318aa6dcbdababe8728023ec9ef3aaac10917a9 dd8f73d55d492ad4e3fc3915c05ecfc6883f124c050dded51f4e43292e6b8c2a
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DD8F73D55D492AD4E3FC3915C05ECFC6883F124C050DDED51F4E43292E6B8C2A"
Last-Modified: Mon, 02 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7576
Expires: Thu, 05 Sep 2024 06:31:12 GMT
Date: Thu, 05 Sep 2024 04:24:56 GMT
Connection: keep-alive
|
|
| syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=xd3p15u4e1v5&aqid=lzLZZuvSFvKAxdwP1YKtkAs&pbt=bs&adbx=490&adby=1287.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=11%7C0%7C234%7C94%7C45&lle=0&ifv=0&hpt=0 | 142.250.74.142 | 204 No Content | 0 B |
URL GET HTTP/3syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=xd3p15u4e1v5&aqid=lzLZZuvSFvKAxdwP1YKtkAs&pbt=bs&adbx=490&adby=1287.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=11%7C0%7C234%7C94%7C45&lle=0&ifv=0&hpt=0 IP142.250.74.142:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDE:8D:5C:FE:24:EB:DA:BC:82:53:9F:0F:0E:84:76:6B:17:A1:29:52 ValidityMon, 05 Aug 2024 07:28:52 GMT - Mon, 28 Oct 2024 07:28:51 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=xd3p15u4e1v5&aqid=lzLZZuvSFvKAxdwP1YKtkAs&pbt=bs&adbx=490&adby=1287.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=11%7C0%7C234%7C94%7C45&lle=0&ifv=0&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-_m6FxunLm5mWTStfvn6l4w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Thu, 05 Sep 2024 04:24:57 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=mbcljuxm7er3&aqid=lzLZZuvSFvKAxdwP1YKtkAs&psid=4449419535&pbt=bs&adbx=232&adby=151.64999389648438&adbh=530&adbw=816&adbah=161%2C161%2C161&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=26%7C0%7C219%7C94%7C45&lle=0&ifv=1&hpt=0 | 142.250.74.142 | 204 No Content | 0 B |
URL GET HTTP/3syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=mbcljuxm7er3&aqid=lzLZZuvSFvKAxdwP1YKtkAs&psid=4449419535&pbt=bs&adbx=232&adby=151.64999389648438&adbh=530&adbw=816&adbah=161%2C161%2C161&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=26%7C0%7C219%7C94%7C45&lle=0&ifv=1&hpt=0 IP142.250.74.142:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDE:8D:5C:FE:24:EB:DA:BC:82:53:9F:0F:0E:84:76:6B:17:A1:29:52 ValidityMon, 05 Aug 2024 07:28:52 GMT - Mon, 28 Oct 2024 07:28:51 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=mbcljuxm7er3&aqid=lzLZZuvSFvKAxdwP1YKtkAs&psid=4449419535&pbt=bs&adbx=232&adby=151.64999389648438&adbh=530&adbw=816&adbah=161%2C161%2C161&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=26%7C0%7C219%7C94%7C45&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-FuO8zld7W3yOxZ5HnHfpbA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Thu, 05 Sep 2024 04:24:57 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=6cc92uyiookg&aqid=lzLZZuvSFvKAxdwP1YKtkAs&psid=4449419535&pbt=bv&adbx=232&adby=151.64999389648438&adbh=530&adbw=816&adbah=161%2C161%2C161&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=26%7C0%7C219%7C94%7C45&lle=0&ifv=1&hpt=0 | 142.250.74.142 | 204 No Content | 0 B |
URL GET HTTP/3syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=6cc92uyiookg&aqid=lzLZZuvSFvKAxdwP1YKtkAs&psid=4449419535&pbt=bv&adbx=232&adby=151.64999389648438&adbh=530&adbw=816&adbah=161%2C161%2C161&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=26%7C0%7C219%7C94%7C45&lle=0&ifv=1&hpt=0 IP142.250.74.142:443
Requested byhttps://ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDE:8D:5C:FE:24:EB:DA:BC:82:53:9F:0F:0E:84:76:6B:17:A1:29:52 ValidityMon, 05 Aug 2024 07:28:52 GMT - Mon, 28 Oct 2024 07:28:51 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=6cc92uyiookg&aqid=lzLZZuvSFvKAxdwP1YKtkAs&psid=4449419535&pbt=bv&adbx=232&adby=151.64999389648438&adbh=530&adbw=816&adbah=161%2C161%2C161&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=667606770&csala=26%7C0%7C219%7C94%7C45&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-SvRI9rwPycJPHkctQ6aJVw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Thu, 05 Sep 2024 04:24:57 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 | 64.190.63.136 | 200 OK | 26 kB |
URL User Request GET HTTP/2ww16.vofycot.com/login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 IP64.190.63.136:443
CertificateIssuerDigiCert Inc Subjectww16.vofycot.com Fingerprint77:E9:D4:A2:BA:16:65:DB:42:BE:75:37:14:8C:76:AC:69:F6:79:69 ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 02 Nov 2024 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /login.php?sub1=20240905-1419-507b-a130-7445afcf7de5 HTTP/1.1
Host: ww16.vofycot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 05 Sep 2024 04:24:54 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 05 Sep 2024 04:24:54 GMT
pragma: no-cache
server: Parking/1.0
vary: Accept-Encoding
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_D33CHcRb/H/d0WFGn1XKsLY1o2L0w7DhWAaNk0IjvodExx1V0a+TdKGvqnAl0M5Tyld7HgJrJpvB+P1WwteUkw==
x-cache-miss-from: parking-fb7ffd9b7-czb9t
X-Firefox-Spdy: h2
|
|
| syndicatedsearch.goog/adsense/domains/caf.js | 142.250.74.142 | 200 OK | 154 kB |
URL GET HTTP/3syndicatedsearch.goog/adsense/domains/caf.js IP142.250.74.142:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=4449419535&channel=exp-0046%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjU1MTAyOTQmdGNpZD13dzE2LnZvZnljb3QuY29tNjZkOTMyOTY5YzMyNTEuODc4NDQ1MTgmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPUc1Z3gySVFpRmQyZHlwV1N4LVdx&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5141725510295225&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1725510295239&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=1479&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=667606770&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20240905-1419-507b-a130-7445afcf7de5 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDE:8D:5C:FE:24:EB:DA:BC:82:53:9F:0F:0E:84:76:6B:17:A1:29:52 ValidityMon, 05 Aug 2024 07:28:52 GMT - Mon, 28 Oct 2024 07:28:51 GMT
File typeJavaScript source, ASCII text, with very long lines (1618) Size154 kB (153711 bytes) Hash2d20019926893df545dd72d0cac61cb7 51f1535cb24ea8b489d1bc4c2156a5e4ea0e4513 777a7a4535c637ced6b7467bc55f42dd936506a32d787c678133d22c7193bdef
GET /adsense/domains/caf.js HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 05 Sep 2024 04:24:55 GMT
expires: Thu, 05 Sep 2024 04:24:55 GMT
cache-control: private, max-age=3600
etag: "5040061370915620560"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|