{"report_id":"6167aef9-8d09-401b-962e-a213d744d047","version":6,"status":"done","tags":[],"date":"2024-01-09T02:35:17Z","url":{"schema":"http","addr":"autoconfig.montokop.pw/","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":0,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"autoconfig.montokop.pw/","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"title":"Montokop.pw"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-26T04:33:11Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"default"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"autoconfig.montokop.pw","ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":6,"request_count":7,"received_data":28180,"sent_data":3160,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.adsensecustomsearchads.com","ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-01-28","domain_rank":0,"first_seen":"2015-09-02 02:57:40","last_seen":"2024-01-08 18:17:09","alert_count":0,"request_count":4,"received_data":155522,"sent_data":3129,"comment":"","tags":null,"fingerprints":null},{"fqdn":"afs.googleusercontent.com","ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-11-17","domain_rank":12123,"first_seen":"2013-05-06 21:11:00","last_seen":"2024-01-08 15:55:32","alert_count":0,"request_count":2,"received_data":2094,"sent_data":1033,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.google.com","ip":{"addr":"142.250.74.132","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":7,"first_seen":"2015-05-10 13:11:19","last_seen":"2023-12-09 10:58:51","alert_count":0,"request_count":1,"received_data":150331,"sent_data":431,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:50Z","timestamp":1704767690,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":47572,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:50.821752+0000\",\"flow_id\":1826609607379448,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":47572,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":34532,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"A\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:50.821752+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:50Z","timestamp":1704767690,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":43143,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:50.821907+0000\",\"flow_id\":2000615912409747,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":43143,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":28018,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:50.821907+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:50Z","timestamp":1704767690,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34836,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:50.876123+0000\",\"flow_id\":1826085621358171,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":34836,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":36199,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:50.876123+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":47060,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:51.134624+0000\",\"flow_id\":218986168651232,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":47060,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":39127,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:51.134624+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.322829+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":603},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":679,\"bytes_toclient\":1787,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":40063,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:51.423371+0000\",\"flow_id\":143003902244299,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":40063,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":65466,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:51.423371+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.517806+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/js/parking.2.110.6.js\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"application/javascript\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1031},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":9,\"bytes_toserver\":1296,\"bytes_toclient\":9357,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":50185,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:51.636388+0000\",\"flow_id\":12192083326436,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":50185,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":8518,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:51.636388+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":60623,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:51.649954+0000\",\"flow_id\":922454567152354,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60623,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":49105,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:51.649954+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":55218,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:51.657084+0000\",\"flow_id\":1137971731039932,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":55218,