| r10.o.lencr.org/ |  23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash91a50ba757c5ca46c896205a21d87a49 0b48953a685631845a7034c8948077de0e60de80 15d10fabb92098e81e218740ae04059fe6340c321ee70325db46f6c9cb7ad817
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "15D10FABB92098E81E218740AE04059FE6340C321EE70325DB46F6C9CB7AD817"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17944
Expires: Sat, 20 Jul 2024 04:10:55 GMT
Date: Fri, 19 Jul 2024 23:11:51 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashc746d0145c03aa7156aa6a21d8cd2d41 8fb7cb950f28012e8bf42cf02c7598862c66e21f c695ccd93d9e45c8d7b4b08201a3fe45221658531fa0a54f778dadcc2479399e
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C695CCD93D9E45C8D7B4B08201A3FE45221658531FA0A54F778DADCC2479399E"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2212
Expires: Fri, 19 Jul 2024 23:48:43 GMT
Date: Fri, 19 Jul 2024 23:11:51 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash9242083e8854242dd63e09c963159384 d334a9ec53be29ce2d3bbc333205b970b84d63fc 927ae834d942951b3ea3f7199aca87d589dee465706a095bcf7131de85d37e1c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "927AE834D942951B3EA3F7199ACA87D589DEE465706A095BCF7131DE85D37E1C"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5387
Expires: Sat, 20 Jul 2024 00:41:38 GMT
Date: Fri, 19 Jul 2024 23:11:51 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashc1c566b13420f7d3edbf1d5ed3b27db9 97de217d617fdc3b20f959d006b312b10cc0cbae fbe357f2cc5c225f66ccd61407a0609124df4790b268fcadf2c3399579ceed4f
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "FBE357F2CC5C225F66CCD61407A0609124DF4790B268FCADF2C3399579CEED4F"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11614
Expires: Sat, 20 Jul 2024 02:25:25 GMT
Date: Fri, 19 Jul 2024 23:11:51 GMT
Connection: keep-alive
|
|
| ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ |  199.59.243.226 | 200 OK | 1.2 kB |
URL User Request GET HTTP/1.1ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ IP199.59.243.226:80
File typeHTML document, ASCII text, with very long lines (454) Hash800681644f5fdd96b7fef19d916872ec 58adac1f8b6f468334e0e0fbb86c948e7cafc2c6 df1201b1e89e945848112f459a41b61ebd98bdcb90725a4ab6d20057d5b417a3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ HTTP/1.1
Host: ww25.lyxynyx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Fri, 19 Jul 2024 23:11:51 GMT
content-type: text/html; charset=utf-8
content-length: 1186
x-request-id: 4d542722-aeba-4333-808f-004893cb1c2a
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CW963bQWgtdgv/zmu5PuEq369+Ce3buiX1j/wvCTo7JbFjBLXX4VcvJS+iP0JxMbxP3GEBJJfSeP4C6He4+oKA==
set-cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a; expires=Fri, 19 Jul 2024 23:26:51 GMT; path=/
|
|
| ww25.lyxynyx.com/bQHGIJMGv.js | 199.59.243.226 | 200 OK | 34 kB |
URL GET HTTP/1.1ww25.lyxynyx.com/bQHGIJMGv.js IP199.59.243.226:80
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (33926) Hash54285d7f26ed4bc84ba79113426dcecb 17dc89efec5df34a280459ffc0e27cb8467045ab b0754afe500a24201f740ed9c023d64483ca9183fa6361d759bb329462d25344
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /bQHGIJMGv.js HTTP/1.1
Host: ww25.lyxynyx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/
Cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Fri, 19 Jul 2024 23:11:51 GMT
content-type: application/javascript; charset=utf-8
content-length: 33929
x-request-id: 539a633d-673a-477a-b714-a0573e109735
set-cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a; expires=Fri, 19 Jul 2024 23:26:52 GMT
|
|
| ww25.lyxynyx.com/_fd?subid1=20240720-0448-0676-afa1-9f7723457794/ | 199.59.243.226 | 200 OK | 5.5 kB |
URL POST HTTP/1.1ww25.lyxynyx.com/_fd?subid1=20240720-0448-0676-afa1-9f7723457794/ IP199.59.243.226:80
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/
File typeASCII text, with very long lines (5541), with no line terminators Hash7ebcffca54f540be6c27c6a868869904 6609fbc3dfce07fde19f93a40ecb9350659bc654 73c3e4beefdf2a4181c7323008c4324ff359ca98f2129a0bfccc2c6daed037c6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /_fd?subid1=20240720-0448-0676-afa1-9f7723457794/ HTTP/1.1
Host: ww25.lyxynyx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/
