Report - www.njqcjy.com/1.exe

Report Overview

Submitted URL
www.njqcjy.com/1.exe
IP
75.2.18.233
ASN
#16509 AMAZON-02
Submitted
2023-06-01 05:00:10
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.njqcjy.com	unknown	2022-05-19	2015-04-03	2023-06-01	2.4 kB	16 kB	75.2.18.233
www.google.com	7	1997-09-15	2015-05-10	2023-05-29	2.3 kB	113 kB	142.250.74.164
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-05-31	1.7 kB	3.5 kB	142.250.74.131
d38psrni17bvxu.cloudfront.net	unknown	2008-04-25	2022-09-22	2023-05-31	396 B	12 kB	54.230.245.8
d1lxhc4jvstzrp.cloudfront.net	unknown	2008-04-25	2020-12-02	2023-06-01	466 B	12 kB	54.230.245.141
afs.googleusercontent.com	12123	2008-11-17	2013-05-06	2023-05-31	969 B	2.2 kB	216.58.211.1
tracking-protection.cdn.mozilla.net	9282	1998-01-31	2015-09-17	2023-05-31	2.0 kB	1.9 MB	34.120.158.37

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-06-01 04:59:56	high	Client IP	75.2.18.233	ET MALWARE Single char EXE direct download likely trojan (multiple families)

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	Size	First Seen	Last Seen
	www.google.com/adsense/domains/caf.js?abp=1	148 kB	2023-05-25	2023-06-01
Pretty URL www.google.com/adsense/domains/caf.js?abp=1 IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-25 23:17:03 Last Seen2023-06-01 20:38:43 Times Seen757 Hash f51be766d49f8c26d133b8f014b074e5 da480cf81a4d498473c4efe043adbbc925c1d406 1de44c034281d97bec166b8bc5defa35a913dbc0fa2a4c164370bb97cca9b13e Loading...

	www.njqcjy.com/1.exe	968 B	2023-03-08	2024-04-24
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 02:24:08 Last Seen2024-04-24 19:23:31 Times Seen27705 Hash c77554570ae0fa8e4fb31747dc213058 e989fbde07e6a68975c7a31e1d4df76afd90b96f c3f831fe1717c6d76a8950ac5e7dc88ceee7440d079b11584be5c6c5b3269e77 Loading...

	www.njqcjy.com/1.exe	734 B	2023-06-01	2023-06-01
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:00:12 Last Seen2023-06-01 07:00:12 Times Seen1 Hash a9945420aa41a79bf8096b8f66d1b5fc f276bff847fb161055af1e8b5a947252824bb773 0a73ddb9b9a2d4ce427553ad46c8acd23a3e4e4e20d9d305cc958432818f3b48 Loading...

	www.njqcjy.com/1.exe	246 B	2023-06-01	2023-06-01
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:00:12 Last Seen2023-06-01 07:00:12 Times Seen1 Hash 55b3073dab579296dbaf8382f7288782 c15cd3d7d4a57c4e8538587b3d706665c5d58581 17d3a312ea45a7850d2f6b15691c0d12e60bb8bd02daf16863724e485dc79d67 Loading...

	www.njqcjy.com/1.exe	7.0 kB	2023-03-13	2024-01-03
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 06:10:31 Last Seen2024-01-03 14:22:39 Times Seen25920 Hash 04b2b624f94797c26d17a57f399d9356 3143986e839c47a5c1eff03bd9df63ecc54dca9c 233b1cbfb295a0629bcf68a2a4198a62132f02ee1f061ada2ce7143bd5d2dabb Loading...

	www.njqcjy.com/1.exe	1.3 kB	2023-06-01	2023-06-01
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:00:12 Last Seen2023-06-01 07:00:12 Times Seen1 Hash 4fb3fb457787b86258fe5551e5adf080 55d873aa0e5413dc5072de865902e6481445df32 aa546526112bb44caf4d157ac3a4cad8a4a97dfc68acd5f76d85ddc162311809 Loading...