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":44701,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:51.657084+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.765472+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":2,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/_fd\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"text/html\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"POST\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":2038},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":22,\"bytes_toserver\":2791,\"bytes_toclient\":28225,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":60630,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.835801+0000\",\"flow_id\":640923755867364,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60630,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/px.gif?ch=1\u0026rn=2.429101628191492\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":42},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":724,\"bytes_toclient\":627,\"start\":\"2024-01-09T02:34:51.650468+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":60634,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.844476+0000\",\"flow_id\":898973980887817,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60634,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/px.gif?ch=2\u0026rn=2.429101628191492\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":42},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":724,\"bytes_toclient\":627,\"start\":\"2024-01-09T02:34:51.658185+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":56392,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:51.851317+0000\",\"flow_id\":789203206798709,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":56392,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":38876,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:51.851317+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":60630,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.990913+0000\",\"flow_id\":640923755867364,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60630,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"image/x-icon\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":6,\"pkts_toclient\":4,\"bytes_toserver\":1287,\"bytes_toclient\":961,\"start\":\"2024-01-09T02:34:51.650468+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:52Z","timestamp":1704767692,"ip_dst":{"addr":"Internal IP","port":53,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":56882,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET DNS Query to a *.pw domain - Likely Hostile","source":"{\"timestamp\":\"2024-01-09T02:34:52.669411+0000\",\"flow_id\":1051483974678243,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":56882,\"dest_ip\":\"10.70.215.1\",\"dest_port\":53,\"proto\":\"UDP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016778,\"rev\":8,\"signature\":\"ET DNS Query to a *.pw domain - Likely Hostile\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"updated_at\":[\"2022_05_03\"]}},\"dns\":{\"query\":[{\"type\":\"query\",\"id\":35808,\"rrname\":\"autoconfig.montokop.pw\",\"rrtype\":\"AAAA\",\"tx_id\":0}]},\"app_proto\":\"dns\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":93,\"bytes_toclient\":0,\"start\":\"2024-01-09T02:34:52.669411+0000\"}}"}]}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"autoconfig.montokop.pw/","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"ef6d5801e0231a154acc48ed4f09c33c","sha1":"6b1a8930d2e53aacdb0ecd67c2cc0d399c227012","sha256":"48502dac083f8f9d4b7d748691cbd1f446bd4960894e31c7c4757f8d3326d2cf","sha512":"c348bed8b78936b7b4e1c4790f869fe94cb7a7371765dd91f77769ddac7210ccda5302ab64b9aa4d5a485c012769020c0c87f5908f9704e211378861bde03578","ssdeep":"","tlshash":"70e07d0c106d9e9cdd315c100b7c4df0a7a436e515b0a689d7d48cf950504dbc81c4ff","size":319,"data":"","first_seen":"2024-08-20T12:50:12.915048Z","last_seen":"2024-08-20T12:50:12.915048Z","times_seen":1,"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.322829+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":603},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":679,\"bytes_toclient\":1787,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/js/parking.2.110.6.js","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"57177752975d3fad5c4672cfca4f5639","sha1":"96d37b02c113869b6424c9c8b1faaf306da4e7a8","sha256":"525a639b46f526cb628ec79545dbccb68f09551e0082eeca9938c09ceb78ba92","sha512":"cc86606f9e99769decad28a6e6bcfe1506c2b8e340c4c4f1f18e3ad3d7fa2c62a7a909824d6727cf4320653bab181192f6c125b91104b346aca4da0bc6767323","ssdeep":"1536:6PL6DAfVaJPBnxG0x0EasIoiGoeWSjAtpUn1nF:ntCMoeS+RF","tlshash":"c763f89c76d2f0b613e3b570903f620bf23979266859c460b226d9d17db494e93a3f2c","size":69215,"data":"","first_seen":"2023-12-14T03:24:07Z","last_seen":"2024-08-20T15:54:37.784124Z","times_seen":23,"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.517806+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/js/parking.2.110.6.js\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"application/javascript\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