Content-Type: application/json
Origin: http://ww25.lyxynyx.com
DNT: 1
Connection: keep-alive
Cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/1.1 200 OK
date: Fri, 19 Jul 2024 23:11:51 GMT
content-type: application/json; charset=utf-8
content-length: 5541
x-request-id: c561d1fa-8e05-40d2-9fd7-7b63a6f26376
set-cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a; expires=Fri, 19 Jul 2024 23:26:52 GMT
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 471 B |
IP216.58.207.195:0
Hash8869c15d7f868a58c18acd816802a6cb 6f24a9679f4f027b8768f26917c8e8e462cd877b 5ee71038b31ec4a0b530c7f869a2ab570c0a5df9e741c56f6449d4cc102b7c84
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 472 B |
IP216.58.207.195:0
Hashf2fccb975dcee041ef42f47a6e52902f 39a6e8ff68b471db2789a0b273175cbdce3ccc4e eb2fb4d7c83d11c110e9bc26002c9eb0353e03f3da61d9fa23aaa11676175297
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 472 B |
IP216.58.207.195:0
Hash1ee5acfa7efec45bb71d03ff6d5664be af0e8b1339064f5d4b5da5cdb9d989b85912dd9a 4935f36a8c34a17a4fff5f0be336de00f2f010a8d9ea643fe988a376ff619486
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol323%2Cpid-bodis-gcontrol492%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol202&client=dp-bodis30_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.lyxynyx.com%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20240720-0448-0676-afa1-9f7723457794%252F&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3&nocache=1571721430712681&num=0&output=afd_ads&domain_name=ww25.lyxynyx.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1721430712683&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww25.lyxynyx.com%2Flogin.php%3Fsubid1%3D20240720-0448-0676-afa1-9f7723457794%2F | 216.58.207.206 | 200 OK | 2.6 kB |
URL GET HTTP/2syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol323%2Cpid-bodis-gcontrol492%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol202&client=dp-bodis30_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.lyxynyx.com%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20240720-0448-0676-afa1-9f7723457794%252F&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3&nocache=1571721430712681&num=0&output=afd_ads&domain_name=ww25.lyxynyx.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1721430712683&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww25.lyxynyx.com%2Flogin.php%3Fsubid1%3D20240720-0448-0676-afa1-9f7723457794%2F IP216.58.207.206:443
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintC4:40:78:7E:BF:F4:0A:6A:4C:F0:04:5E:14:5D:12:24:2E:CB:6A:56 ValidityMon, 24 Jun 2024 07:54:13 GMT - Mon, 16 Sep 2024 07:54:12 GMT
File typeHTML document, ASCII text, with very long lines (13236) Hash453c21139d9e3808f93b448d5cb7f37f 449a3ba5c39f32ed200138fa85770d284eaa5857 a6f3c1fd8a090121f998e7f780a4f007146c5238ca7631bd8ba77489deb13a10
GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol323%2Cpid-bodis-gcontrol492%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol202&client=dp-bodis30_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.lyxynyx.com%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20240720-0448-0676-afa1-9f7723457794%252F&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3&nocache=1571721430712681&num=0&output=afd_ads&domain_name=ww25.lyxynyx.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1721430712683&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww25.lyxynyx.com%2Flogin.php%3Fsubid1%3D20240720-0448-0676-afa1-9f7723457794%2F HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.lyxynyx.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Fri, 19 Jul 2024 23:11:52 GMT
expires: Fri, 19 Jul 2024 23:11:52 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-VOkNdy4k4urol2dhSHF3bw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2601
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 472 B |
IP216.58.207.195:0
Hash1ee5acfa7efec45bb71d03ff6d5664be af0e8b1339064f5d4b5da5cdb9d989b85912dd9a 4935f36a8c34a17a4fff5f0be336de00f2f010a8d9ea643fe988a376ff619486
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| syndicatedsearch.goog/adsense/domains/caf.js | 216.58.207.206 | | 77 kB |
URL syndicatedsearch.goog/adsense/domains/caf.js IP216.58.207.206:0
CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintC4:40:78:7E:BF:F4:0A:6A:4C:F0:04:5E:14:5D:12:24:2E:CB:6A:56 ValidityMon, 24 Jun 2024 07:54:13 GMT - Mon, 16 Sep 2024 07:54:12 GMT
File typegzip compressed data, max compression Hashad4f631a74b0dd38722324c4066160bb 423cf3b90d50a95c24ec0ed640c0f496e84cea7b 312d552f1aa14f27c54bf9602d8337fb79411018c707723a9eeebfed20656a48
GET /adsense/domains/caf.js HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Fri, 19 Jul 2024 23:11:52 GMT
expires: Fri, 19 Jul 2024 23:11:52 GMT
cache-control: private, max-age=3600
etag: "6012556954601310416"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 471 B |
IP216.58.207.195:0
Hash73211a4bf0a6ba99cfe928c28b2316a5 567810246b185042f4f8ee1c2231b6186a1e4340 662a7518b008db1cc47cf4ccf4ea72e5efe505db961d0d5fcbfd1e9c3e441b23
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 471 B |
IP216.58.207.195:0
Hash73211a4bf0a6ba99cfe928c28b2316a5 567810246b185042f4f8ee1c2231b6186a1e4340 662a7518b008db1cc47cf4ccf4ea72e5efe505db961d0d5fcbfd1e9c3e441b23
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b | 142.250.74.97 | | 174 B |
URL afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b IP142.250.74.97:0
File typeSVG Scalable Vector Graphics image Hashd47125b2ba92be53dcff07ba322ce1de e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28 5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 19 Jul 2024 10:01:22 GMT
expires: Sat, 20 Jul 2024 09:01:22 GMT
cache-control: public, max-age=82800
age: 47431
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff | 142.250.74.97 | 200 OK | 278 B |
URL GET HTTP/2afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff IP142.250.74.97:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol323%2Cpid-bodis-gcontrol492%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol202&client=dp-bodis30_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.lyxynyx.com%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20240720-0448-0676-afa1-9f7723457794%252F&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266&format=r3&nocache=1571721430712681&num=0&output=afd_ads&domain_name=ww25.lyxynyx.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1721430712683&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww25.lyxynyx.com%2Flogin.php%3Fsubid1%3D20240720-0448-0676-afa1-9f7723457794%2F CertificateIssuerGoogle Trust Services Subject*.googleusercontent.com Fingerprint7C:4C:89:9D:C0:52:5F:36:7E:51:89:B8:F3:71:B4:81:B3:DF:6F:73 ValidityMon, 24 Jun 2024 07:37:56 GMT - Mon, 16 Sep 2024 07:37:55 GMT
File typeSVG Scalable Vector Graphics image Hashfe7dd8c3c629cc6e9cd6d3e4d3cbe905 59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18 5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e
GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 19 Jul 2024 20:53:23 GMT
expires: Sat, 20 Jul 2024 19:53:23 GMT
cache-control: public, max-age=82800
age: 8310
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| o.pki.goog/wr2 | 216.58.207.195 | | 471 B |
IP216.58.207.195:0
Hash73211a4bf0a6ba99cfe928c28b2316a5 567810246b185042f4f8ee1c2231b6186a1e4340 662a7518b008db1cc47cf4ccf4ea72e5efe505db961d0d5fcbfd1e9c3e441b23
POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 19 Jul 2024 23:11:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.google.com/adsense/domains/caf.js?abp=1&bodis=true | 142.250.74.132 | 200 OK | 78 kB |
URL GET HTTP/2www.google.com/adsense/domains/caf.js?abp=1&bodis=true IP142.250.74.132:443
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ CertificateIssuerGoogle Trust Services Subjectwww.google.com Fingerprint8C:C2:35:30:95:5A:AF:BF:64:28:C5:B3:AD:C4:92:7D:9F:BF:E7:DA ValidityMon, 24 Jun 2024 07:42:34 GMT - Mon, 16 Sep 2024 07:42:33 GMT
File typegzip compressed data, max compression Hashfb2e614c3039ab697a138339a7b73586 53dce2ed4389e4fcf8289752d371f43ae7f54c03 8b7122d0c15edc1a829305d89cfe0e499f1fe0df9c8310580dda3ecb104a17dc
GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.lyxynyx.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Fri, 19 Jul 2024 23:11:52 GMT
expires: Fri, 19 Jul 2024 23:11:52 GMT
cache-control: private, max-age=3600