	www.njqcjy.com/1.exe	20 B	2023-03-12	2024-01-03
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 13:00:05 Last Seen2024-01-03 14:22:39 Times Seen13851 Hash bb9472ed191ad69435d630c50e139a17 4efa10c70dbfe37ec4c8bb5a04b907c549de7e3d eec645c8d410f4d6accc5c4c3326bbff80fdd9d105e423ad50c5c87b22845492 Loading...

	www.google.com/adsense/domains/caf.js	148 kB	2023-05-26	2023-06-01
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-26 03:50:52 Last Seen2023-06-01 20:12:31 Times Seen246 Hash 58c31aeb089c63c8f027835e7b0e4c31 3cbc732e5a7905082ad2d06d320049c7f2f689f9 ca4f1778fd2387cdd0ed485b67e9ca7f93978131d829340af1fe397baebfc8b6 Loading...

	www.njqcjy.com/1.exe	65 B	2023-03-12	2023-10-31
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 13:50:53 Last Seen2023-10-31 06:44:41 Times Seen2161 Hash 62fb68db3a7f1a5728e00eebc88621bd 69f165691e40c4ceb9bc5fe70dbf0139826eebb6 52910149dd73101c1716a6cb4805c6c8475976be06768a9851776f79b3c45cae Loading...

	www.njqcjy.com/1.exe	472 B	2023-03-13	2024-01-03
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 06:13:46 Last Seen2024-01-03 14:22:39 Times Seen25251 Hash d31eefc1e54bdae9204297e4ae5b9cce fc49bf319586a623670a81c01d43bbd93b477fbb 2683a6247a15433dd269eaefbc7131b1326c7bc0146361913ea10ad8fa23bb14 Loading...

	www.njqcjy.com/1.exe	669 B	2023-06-01	2023-06-01
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:00:12 Last Seen2023-06-01 07:00:12 Times Seen1 Hash 3b7eedb1d81db33cd7b734a07bd051aa 284cdc0f992116ff66d287ac2c7639b9c752c1dc 6a36ccc76ca9ef366baed8f66ec1faac0a6f1bbaaa8e8c6096de89d3ec65e25b Loading...

	www.njqcjy.com/1.exe	40 B	2023-04-18	2023-06-27
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-18 09:10:37 Last Seen2023-06-27 14:44:07 Times Seen10821 Hash bcdb5f35f5da29644017c63a72a72921 5bd1c81154b546c01c88b02fdb29b687f0c9cef3 a71d2bc0274b66fc2cb2c8daf1bf8b8a6a4cbfd5bd1e30574e9abb61aa9c3983 Loading...

	www.njqcjy.com/1.exe	71 B	2023-03-08	2024-01-04
Pretty URL www.njqcjy.com/1.exe IP 75.2.18.233 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 02:23:53 Last Seen2024-01-04 08:38:22 Times Seen25410 Hash 1a5a5e1b6a26f57b95e3dd42f60612f4 b62a27e55a59b49084e682bd3c1588f6a40881ab 4066da16910907c7962da8e7011bf0cd62b6f2dcddb1911e3ea2de03ce3e1dc7 Loading...

	www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530	5.8 kB	2023-06-01	2023-06-01
Pretty URL www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530 IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:00:12 Last Seen2023-06-01 07:00:12 Times Seen1 Hash aef0729d379970b51b437d20f75d028a cc772ddcd808a2e3d1b1b43e2f99b4724f3a3ab1 5b15516d667535c5d4bfb96d510e59a00e8549ff019ed9ac9fd7e5587091ab78 Loading...