1031},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":9,\"bytes_toserver\":1296,\"bytes_toclient\":9357,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.132","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"abafa0849308459af6d9407e8113b991","sha1":"ce0b4e1c84fdae81f302e3944ffabe95922cdba6","sha256":"dba14e89fd4e3f93c81704e1dba22cb195387a59c91392a36e47a4dbbe75d798","sha512":"0715074eba2f8809b473189d6b941d54bc0a84796af7dac6cf029c48e911d75f74f7b0669e79902002b448511ffbee7ea53cce68fd8ad9c4af522dddeaad2709","ssdeep":"1536:S6/bgOGuWJWPy7qnyteyuHUhtgYKtpGvKRPX0ogQZhe0z6BerfjcLsRglCgWIjyt:H4fJhvXQZhe0HroLAgWI29ial4nXMR","tlshash":"52e35c9977a1702653a350b4603f168fb23af96ae84845f4f198c4e47cb8da81237f7d","size":149479,"data":"","first_seen":"2023-12-13T18:30:42Z","last_seen":"2024-08-20T15:56:30.274125Z","times_seen":2655,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.adsensecustomsearchads.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol302%2Cpid-bodis-gcontrol153%2Cpid-bodis-gcontrol410\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fautoconfig.montokop.pw%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2261622373373818\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301383\u0026format=r3\u0026nocache=4271704767692012\u0026num=0\u0026output=afd_ads\u0026domain_name=autoconfig.montokop.pw\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1704767692013\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1264\u0026psh=79\u0026frm=0\u0026cl=588056317\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=588056317\u0026rurl=http%3A%2F%2Fautoconfig.montokop.pw%2F","fqdn":"www.adsensecustomsearchads.com","domain":"adsensecustomsearchads.com","tld":"com"},"ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"34642c55bac9c3c101f5a5258f45b804","sha1":"2156706382df7afe5429f3637dda9ae12ade2cf6","sha256":"59f8d55915ef5eb52dbd986caf51535ba5bfb6ed5448c52d8ceccce95237e7e5","sha512":"0f5685eba518ea92cf1a7827e9c0a6422650e7df2a8dd6b9a4d4657abd15a2179c168a2f156f43e3b57ffda8cc0815249c5f5b3fbfece6890e1a3d5866fd3473","ssdeep":"","tlshash":"37f0a2961d240232d4ab15575c4f3fb1349c157132972685a09db8c9217d79f622f0bb","size":622,"data":"","first_seen":"2024-08-20T12:50:12.916056Z","last_seen":"2024-08-20T12:50:12.916056Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.adsensecustomsearchads.com/adsense/domains/caf.js","fqdn":"www.adsensecustomsearchads.com","domain":"adsensecustomsearchads.com","tld":"com"},"ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"02e1d7d22ce77a26db2d31e0ea226c4d","sha1":"589e90664548afbd0a6bd50624e06511989ffc27","sha256":"b8c187466021871117db097cde92e79d559f9c28804015bef784dac6c6d4e8df","sha512":"94ebdcf9e9d2f13676ef2b997e5a6b6b27b9bbdeb71c207b8269ac629a7d08b3503774f05123e30d0b9aa823660a6c02cffe7dd11fc39b3d0e7e253e3c8950fe","ssdeep":"1536:16/bgOGuWJWPy7qnyteyuHUhtgYKtpGvKRPX0ogQZhe0z6BerfjcLsRglCgWIjyt:y4fJhvXQZhe0HroLAgWI29ial4nXMR","tlshash":"dee35c9977a1702653a350b4603f168fb23af96ae84845f4f198c4e47cb8da81237f7d","size":149495,"data":"","first_seen":"2023-12-13T18:09:44Z","last_seen":"2024-08-20T15:56:34.550618Z","times_seen":2232,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"autoconfig.montokop.pw/","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-01-09T02:34:51.143Z","timestamp":1704767691143,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 09 Jan 2024 02:34:51 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284; expires=Tue, 09 Jan 2024 02:49:51 GMT; Max-Age=900; path=/; HttpOnly\r\nX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_N67eaUKCFKelqYsCiS2fxJ7G5O6OhELK59EwYbl9sv+XU3mIjpllyQIf/69VTp4ihm99EwGK8u27eAkJINzNNQ==\r\nAccept-CH: sec-ch-prefers-color-scheme\r\nCritical-CH: sec-ch-prefers-color-scheme\r\nVary: sec-ch-prefers-color-scheme\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":658,"size_decoded":867,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (867), with no line terminators","md5":"3ff40b958ca380345fc416e2264b8e22","sha1":"af7786f534ae82a54b08f130e37f388ee5e7357e","sha256":"c99182b4e8d112c0c1e189d9f494bd7078e6ed10093286a34e4e6ab22da0f954","sha512":"8f33a3d1b47e1b58900542e2da1578bab1b9d64883aca3c990ee2101b0cfa626976e5cf3efa940a61874794d35bedd2e350eb43f5583ab7e48f31492eb0db77d","ssdeep":"","tlshash":"3611965504699969ee7144119d7886ac818c67dc6320dc48dfec84bc84807c2dc1c5fd","first_seen":"2024-08-20T12:50:12.905489Z","last_seen":"2024-08-20T12:50:12.905489Z","times_seen":1,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":86,"dns":0,"connect":93,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.322829+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":603},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":679,\"bytes_toclient\":1787,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/js/parking.2.110.6.js","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:51.425Z","timestamp":1704767691425,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js/parking.2.110.6.js HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nCookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 09 Jan 2024 02:34:51 