etag: "330119473028373510"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash1543efa0b06a3c4484d059961f9cf2d0 1aef10797a9524ff91b70e87f41e935a2dbf1917 a8fc1fb00fc3ee458f9a31d619be4cc4a9e7263f980deb8323a5a6ba69c03f8d
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A8FC1FB00FC3EE458F9A31D619BE4CC4A9E7263F980DEB8323A5A6BA69C03F8D"
Last-Modified: Thu, 18 Jul 2024 07:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8281
Expires: Sat, 20 Jul 2024 01:29:54 GMT
Date: Fri, 19 Jul 2024 23:11:53 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash1543efa0b06a3c4484d059961f9cf2d0 1aef10797a9524ff91b70e87f41e935a2dbf1917 a8fc1fb00fc3ee458f9a31d619be4cc4a9e7263f980deb8323a5a6ba69c03f8d
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A8FC1FB00FC3EE458F9A31D619BE4CC4A9E7263F980DEB8323A5A6BA69C03F8D"
Last-Modified: Thu, 18 Jul 2024 07:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8281
Expires: Sat, 20 Jul 2024 01:29:54 GMT
Date: Fri, 19 Jul 2024 23:11:53 GMT
Connection: keep-alive
|
|
| syndicatedsearch.goog/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=yrj0z46f95km&aqid=uPKaZsPeMIePxdwP6dmUuAg&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=652824369&csala=5%7C0%7C268%7C67%7C11&lle=0&ifv=1&hpt=0 | 216.58.207.206 | 204 No Content | 0 B |
URL GET HTTP/3syndicatedsearch.goog/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=yrj0z46f95km&aqid=uPKaZsPeMIePxdwP6dmUuAg&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=652824369&csala=5%7C0%7C268%7C67%7C11&lle=0&ifv=1&hpt=0 IP216.58.207.206:443
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintC4:40:78:7E:BF:F4:0A:6A:4C:F0:04:5E:14:5D:12:24:2E:CB:6A:56 ValidityMon, 24 Jun 2024 07:54:13 GMT - Mon, 16 Sep 2024 07:54:12 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=yrj0z46f95km&aqid=uPKaZsPeMIePxdwP6dmUuAg&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=652824369&csala=5%7C0%7C268%7C67%7C11&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.lyxynyx.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-kvjgeEh-hRcXL-spx6_F9Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Fri, 19 Jul 2024 23:11:54 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| syndicatedsearch.goog/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=iadyfv8wynh&aqid=uPKaZsPeMIePxdwP6dmUuAg&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=652824369&csala=5%7C0%7C268%7C67%7C11&lle=0&ifv=1&hpt=0 | 216.58.207.206 | 204 No Content | 0 B |
URL GET HTTP/3syndicatedsearch.goog/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=iadyfv8wynh&aqid=uPKaZsPeMIePxdwP6dmUuAg&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=652824369&csala=5%7C0%7C268%7C67%7C11&lle=0&ifv=1&hpt=0 IP216.58.207.206:443
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/ CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintC4:40:78:7E:BF:F4:0A:6A:4C:F0:04:5E:14:5D:12:24:2E:CB:6A:56 ValidityMon, 24 Jun 2024 07:54:13 GMT - Mon, 16 Sep 2024 07:54:12 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=iadyfv8wynh&aqid=uPKaZsPeMIePxdwP6dmUuAg&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=652824369&csala=5%7C0%7C268%7C67%7C11&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.lyxynyx.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-sn9kGbGXOVz06iOm98MJdA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Fri, 19 Jul 2024 23:11:55 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| ww25.lyxynyx.com/_tr | 199.59.243.226 | 200 OK | 2 B |
IP199.59.243.226:80
Requested byhttp://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/
File typeASCII text, with no line terminators Hash444bcb3a3fcf8389296c49467f27e1d6 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /_tr HTTP/1.1
Host: ww25.lyxynyx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.lyxynyx.com/login.php?subid1=20240720-0448-0676-afa1-9f7723457794/
Content-Type: application/json
Content-Length: 1873
Origin: http://ww25.lyxynyx.com
DNT: 1
Connection: keep-alive
Cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Fri, 19 Jul 2024 23:11:52 GMT
content-type: application/json; charset=utf-8
content-length: 2
x-request-id: becfe758-aec5-4294-929b-94150fc4c6ab
set-cookie: parking_session=4d542722-aeba-4333-808f-004893cb1c2a; expires=Fri, 19 Jul 2024 23:26:53 GMT
|
|