HTTP Transactions (23)

URL IP Response Size

tracking-protection.cdn.mozilla.net/ads-track-digest256/1684337778

34.120.158.37

56 kB

URL
tracking-protection.cdn.mozilla.net/ads-track-digest256/1684337778
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
56 kB (56534 bytes)
Hash
e82f812913b6a06c608d7bb688e184b4
ea5db373525ee7dfa0abaf0befb2dae54e62b699
46fb1d72ca8047216ad4c5349f791a385049e1025042a3fbca56a7bf94ff2e89

HTTP Headers

GET /ads-track-digest256/1684337778 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: uJ6ZIMoE839Ys4+Yj3C+jbRbfVECZh0707onUtGlk5hdextGhsb3bh02VJkX5lXH4Bx+uTOOAnY=
x-amz-request-id: GNCXKCX6NQ2XPRDM
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 56534
via: 1.1 google
date: Wed, 31 May 2023 15:37:05 GMT
age: 48168
last-modified: Wed, 17 May 2023 15:36:30 GMT
etag: "e82f812913b6a06c608d7bb688e184b4"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/analytics-track-digest256/1683905755

34.120.158.37

10 kB

URL
tracking-protection.cdn.mozilla.net/analytics-track-digest256/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
10 kB (10486 bytes)
Hash
feffee93ee53bd6b02687bb9d9a11425
f9fab28225d6eb2ed2e72ce675d5d5b624383658
3b09c3bc75d40a2dc370d7a9e88433d74de203f31056900b995b497950f2d672

HTTP Headers

GET /analytics-track-digest256/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: jnUFOs+XG7u8/CJ6yk5MQh0kHBuVYY6+Hq30/Sw5zvUW4aUubQ8+xEGgWzr7ekaff9L1AHhH7oU=
x-amz-request-id: RME7Q3BW2E0T655T
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 10486
via: 1.1 google
date: Wed, 31 May 2023 15:36:44 GMT
age: 48189
last-modified: Fri, 12 May 2023 15:36:10 GMT
etag: "feffee93ee53bd6b02687bb9d9a11425"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/content-track-digest256/1683905755

34.120.158.37

15 kB

URL
tracking-protection.cdn.mozilla.net/content-track-digest256/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
15 kB (15350 bytes)
Hash
adff9f8518019ddb5b72e09fa471bd56
2a5cf28dcda107605da2bb4f6e56a07e514a927f
900f414ea63bb7f4e5a33041d77112c309aa8dfebd93681895c596d948ed12bf

HTTP Headers

GET /content-track-digest256/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: i/Ud7V7OlbaJWvAmKuf4WUnvlgmFEyWVOVzuWRZyo2RndALHx9vllvVaThREUG8hBxWsasULpX8=
x-amz-request-id: GNCVBFDZWNYXVZYA
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 15350
via: 1.1 google
date: Wed, 31 May 2023 15:37:05 GMT
age: 48168
last-modified: Fri, 12 May 2023 15:36:06 GMT
etag: "adff9f8518019ddb5b72e09fa471bd56"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/google-trackwhite-digest256/1683905755

34.120.158.37

1.5 MB

URL
tracking-protection.cdn.mozilla.net/google-trackwhite-digest256/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
1.5 MB (1476920 bytes)
Hash
501d3f65be5457b0986a2f0b880e88f2
0df631bbe10a12e255c8d323fed084f51ffb842d
e3acbced9ab46ff7a41311445b2bd1f6f70f8716d35131670528417d2c9a6627

HTTP Headers

GET /google-trackwhite-digest256/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: zeomrkpP6+0WsAVu50PLaOJHtcQ1wsSgOo0Md30u1LY226GMa4El5hnDcR74uRV2HFu/gjAUO9A=
x-amz-request-id: T70G5DF1P5EQD5ZA
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
via: 1.1 google
date: Wed, 31 May 2023 15:36:58 GMT
age: 48175
last-modified: Fri, 12 May 2023 15:36:17 GMT
etag: "501d3f65be5457b0986a2f0b880e88f2"
content-type: application/octet-stream
content-length: 1476920
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/mozstd-trackwhite-digest256/1684337778

34.120.158.37

346 kB

URL
tracking-protection.cdn.mozilla.net/mozstd-trackwhite-digest256/1684337778
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
346 kB (345943 bytes)
Hash
dc048d310df250632824a0ef784c0503
349ed5134df1bb49ba48bab8498c932655795279
a217142987da561fafd04a5f77dcab5860687e0089002eec43cd8bd619b9870a