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Wed, 13 Dec 2023 20:32:10 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22266,"size_decoded":69215,"mime_type":"application/javascript; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65536), with no line terminators","md5":"57177752975d3fad5c4672cfca4f5639","sha1":"96d37b02c113869b6424c9c8b1faaf306da4e7a8","sha256":"525a639b46f526cb628ec79545dbccb68f09551e0082eeca9938c09ceb78ba92","sha512":"cc86606f9e99769decad28a6e6bcfe1506c2b8e340c4c4f1f18e3ad3d7fa2c62a7a909824d6727cf4320653bab181192f6c125b91104b346aca4da0bc6767323","ssdeep":"1536:6PL6DAfVaJPBnxG0x0EasIoiGoeWSjAtpUn1nF:ntCMoeS+RF","tlshash":"c763f89c76d2f0b613e3b570903f620bf23979266859c460b226d9d17db494e93a3f2c","first_seen":"2023-12-14T03:24:07Z","last_seen":"2024-08-20T15:54:37.784124Z","times_seen":23,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":94,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.517806+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/js/parking.2.110.6.js\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"application/javascript\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1031},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":9,\"bytes_toserver\":1296,\"bytes_toclient\":9357,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/_fd","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:51.650Z","timestamp":1704767691650,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /_fd HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://autoconfig.montokop.pw/\r\nContent-Type: application/json\r\nOrigin: http://autoconfig.montokop.pw\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nDate: Tue, 09 Jan 2024 02:34:51 GMT\r\nX-Version: 2.110.6\r\nSet-Cookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284; expires=Tue, 09 Jan 2024 02:49:51 GMT; Max-Age=900; path=/; httponly\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2028,"size_decoded":3961,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with very long lines (3961), with no line terminators","md5":"68044cf0ca6208e81f2fd4c7be2f10ee","sha1":"6b91a83982088130b90523ad8b8a33d91d5aa165","sha256":"c8e8ae0315b84f1398635fea7cde7412ae9903c481778d45e85f23433b782e8f","sha512":"21f344ac2a8c6415e370a1f60b373f8def4d1fc3eb73e13a74418da4281d416bf0f39ed0ef118242250c3269dcba77a3de991c6cf39b15969455915c421a63b3","ssdeep":"","tlshash":"a981f9d78e1a3e68db1a420724cd41d2035d87ef2c62809e8a6d5ae48f1974e76d113f","first_seen":"2024-08-20T12:50:12.907247Z","last_seen":"2024-08-20T12:50:12.907247Z","times_seen":1,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":1,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60628,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.765472+0000\",\"flow_id\":883817041301632,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60628,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":2,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/_fd\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"text/html\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"POST\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":2038},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":22,\"bytes_toserver\":2791,\"bytes_toclient\":28225,\"start\":\"2024-01-09T02:34:51.135296+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/px.gif?ch=1\u0026rn=2.429101628191492","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:51.654Z","timestamp":1704767691654,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /px.gif?ch=1\u0026rn=2.429101628191492 HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nCookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 09 Jan 2024 02:34:51 GMT\r\nContent-Type: image/gif\r\nContent-Length: 42\r\nLast-Modified: Tue, 21 Dec 2021 18:13:32 GMT\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nAccept-Ranges: bytes\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42,"size_decoded":42,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-06-15T01:32:59.612548Z","times_seen":949522,"resource_available":true,"data":null}},"time_used":276,"timings":{"blocked":89,"dns":1,"connect":93,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60630,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.835801+0000\",\"flow_id\":640923755867364,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60630,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/px.gif?ch=1\u0026rn=2.429101628191492\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":42},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":724,\"bytes_toclient\":627,\"start\":\"2024-01-09T02:34:51.650468+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/px.gif?ch=2\u0026rn=2.429101628191492","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:51.659Z","timestamp":1704767691659,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /px.gif?ch=2\u0026rn=2.429101628191492 HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nCookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 09 Jan 2024 02:34:51 GMT\r\nContent-Type: image/gif\r\nContent-Length: 42\r\nLast-Modified: Tue, 21 Dec 2021 18:13:32 GMT\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nAccept-Ranges: bytes\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42,"size_decoded":42,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-06-15T01:32:59.612548Z","times_seen":949522,"resource_available":true,"data":null}},"time_used":279,"timings":{"blocked":93,"dns":0,"connect":93,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60634,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.844476+0000\",\"flow_id\":898973980887817,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60634,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/px.gif?ch=2\u0026rn=2.429101628191492\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":42},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":724,\"bytes_toclient\":627,\"start\":\"2024-01-09T02:34:51.658185+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/favicon.ico","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:51.851Z","timestamp":1704767691851,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nCookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 09 Jan 2024 02:34:51 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 0\r\nLast-Modified: Tue, 21 Dec 2021 18:13:32 GMT\r\nConnection: keep-alive\r\nETag: \"61c2194c-0\"\r\nx-backend-server: va32.bodis.com\r\nAccept-Ranges: bytes\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-15T01:33:43.424583Z","times_seen":16429506,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2024-01-09T02:34:51Z","timestamp":1704767691,"ip_dst":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"ip_src":{"addr":"10.70.215.83","port":60630,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO HTTP Request to a *.pw domain","source":"{\"timestamp\":\"2024-01-09T02:34:51.990913+0000\",\"flow_id\":640923755867364,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"10.70.215.83\",\"src_port\":60630,\"dest_ip\":\"199.59.242.153\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016777,\"rev\":16,\"signature\":\"ET INFO HTTP Request to a *.pw domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2013_04_20\"],\"former_category\":[\"INFO\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_09_14\"]}},\"http\":{\"hostname\":\"autoconfig.montokop.pw\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\",\"http_content_type\":\"image/x-icon\",\"http_refer\":\"http://autoconfig.montokop.pw/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":6,\"pkts_toclient\":4,\"bytes_toserver\":1287,\"bytes_toclient\":961,\"start\":\"2024-01-09T02:34:51.650468+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.adsensecustomsearchads.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol302%2Cpid-bodis-gcontrol153%2Cpid-bodis-gcontrol410\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fautoconfig.montokop.pw%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2261622373373818\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301383\u0026format=r3\u0026nocache=4271704767692012\u0026num=0\u0026output=afd_ads\u0026domain_name=autoconfig.montokop.pw\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1704767692013\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1264\u0026psh=79\u0026frm=0\u0026cl=588056317\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=588056317\u0026rurl=http%3A%2F%2Fautoconfig.montokop.pw%2F","fqdn":"www.adsensecustomsearchads.com","domain":"adsensecustomsearchads.com","tld":"com"},"ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:52.026Z","timestamp":1704767692026,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:03:51 GMT","end":"Mon, 12 Feb 2024 08:03:50 GMT"},"fingerprint":{"sha1":"CC:43:B8:B1:97:47:17:A9:AD:50:52:49:F8:17:A6:48:24:6F:9D:79","sha256":"70:D1:19:EB:67:FB:D4:DE:F2:0E:81:C6:15:EC:3F:4C:84:AF:F1:99:D2:60:5F:79:64:A5:A7:E9:9F:60:55:4D"}}},"request":{"raw":"GET /afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol302%2Cpid-bodis-gcontrol153%2Cpid-bodis-gcontrol410\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fautoconfig.montokop.pw%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2261622373373818\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301383\u0026format=r3\u0026nocache=4271704767692012\u0026num=0\u0026output=afd_ads\u0026domain_name=autoconfig.montokop.pw\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1704767692013\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1264\u0026psh=79\u0026frm=0\u0026cl=588056317\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=588056317\u0026rurl=http%3A%2F%2Fautoconfig.montokop.pw%2F HTTP/1.1\r\nHost: www.adsensecustomsearchads.