HTTP Headers

GET /mozstd-trackwhite-digest256/1684337778 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: k893AxateR7sUqZdt0QLyIIEt3QfpoRUhDChE8JXypuA+cSIDO+XpD4N5OJ/pL6dDlpnWvE6dHE=
x-amz-request-id: Z62MZJB5T8XGJ490
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 345943
via: 1.1 google
date: Wed, 31 May 2023 15:37:06 GMT
age: 48168
last-modified: Wed, 17 May 2023 15:36:35 GMT
etag: "dc048d310df250632824a0ef784c0503"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

www.njqcjy.com/

75.2.18.233

6.2 kB

URL
www.njqcjy.com/
IP
75.2.18.233:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1332)
Size
6.2 kB (6195 bytes)
Hash
c9ed804560b71f17d166bfb8508fb8fb
53faf2d8b3e6c18ef1f3eac51f3a10aded8d10d5
a0cf08437774a7c762969f971b13206fad6f1c1fcd0659b5bd22559013742201

HTTP Headers

GET / HTTP/1.1
Host: www.njqcjy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 04:59:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Buckets: bucket003
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_gCWCYMAgBP1iBCSSYP3l4yxXwFMA4eMkXnqPwTQHtKoYWW6P+QkwlrfFafzaNeW2wIi65FDkmAP0Gluz/wLOdQ==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: njqcjy.com
X-Subdomain: www
Content-Encoding: gzip

www.njqcjy.com/1.exe

75.2.18.233

200 OK

6.2 kB

URL User Request GET HTTP/1.1
www.njqcjy.com/1.exe
IP
75.2.18.233:80
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1332)
Size
6.2 kB (6198 bytes)
Hash
aba1c425a1804c099ad398063dcc8dee
691483405e655b80b4b69bcdcdd46473080e43a6
f45721ba2f88f8da23ac0598f6a3df4ad92d651961fe059812dca06636fdfb24

Detections

NIDS	Severity	Alert
suricata	high	ET MALWARE Single char EXE direct download likely trojan (multiple families)

HTTP Headers

GET /1.exe HTTP/1.1
Host: www.njqcjy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 04:59:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Buckets: bucket003
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_Xjg9di8swTEYxzqQGLjai2FANWmnz0oWpnDc0xyyQtVe0HZX4TD/AvA0WTlCTDxYs5yAykflgFkWXhQbIWFByQ==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: njqcjy.com
X-Subdomain: www
Content-Encoding: gzip

www.google.com/adsense/domains/caf.js?abp=1

142.250.74.164

200 OK

54 kB

URL GET HTTP/1.1
www.google.com/adsense/domains/caf.js?abp=1
IP
142.250.74.164:80
ASN
#15169 GOOGLE

Requested by
http://www.njqcjy.com/1.exe

File type
ASCII text, with very long lines (2125)
Size
54 kB (53790 bytes)
Hash
f51be766d49f8c26d133b8f014b074e5
da480cf81a4d498473c4efe043adbbc925c1d406
1de44c034281d97bec166b8bc5defa35a913dbc0fa2a4c164370bb97cca9b13e

HTTP Headers

GET /adsense/domains/caf.js?abp=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Thu, 01 Jun 2023 04:59:56 GMT
Expires: Thu, 01 Jun 2023 04:59:56 GMT
Cache-Control: private, max-age=3600
ETag: "9185248191336506850"
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0

www.njqcjy.com/track.php?domain=njqcjy.com&toggle=browserjs&uid=MTY4NTU5NTU5Ni40MTcyOjE2MzYzYmJmOGM1MGE1MGVlMGQ0YjU4YWViYTYzMmMzNzY1MTc4OTk5MGUwMDQwZDJhYTUzZjk1MjVlYWNkM2M6NjQ3ODI1Y2M2NWQ5Mg%3D%3D