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-disposition: inline\r\ndate: Tue, 09 Jan 2024 02:34:52 GMT\r\nexpires: Tue, 09 Jan 2024 02:34:52 GMT\r\ncache-control: private, max-age=3600\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-dOHfgrdPfY7X7EozUX_WSA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ncontent-encoding: br\r\nserver: gws\r\ncontent-length: 2517\r\nx-xss-protection: 0\r\nset-cookie: CONSENT=PENDING+382; expires=Thu, 08-Jan-2026 02:34:52 GMT; path=/; domain=.adsensecustomsearchads.com; Secure\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2517,"size_decoded":13556,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (12989)","md5":"f7cc0f8aa25397539b252cce0f816629","sha1":"8014dc3c1c80f1c6380f94a3be495b452a2c246d","sha256":"1252e0dfd1c86e0e340c851e5c1b1733b399c44ef5ee329ea189d73fe8dbef34","sha512":"83d004eef73e51d693640cd3eec28435b4434db814c00ab723a35bf1c9d06b318fb312cdd9c675200820d98b2c0791d901957eb9e4b5d6bf228185dfc5a81972","ssdeep":"192:GE12ikpBn9+m0yEMcfWrGkagFyZEb/zkx:Gni8jHEJpka6yZEb/zkx","tlshash":"6c523237746227290507dc541b296f6dd181d53ac46b35e848a35b25c7ebf828fe228e","first_seen":"2024-08-20T12:50:12.90966Z","last_seen":"2024-08-20T12:50:12.90966Z","times_seen":1,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":65,"dns":35,"connect":7,"send":0,"wait":113,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff","fqdn":"afs.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://www.adsensecustomsearchads.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol302%2Cpid-bodis-gcontrol153%2Cpid-bodis-gcontrol410\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fautoconfig.montokop.pw%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2261622373373818\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301383\u0026format=r3\u0026nocache=4271704767692012\u0026num=0\u0026output=afd_ads\u0026domain_name=autoconfig.montokop.pw\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1704767692013\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1264\u0026psh=79\u0026frm=0\u0026cl=588056317\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=588056317\u0026rurl=http%3A%2F%2Fautoconfig.montokop.pw%2F","date":"2024-01-09T02:34:52.685Z","timestamp":1704767692685,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:08:31 GMT","end":"Mon, 12 Feb 2024 08:08:30 GMT"},"fingerprint":{"sha1":"17:E3:6E:DB:3C:C4:0E:B4:6D:D3:55:1A:70:F8:0B:23:86:54:69:D8","sha256":"9D:AE:60:BC:89:F8:54:D0:F1:1F:5E:48:9A:25:49:AB:1A:A0:0F:CE:41:C5:74:F8:71:DA:4E:13:BE:F5:F7:CE"}}},"request":{"raw":"GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1\r\nHost: afs.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.adsensecustomsearchads.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers\r\ncross-origin-opener-policy: same-origin; report-to=\"afs-native-asset-managers\"\r\nreport-to: {\"group\":\"afs-native-asset-managers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers\"}]}\r\ncontent-length: 278\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 08 Jan 2024 18:31:23 GMT\r\nexpires: Tue, 09 Jan 2024 17:31:23 GMT\r\ncache-control: public, max-age=82800\r\nage: 29009\r\nlast-modified: Tue, 27 Jun 2023 17:28:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":278,"size_decoded":444,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fe7dd8c3c629cc6e9cd6d3e4d3cbe905","sha1":"59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18","sha256":"5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e","sha512":"1c663e07978d95c838aed54421a9c725d7311b8c002f436b30555affb26c25f6ebecff6af5c54ef112370a36a5f5aadf611304bffe76a59fb3d206e943cf153f","ssdeep":"","tlshash":"eff055bcd2ad4914a608c7017ef8a5174066f0c563cc01ceee81ac69f0614e43a63ade","first_seen":"2023-04-07T08:14:08Z","last_seen":"2026-06-08T18:18:07.17184Z","times_seen":69566,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":53,"dns":19,"connect":7,"send":0,"wait":8,"receive":1,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b","fqdn":"afs.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://www.adsensecustomsearchads.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol302%2Cpid-bodis-gcontrol153%2Cpid-bodis-gcontrol410\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fautoconfig.montokop.pw%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2261622373373818\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301383\u0026format=r3\u0026nocache=4271704767692012\u0026num=0\u0026output=afd_ads\u0026domain_name=autoconfig.montokop.pw\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1704767692013\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1264\u0026psh=79\u0026frm=0\u0026cl=588056317\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=588056317\u0026rurl=http%3A%2F%2Fautoconfig.montokop.pw%2F","date":"2024-01-09T02:34:52.687Z","timestamp":1704767692687,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:08:31 GMT","end":"Mon, 12 Feb 2024 08:08:30 GMT"},"fingerprint":{"sha1":"17:E3:6E:DB:3C:C4:0E:B4:6D:D3:55:1A:70:F8:0B:23:86:54:69:D8","sha256":"9D:AE:60:BC:89:F8:54:D0:F1:1F:5E:48:9A:25:49:AB:1A:A0:0F:CE:41:C5:74:F8:71:DA:4E:13:BE:F5:F7:CE"}}},"request":{"raw":"GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1\r\nHost: afs.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.adsensecustomsearchads.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers\r\ncross-origin-opener-policy: same-origin; report-to=\"afs-native-asset-managers\"\r\nreport-to: {\"group\":\"afs-native-asset-managers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers\"}]}\r\ncontent-length: 174\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 08 Jan 2024 21:24:07 GMT\r\nexpires: Tue, 09 Jan 2024 20:24:07 GMT\r\ncache-control: public, max-age=82800\r\nage: 18645\r\nlast-modified: Thu, 02 Nov 2023 22:48:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":174,"size_decoded":200,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d47125b2ba92be53dcff07ba322ce1de","sha1":"e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28","sha256":"5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6","sha512":"78a1bf7547b1c28f600163689161955bc56a621ace3228c9169143be933ccf789fc6106bbf729f2e9483bcaa03271529d3913088094c7fb906b44673e13f1f92","ssdeep":"","tlshash":"72d02291d2286d38441e82e0c37c712200ee70a2230c10ccfa81a700720c8abb8a1668","first_seen":"2023-04-07T07:55:51Z","last_seen":"2026-02-01T02:48:24.72202Z","times_seen":175105,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":52,"dns":20,"connect":7,"send":0,"wait":8,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"autoconfig.montokop.pw/_tr","fqdn":"autoconfig.montokop.pw","domain":"montokop.pw","tld":"pw"},"ip":{"addr":"199.59.242.153","port":80,"asn":395082,"as":"BODIS-NJ","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:52.669Z","timestamp":1704767692669,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /_tr HTTP/1.1\r\nHost: autoconfig.montokop.pw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://autoconfig.montokop.pw/\r\nContent-Type: application/json\r\nContent-Length: 1585\r\nOrigin: http://autoconfig.montokop.pw\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nDate: Tue, 09 Jan 2024 02:34:52 GMT\r\nX-Version: 2.110.6\r\nSet-Cookie: parking_session=057bfb27-5e9e-5b90-3937-235f610ac284; expires=Tue, 09 Jan 2024 02:49:52 GMT; Max-Age=900; path=/; httponly\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22,"size_decoded":2,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-06-15T01:36:33.941814Z","times_seen":425718,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":118,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.adsensecustomsearchads.com/afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=4rt8be5j2xih\u0026aqid=zLCcZY32CaywjuwP46m-0AE\u0026psid=3113057640\u0026pbt=bs\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=588056317\u0026csala=8%7C0%7C516%7C93%7C20\u0026lle=0\u0026ifv=1\u0026hpt=0","fqdn":"www.adsensecustomsearchads.com","domain":"adsensecustomsearchads.com","tld":"com"},"ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:54.151Z","timestamp":1704767694151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:03:51 GMT","end":"Mon, 12 Feb 2024 08:03:50 GMT"},"fingerprint":{"sha1":"CC:43:B8:B1:97:47:17:A9:AD:50:52:49:F8:17:A6:48:24:6F:9D:79","sha256":"70:D1:19:EB:67:FB:D4:DE:F2:0E:81:C6:15:EC:3F:4C:84:AF:F1:99:D2:60:5F:79:64:A5:A7:E9:9F:60:55:4D"}}},"request":{"raw":"GET /afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=4rt8be5j2xih\u0026aqid=zLCcZY32CaywjuwP46m-0AE\u0026psid=3113057640\u0026pbt=bs\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=588056317\u0026csala=8%7C0%7C516%7C93%7C20\u0026lle=0\u0026ifv=1\u0026hpt=0 HTTP/1.1\r\nHost: www.adsensecustomsearchads.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nTE: trailers\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-pqZp_tfjk9Z1d-fA_AbwPw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ndate: Tue, 09 Jan 2024 02:34:54 GMT\r\nserver: gws\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nset-cookie: CONSENT=PENDING+997; expires=Thu, 08-Jan-2026 02:34:54 GMT; path=/; domain=.adsensecustomsearchads.com; Secure\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-15T01:33:43.424583Z","times_seen":16429506,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.adsensecustomsearchads.com/afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=ixwafcuwq7e3\u0026aqid=zLCcZY32CaywjuwP46m-0AE\u0026psid=3113057640\u0026pbt=bv\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=588056317\u0026csala=8%7C0%7C516%7C93%7C20\u0026lle=0\u0026ifv=1\u0026hpt=0","fqdn":"www.adsensecustomsearchads.com","domain":"adsensecustomsearchads.com","tld":"com"},"ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:54.654Z","timestamp":1704767694654,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:03:51 GMT","end":"Mon, 12 Feb 2024 08:03:50 GMT"},"fingerprint":{"sha1":"CC:43:B8:B1:97:47:17:A9:AD:50:52:49:F8:17:A6:48:24:6F:9D:79","sha256":"70:D1:19:EB:67:FB:D4:DE:F2:0E:81:C6:15:EC:3F:4C:84:AF:F1:99:D2:60:5F:79:64:A5:A7:E9:9F:60:55:4D"}}},"request":{"raw":"GET /afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=ixwafcuwq7e3\u0026aqid=zLCcZY32CaywjuwP46m-0AE\u0026psid=3113057640\u0026pbt=bv\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=588056317\u0026csala=8%7C0%7C516%7C93%7C20\u0026lle=0\u0026ifv=1\u0026hpt=0 HTTP/1.1\r\nHost: www.adsensecustomsearchads.