75.2.18.233

200 OK

20 B

URL GET HTTP/1.1
www.njqcjy.com/track.php?domain=njqcjy.com&toggle=browserjs&uid=MTY4NTU5NTU5Ni40MTcyOjE2MzYzYmJmOGM1MGE1MGVlMGQ0YjU4YWViYTYzMmMzNzY1MTc4OTk5MGUwMDQwZDJhYTUzZjk1MjVlYWNkM2M6NjQ3ODI1Y2M2NWQ5Mg%3D%3D
IP
75.2.18.233:80
ASN
#16509 AMAZON-02

Requested by
http://www.njqcjy.com/1.exe

File type
gzip compressed data, max speed, from Unix\012- data
Size
20 B (20 bytes)
Hash
a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

HTTP Headers

GET /track.php?domain=njqcjy.com&toggle=browserjs&uid=MTY4NTU5NTU5Ni40MTcyOjE2MzYzYmJmOGM1MGE1MGVlMGQ0YjU4YWViYTYzMmMzNzY1MTc4OTk5MGUwMDQwZDJhYTUzZjk1MjVlYWNkM2M6NjQ3ODI1Y2M2NWQ5Mg%3D%3D HTTP/1.1
Host: www.njqcjy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/1.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 04:59:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
2e49fbb441f0fbebc6ce31ee4abd5600
f586dcfb316f20902e5b479d482f91138efafa28
8fda5c8ae8be7dd24164ca2cf2ea3f0b7271c4735a653e972f69dea503bc24ba

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 04:59:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.njqcjy.com/ls.php?t=647825cc&token=f38f5bdd03138014d5e3d5d39f7a8bf6d5dc7dad

75.2.18.233

201 Created

16 B

URL GET HTTP/1.1
www.njqcjy.com/ls.php?t=647825cc&token=f38f5bdd03138014d5e3d5d39f7a8bf6d5dc7dad
IP
75.2.18.233:80
ASN
#16509 AMAZON-02

Requested by
http://www.njqcjy.com/1.exe

File type
JSON data\012- , ASCII text, with no line terminators
Size
16 B (16 bytes)
Hash
7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

HTTP Headers

GET /ls.php?t=647825cc&token=f38f5bdd03138014d5e3d5d39f7a8bf6d5dc7dad HTTP/1.1
Host: www.njqcjy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/1.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Thu, 01 Jun 2023 04:59:56 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 647825ccf415266d552f4550
Charset: utf-8
Access-Control-Allow-Origin: 
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_nJdIPIualVkMhBK1ZNed+Aa7fbhTF3vi6jb6lGm0vlpTUfp7pNAp22MYJWwiIX4xmLYfYE0Nwg8MyXYod7oLoQ==

d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png

54.230.245.8

200 OK

11 kB

URL GET HTTP/1.1
d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
IP
54.230.245.8:80
ASN
#16509 AMAZON-02

Requested by
http://www.njqcjy.com/1.exe

File type
PNG image data, 1500 x 600, 8-bit colormap, non-interlaced\012- data
Size
11 kB (11375 bytes)
Hash
0cb2e5165dc9324eb462199f04e1ffa9
9e0f89847ec8a98d98a6020bc5c4ed32b7a48bf8
67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865

HTTP Headers

GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 11375
Connection: keep-alive
Server: nginx
Date: Thu, 01 Jun 2023 01:25:02 GMT
Last-Modified: Thu, 23 Jun 2022 10:44:43 GMT
Accept-Ranges: bytes
ETag: "62b4441b-2c6f"
X-Cache: Hit from cloudfront
Via: 1.1 3bff78035f818b6a3185b0f5f4586410.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: GsDcOT-M9LIyPEC-_-AsIEsYuKbKPzeSivGPLXFRZdS7tqpZRLG8_A==
Age: 12894

d1lxhc4jvstzrp.cloudfront.net/themes/registrar/images/logo_dynadot3.png

54.230.245.141

200 OK

12 kB

URL GET HTTP/2
d1lxhc4jvstzrp.cloudfront.net/themes/registrar/images/logo_dynadot3.png
IP
54.230.245.141:443
ASN
#16509 AMAZON-02

Requested by
http://www.njqcjy.com/1.exe
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT