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nTE: trailers\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-nqbUwL-8M47xabZV-Bhg3Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ndate: Tue, 09 Jan 2024 02:34:54 GMT\r\nserver: gws\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nset-cookie: CONSENT=PENDING+651; expires=Thu, 08-Jan-2026 02:34:54 GMT; path=/; domain=.adsensecustomsearchads.com; Secure\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-15T01:33:43.424583Z","times_seen":16429506,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.132","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://autoconfig.montokop.pw/","date":"2024-01-09T02:34:51.849Z","timestamp":1704767691849,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:09:47 GMT","end":"Mon, 12 Feb 2024 08:09:46 GMT"},"fingerprint":{"sha1":"50:3E:DA:12:EC:7F:39:A5:E9:4F:16:D7:D6:AA:BF:45:15:44:7F:E9","sha256":"98:2D:C0:52:3D:84:7D:B5:89:AE:22:3E:DD:D8:37:86:72:79:D7:32:40:D6:03:55:D8:A6:F1:70:53:DF:48:95"}}},"request":{"raw":"GET /adsense/domains/caf.js HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://autoconfig.montokop.pw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-type: text/javascript; charset=UTF-8\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"ads-afs-ui\"\r\nreport-to: {\"group\":\"ads-afs-ui\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/ads-afs-ui\"}]}\r\ndate: Tue, 09 Jan 2024 02:34:51 GMT\r\nexpires: Tue, 09 Jan 2024 02:34:51 GMT\r\ncache-control: private, max-age=3600\r\netag: \"4119344319494620179\"\r\nx-content-type-options: nosniff\r\nlink: \u003chttps://www.adsensecustomsearchads.com\u003e; rel=\"preconnect\"\r\ncontent-encoding: gzip\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":149479,"size_decoded":149479,"mime_type":"text/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (1888)","md5":"abafa0849308459af6d9407e8113b991","sha1":"ce0b4e1c84fdae81f302e3944ffabe95922cdba6","sha256":"dba14e89fd4e3f93c81704e1dba22cb195387a59c91392a36e47a4dbbe75d798","sha512":"0715074eba2f8809b473189d6b941d54bc0a84796af7dac6cf029c48e911d75f74f7b0669e79902002b448511ffbee7ea53cce68fd8ad9c4af522dddeaad2709","ssdeep":"1536:S6/bgOGuWJWPy7qnyteyuHUhtgYKtpGvKRPX0ogQZhe0z6BerfjcLsRglCgWIjyt:H4fJhvXQZhe0HroLAgWI29ial4nXMR","tlshash":"52e35c9977a1702653a350b4603f168fb23af96ae84845f4f198c4e47cb8da81237f7d","first_seen":"2023-12-13T18:30:42Z","last_seen":"2024-08-20T15:56:30.274125Z","times_seen":2655,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":31,"dns":8,"connect":7,"send":0,"wait":18,"receive":11,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.adsensecustomsearchads.com/adsense/domains/caf.js","fqdn":"www.adsensecustomsearchads.com","domain":"adsensecustomsearchads.com","tld":"com"},"ip":{"addr":"216.58.211.14","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.adsensecustomsearchads.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol302%2Cpid-bodis-gcontrol153%2Cpid-bodis-gcontrol410\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fautoconfig.montokop.pw%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2261622373373818\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301383\u0026format=r3\u0026nocache=4271704767692012\u0026num=0\u0026output=afd_ads\u0026domain_name=autoconfig.montokop.pw\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1704767692013\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1264\u0026psh=79\u0026frm=0\u0026cl=588056317\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=588056317\u0026rurl=http%3A%2F%2Fautoconfig.montokop.pw%2F","date":"2024-01-09T02:34:52.526Z","timestamp":1704767692526,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 20 Nov 2023 08:03:51 GMT","end":"Mon, 12 Feb 2024 08:03:50 GMT"},"fingerprint":{"sha1":"CC:43:B8:B1:97:47:17:A9:AD:50:52:49:F8:17:A6:48:24:6F:9D:79","sha256":"70:D1:19:EB:67:FB:D4:DE:F2:0E:81:C6:15:EC:3F:4C:84:AF:F1:99:D2:60:5F:79:64:A5:A7:E9:9F:60:55:4D"}}},"request":{"raw":"GET /adsense/domains/caf.js HTTP/1.1\r\nHost: www.adsensecustomsearchads.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.adsensecustomsearchads.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-type: text/javascript; charset=UTF-8\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"ads-afs-ui\"\r\nreport-to: {\"group\":\"ads-afs-ui\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/ads-afs-ui\"}]}\r\ndate: Tue, 09 Jan 2024 02:34:52 GMT\r\nexpires: Tue, 09 Jan 2024 02:34:52 GMT\r\ncache-control: private, max-age=3600\r\netag: \"10394782280221507858\"\r\nx-content-type-options: nosniff\r\nlink: \u003chttps://www.adsensecustomsearchads.com\u003e; rel=\"preconnect\"\r\ncontent-encoding: gzip\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":149495,"size_decoded":149495,"mime_type":"text/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (1888)","md5":"02e1d7d22ce77a26db2d31e0ea226c4d","sha1":"589e90664548afbd0a6bd50624e06511989ffc27","sha256":"b8c187466021871117db097cde92e79d559f9c28804015bef784dac6c6d4e8df","sha512":"94ebdcf9e9d2f13676ef2b997e5a6b6b27b9bbdeb71c207b8269ac629a7d08b3503774f05123e30d0b9aa823660a6c02cffe7dd11fc39b3d0e7e253e3c8950fe","ssdeep":"1536:16/bgOGuWJWPy7qnyteyuHUhtgYKtpGvKRPX0ogQZhe0z6BerfjcLsRglCgWIjyt:y4fJhvXQZhe0HroLAgWI29ial4nXMR","tlshash":"dee35c9977a1702653a350b4603f168fb23af96ae84845f4f198c4e47cb8da81237f7d","first_seen":"2023-12-13T18:09:44Z","last_seen":"2024-08-20T15:56:34.550618Z","times_seen":2232,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}