File type
PNG image data, 512 x 360, 8-bit/color RGBA, non-interlaced\012- data
Size
12 kB (11597 bytes)
Hash
3489ddefcbe1d2740a2c19d68ed0036d
c5002e2bc054d41b2b8b5bf71f42b1ea5925bec0
5688485453df1fb693d1c7c401075db22569dbe607dbcddd2cb2cba84d2a98a1

HTTP Headers

GET /themes/registrar/images/logo_dynadot3.png HTTP/1.1
Host: d1lxhc4jvstzrp.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-length: 11597
server: nginx
date: Thu, 01 Jun 2023 00:13:09 GMT
last-modified: Mon, 15 Mar 2021 08:16:37 GMT
accept-ranges: bytes
etag: "604f17e5-2d4d"
x-cache: Hit from cloudfront
via: 1.1 4c07121ca6e32bcda85cc9091b92050e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: B7XQJeIP6IPmuETgIOgqaoCOQBo8-VkV72C6-YH1n5lseKXAqZnGqw==
age: 17207
X-Firefox-Spdy: h2

www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530

142.250.74.164

200 OK

2.5 kB

URL GET HTTP/2
www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
http://www.njqcjy.com/1.exe
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint48:E3:15:66:FC:EA:15:BF:D2:34:C1:DD:60:D4:23:A3:63:57:89:8D
ValidityMon, 08 May 2023 08:25:18 GMT - Mon, 31 Jul 2023 08:25:17 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4973)
Size
2.5 kB (2480 bytes)
Hash
74a89802f80d2900b90647b4fe0997f4
6bfd54ef5525bdb7d842015ccf2741df0e802910
46e4c6f2eee28fa9e796cc49edaa0bff62337f754212db170907949e854204f5

HTTP Headers

GET /afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Thu, 01 Jun 2023 04:59:56 GMT
expires: Thu, 01 Jun 2023 04:59:56 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-uOhTXXFlu3w3i18qkQzsJQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2480
x-xss-protection: 0
set-cookie: CONSENT=PENDING+960; expires=Sat, 31-May-2025 04:59:56 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.njqcjy.com/favicon.ico

75.2.18.233

200 OK

0 B

URL GET HTTP/1.1
www.njqcjy.com/favicon.ico
IP
75.2.18.233:80
ASN
#16509 AMAZON-02

Requested by
http://www.njqcjy.com/1.exe

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.njqcjy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/1.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 04:59:57 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
aaa62c1792576f29afd83c721c769ae2
a91969d4ec40a18844781b9364d60e9ae0cb1b52
3ef969ba686248b09252da03a2effad7d8e09e7192ae1daa6e3b8d0240405c43

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 04:59:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4f25832062da8d4729b5be811b75be0a
d6e10effb5d9ce1bf56524ff0bbb3d5891fb522d
c526adeedcb442f61f4303bd5a219fb6ef6132d18dfdb4ae5f4f09400852156e

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 04:59:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4f25832062da8d4729b5be811b75be0a
d6e10effb5d9ce1bf56524ff0bbb3d5891fb522d
c526adeedcb442f61f4303bd5a219fb6ef6132d18dfdb4ae5f4f09400852156e

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 04:59:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/adsense/domains/caf.js

142.250.74.164

200 OK

54 kB

URL GET HTTP/3
www.google.com/adsense/domains/caf.js
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:BA:19:A5:81:25:05:32:72:13:A7:18:CF:67:8C:D6:6F:13:B3:EF
ValidityMon, 08 May 2023 08:20:09 GMT - Mon, 31 Jul 2023 08:20:08 GMT

File type
ASCII text, with very long lines (2125)
Size
54 kB (54048 bytes)
Hash
ff9302e092fea6dc6fe386ba2ba6ced3
7edbae2259c7280ba75b3e5898a6c36ba3e91861
982b4a58607e419f565a1018385ac2f33f7d85a82dc44615d5c54941409ff66a

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 01 Jun 2023 04:59:57 GMT
expires: Thu, 01 Jun 2023 04:59:57 GMT
cache-control: private, max-age=3600
etag: "8062337233583559909"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff

216.58.211.1

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
216.58.211.1:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE9:43:A2:2D:EB:A2:E1:09:B0:36:19:CF:E3:9C:F0:37:52:4F:DB:7A
ValidityMon, 08 May 2023 08:24:36 GMT - Mon, 31 Jul 2023 08:24:35 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
174 B (174 bytes)
Hash
11b3089d616633ca6b73b57aa877eeb4
07632f63e06b30d9b63c97177d3a8122629bda9b
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Wed, 31 May 2023 13:22:37 GMT
expires: Thu, 01 Jun 2023 12:22:37 GMT
cache-control: public, max-age=82800
age: 56240
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.njqcjy.com/track.php?domain=njqcjy.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTU5NTU5Ni40MTcyOjE2MzYzYmJmOGM1MGE1MGVlMGQ0YjU4YWViYTYzMmMzNzY1MTc4OTk5MGUwMDQwZDJhYTUzZjk1MjVlYWNkM2M6NjQ3ODI1Y2M2NWQ5Mg%3D%3D

75.2.18.233

200 OK

20 B

URL GET HTTP/1.1
www.njqcjy.com/track.php?domain=njqcjy.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTU5NTU5Ni40MTcyOjE2MzYzYmJmOGM1MGE1MGVlMGQ0YjU4YWViYTYzMmMzNzY1MTc4OTk5MGUwMDQwZDJhYTUzZjk1MjVlYWNkM2M6NjQ3ODI1Y2M2NWQ5Mg%3D%3D
IP
75.2.18.233:80
ASN
#16509 AMAZON-02

Requested by
http://www.njqcjy.com/1.exe

File type
gzip compressed data, max speed, from Unix\012- data
Size
20 B (20 bytes)
Hash
a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

HTTP Headers

GET /track.php?domain=njqcjy.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTU5NTU5Ni40MTcyOjE2MzYzYmJmOGM1MGE1MGVlMGQ0YjU4YWViYTYzMmMzNzY1MTc4OTk5MGUwMDQwZDJhYTUzZjk1MjVlYWNkM2M6NjQ3ODI1Y2M2NWQ5Mg%3D%3D HTTP/1.1
Host: www.njqcjy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.njqcjy.com/1.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 04:59:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: answercheck
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4f25832062da8d4729b5be811b75be0a
d6e10effb5d9ce1bf56524ff0bbb3d5891fb522d
c526adeedcb442f61f4303bd5a219fb6ef6132d18dfdb4ae5f4f09400852156e

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 04:59:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff

216.58.211.1

200 OK

391 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
IP
216.58.211.1:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fwww.njqcjy.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NDc4MjVjYzY1ZDZlfHx8MTY4NTU5NTU5Ni40MjMxfDdiMzZkZTkyMDAzZTUzMzUxOWE5MWVmOTM1OGIyYzkyMzkwNGNkZTN8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGYzOGY1YmRkMDMxMzgwMTRkNWUzZDVkMzlmN2E4YmY2ZDVkYzdkYWR8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2997149969328928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3%7Cs&nocache=121685595596427&num=0&output=afd_ads&domain_name=www.njqcjy.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685595596429&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=840&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww.njqcjy.com%2F1.exe&adbw=master-1%3A530
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE9:43:A2:2D:EB:A2:E1:09:B0:36:19:CF:E3:9C:F0:37:52:4F:DB:7A
ValidityMon, 08 May 2023 08:24:36 GMT - Mon, 31 Jul 2023 08:24:35 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (406), with no line terminators
Size
391 B (391 bytes)
Hash
249bb4c6a37dfa60d6ecf838cada5020
4e56099d13b015804f79d1182f66982bc6e4662b
a2cebc2af2fd29cbee1ed7860ef5b12088b85259918d8bf2f2aaa99b915fa3f4

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Wed, 31 May 2023 19:36:27 GMT
expires: Thu, 01 Jun 2023 18:36:27 GMT
cache-control: public, max-age=82800
age: 33810
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML