Report - lygygin.com/WMeSZ/login.php/

Report Overview

Submitted URL
lygygin.com/WMeSZ/login.php/
IP
45.33.2.79
ASN
#63949 Linode, LLC
Submitted
2023-06-01 05:31:07
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
36

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www1.lygygin.com	unknown	2022-06-10	2023-04-26	2023-05-31	2.3 kB	8.3 kB	76.223.26.96
www.google.com	7	1997-09-15	2015-05-10	2023-05-29	2.3 kB	114 kB	142.250.74.164
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-05-31	1.7 kB	3.5 kB	142.250.74.3
d38psrni17bvxu.cloudfront.net	unknown	2008-04-25	2022-09-22	2023-05-31	398 B	12 kB	54.230.245.8
afs.googleusercontent.com	12123	2008-11-17	2013-05-06	2023-05-31	969 B	2.2 kB	142.250.74.97
lygygin.com	unknown	2022-06-10	2012-10-12	2023-05-31	2.4 kB	2.0 kB	45.56.79.23

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com

Quad9 DNS

Scan Date	Severity	Indicator
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com
2023-06-01	medium	lygygin.com

ThreatFox

No alerts detected

JavaScript (14)

	URL	Size	First Seen	Last Seen
	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	968 B	2023-03-08	2024-05-10
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 02:24:08 Last Seen2024-05-10 23:39:39 Times Seen27998 Hash c77554570ae0fa8e4fb31747dc213058 e989fbde07e6a68975c7a31e1d4df76afd90b96f c3f831fe1717c6d76a8950ac5e7dc88ceee7440d079b11584be5c6c5b3269e77 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	719 B	2023-06-01	2023-06-01
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:31:08 Last Seen2023-06-01 07:31:08 Times Seen1 Hash 6dd46de827c7485953079deddaed9e85 b2b6ddef49e76c326670e37acd48e822325c3294 defb81c856a07767229e83035a907bf1d79d9cd8b39c092e52f51031ea0dbfd9 Loading...

	www.google.com/adsense/domains/caf.js	148 kB	2023-05-31	2023-06-06
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-31 17:27:37 Last Seen2023-06-06 13:33:54 Times Seen256 Hash 390ffa6c29ad2e97f916f0ee300c5f3c 796406f1e6ae1c3db2bf37830b62a8a9f1eb44e7 4c0c0c586720f480f2ca2d72cd095e3ae7acb17195a22238723e4744ca68f95f Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	246 B	2023-06-01	2023-06-01
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:31:08 Last Seen2023-06-01 07:31:08 Times Seen1 Hash bec72921c2c9533aea909a9c629ad4ce dbd446d33855b338e69c1986cfa973c47850599a 69685f193e06dbdac7c157dd79afcd4ede163cda121808f57ea18d57c4ccd6dd Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	7.0 kB	2023-03-13	2024-01-03
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 06:10:31 Last Seen2024-01-03 14:22:39 Times Seen25920 Hash 04b2b624f94797c26d17a57f399d9356 3143986e839c47a5c1eff03bd9df63ecc54dca9c 233b1cbfb295a0629bcf68a2a4198a62132f02ee1f061ada2ce7143bd5d2dabb Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	1.2 kB	2023-06-01	2023-06-01
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:31:08 Last Seen2023-06-01 07:31:08 Times Seen1 Hash 55c44be2630112880862fb8adbd60376 4be34aba5a3aaa45bd646007d06a185eb97aa387 da5a05f81693edc07a962384065b9b5af2d58754afe5820adfde8a64416a2473 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	29 B	2023-03-12	2024-01-03
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 12:56:36 Last Seen2024-01-03 12:53:29 Times Seen10974 Hash 5405126a58d646a09ad6d154c5d3a335 9e64f2a4ee55fef112fbd9654e76e8eabb751e28 76229fdaf8e9553878811c30cf5305bd2dab82248d0054d3fb2e760b35f32154 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	65 B	2023-04-26	2023-06-14
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-26 08:12:50 Last Seen2023-06-14 17:03:12 Times Seen3080 Hash 88509ad33225897bf131e892ee5c9f35 0f2aa7edc79aad77334a6d25e193d9d63f546bec c74f823d97f995f1209cb84aeed9653cca3b2f90c308d9dff3e135250c6c8974 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	472 B	2023-03-13	2024-01-03
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 06:13:46 Last Seen2024-01-03 14:22:39 Times Seen25251 Hash d31eefc1e54bdae9204297e4ae5b9cce fc49bf319586a623670a81c01d43bbd93b477fbb 2683a6247a15433dd269eaefbc7131b1326c7bc0146361913ea10ad8fa23bb14 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	669 B	2023-06-01	2023-06-01
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:31:08 Last Seen2023-06-01 07:31:08 Times Seen1 Hash 71d67ad04303bdbe9f4bcdc35550136f 4e3d61926d4c175f6438869c77ddc4032775707c b34446a03b9e8c55fd3eb1997219dc0f9a2b8a854eec470eaa6632d7767b1146 Loading...

	www.google.com/adsense/domains/caf.js?abp=1	148 kB	2023-05-27	2023-06-01
Pretty URL www.google.com/adsense/domains/caf.js?abp=1 IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-27 08:21:46 Last Seen2023-06-01 07:31:08 Times Seen36 Hash 6055d0ed5594c816be23b01586d11898 a915acbbd7fd6bf5bef07e1b097db8ac8c8cf0f5 51b466725732957cd3c6f173568694987da708cea2d47d5a7f16803b898290b9 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	40 B	2023-04-18	2023-06-27
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-18 09:10:37 Last Seen2023-06-27 14:44:07 Times Seen10821 Hash bcdb5f35f5da29644017c63a72a72921 5bd1c81154b546c01c88b02fdb29b687f0c9cef3 a71d2bc0274b66fc2cb2c8daf1bf8b8a6a4cbfd5bd1e30574e9abb61aa9c3983 Loading...

	www1.lygygin.com/?tm=1&subid4=1685597450.0201200000	71 B	2023-03-08	2024-01-04
Pretty URL www1.lygygin.com/?tm=1&subid4=1685597450.0201200000 IP 76.223.26.96 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 02:23:53 Last Seen2024-01-04 08:38:22 Times Seen25410 Hash 1a5a5e1b6a26f57b95e3dd42f60612f4 b62a27e55a59b49084e682bd3c1588f6a40881ab 4066da16910907c7962da8e7011bf0cd62b6f2dcddb1911e3ea2de03ce3e1dc7 Loading...

	www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530	2.0 kB	2023-06-01	2023-06-01
Pretty URL www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530 IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-01 07:31:08 Last Seen2023-06-01 07:31:08 Times Seen1 Hash 13eaa75a6601874121157e14343ccca7 5984e560530a2b6508e2704ff9a0925afa8aef65 c04cd06a7d3fa025eeb52d19a889d7ccbc4539d6f218ea2f502d4ddb87ff2424 Loading...

HTTP Transactions (20)

URL IP Response Size

lygygin.com/WMeSZ/login.php/

45.56.79.23

0 B

URL
lygygin.com/WMeSZ/login.php/
IP
45.56.79.23:0
ASN
#63949 Linode, LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /WMeSZ/login.php/ HTTP/1.1
Host: lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
content-length: 0
location: http://lygygin.com/WMeSZ/login.php/
cache-control: no-cache
set-cookie: mtmssl=1; path=/;

lygygin.com/WMeSZ/login.php/

96.126.123.244

561 B

URL
lygygin.com/WMeSZ/login.php/
IP
96.126.123.244:0
ASN
#63949 Linode, LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (333)
Size
561 B (561 bytes)
Hash
61b3707917eeb60ea3f6bc82631062f2
8bb6b4e60a4d3cba0dbc5b1f0c276299feb48c6c
9704fe572f52ca493530006f847edc731ddd79ada81c5528f2864ca3ada42594

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /WMeSZ/login.php/ HTTP/1.1
Host: lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: mtmssl=1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 05:30:50 GMT
content-type: text/html
transfer-encoding: chunked
content-encoding: gzip
connection: close

lygygin.com/WMeSZ/login.php?gp=1&js=1&uuid=1685597450.0098564899&other_args=eyJ1cmkiOiAiL1dNZVNaL2xvZ2luLnBocCIsICJhcmdzIjogIiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2UvYXZpZixpbWFnZS93ZWJwLCovKjtxPTAuOCJ9

45.56.79.23

302 Found

0 B

URL User Request GET HTTP/1.1
lygygin.com/WMeSZ/login.php?gp=1&js=1&uuid=1685597450.0098564899&other_args=eyJ1cmkiOiAiL1dNZVNaL2xvZ2luLnBocCIsICJhcmdzIjogIiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2UvYXZpZixpbWFnZS93ZWJwLCovKjtxPTAuOCJ9
IP
45.56.79.23:80
ASN
#63949 Linode, LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /WMeSZ/login.php?gp=1&js=1&uuid=1685597450.0098564899&other_args=eyJ1cmkiOiAiL1dNZVNaL2xvZ2luLnBocCIsICJhcmdzIjogIiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2UvYXZpZixpbWFnZS93ZWJwLCovKjtxPTAuOCJ9 HTTP/1.1
Host: lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://lygygin.com/WMeSZ/login.php/
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Cookie: mtmssl=1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
content-length: 0
location: http://lygygin.com/WMeSZ/login.php?gp=1&js=1&uuid=1685597450.0098564899&other_args=eyJ1cmkiOiAiL1dNZVNaL2xvZ2luLnBocCIsICJhcmdzIjogIiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2UvYXZpZixpbWFnZS93ZWJwLCovKjtxPTAuOCJ9
cache-control: no-cache
set-cookie: mtmssl=1; path=/;

45.33.18.44

302 Found

0 B

URL User Request GET HTTP/1.1
lygygin.com/WMeSZ/login.php?gp=1&js=1&uuid=1685597450.0098564899&other_args=eyJ1cmkiOiAiL1dNZVNaL2xvZ2luLnBocCIsICJhcmdzIjogIiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2UvYXZpZixpbWFnZS93ZWJwLCovKjtxPTAuOCJ9
IP
45.33.18.44:80
ASN
#63949 Linode, LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /WMeSZ/login.php?gp=1&js=1&uuid=1685597450.0098564899&other_args=eyJ1cmkiOiAiL1dNZVNaL2xvZ2luLnBocCIsICJhcmdzIjogIiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2UvYXZpZixpbWFnZS93ZWJwLCovKjtxPTAuOCJ9 HTTP/1.1
Host: lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lygygin.com/
DNT: 1
Connection: keep-alive
Cookie: mtmssl=1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 05:30:50 GMT
content-type: text/html; charset=utf-8
content-length: 0
location: http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
referrer-policy: no-referrer
x-mtm-path: 4
x-mtm-prov: 552:0.08;558:0.00
x-mtm-rd: 0.88
vary: Accept-Language
content-language: en
set-cookie: mtm_delivered=WyJseWd5Z2luLmNvbSIsImh0dHA6Ly93d3cxLmx5Z3lnaW4uY29tLz90bT0xJnN1YmlkND0xNjg1NTk3NDUwLjAyMDEyMDAwMDAiLDEsIjIwMjMtMDYtMDEgMDU6MzA6NTAiLDEsIjE2ODU1OTc0NTAuMDIwMTIwMDAwMCIsNTUyLG51bGwsbnVsbF0:1q4ate:akhLKgH02ZneLSs2bdd09Ho7PCA; expires=Thu, 01-Jun-2023 06:30:50 GMT; Max-Age=3600; Path=/
connection: close

www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

76.223.26.96

200 OK

5.6 kB

URL User Request GET HTTP/1.1
www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
IP
76.223.26.96:80
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1296)
Size
5.6 kB (5601 bytes)
Hash
81c97bd9c4ed38b2e2ef050b97774d8a
9cba5533e0f5e486f8b330c0d4aba814438dee4e
9caf1d0ab30e61c8855931a4d532a4097b274c48c27a9d87b3584271598669e2

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /?tm=1&subid4=1685597450.0201200000 HTTP/1.1
Host: www1.lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 05:30:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Buckets: bucket103
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_dqcW5qHGAcQwv9SVsFT+m8kuGNEyZTQiCa5iOvFBcMcq8JmH2FSBC1u6FbM1/KQSpWqnKKnNShKpvQPzuI18lg==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: lygygin.com
X-Subdomain: www1
Content-Encoding: gzip

www.google.com/adsense/domains/caf.js?abp=1

142.250.74.164

200 OK

54 kB

URL GET HTTP/1.1
www.google.com/adsense/domains/caf.js?abp=1
IP
142.250.74.164:80
ASN
#15169 GOOGLE

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

File type
ASCII text, with very long lines (2125)
Size
54 kB (53795 bytes)
Hash
6055d0ed5594c816be23b01586d11898
a915acbbd7fd6bf5bef07e1b097db8ac8c8cf0f5
51b466725732957cd3c6f173568694987da708cea2d47d5a7f16803b898290b9

HTTP Headers

GET /adsense/domains/caf.js?abp=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Thu, 01 Jun 2023 05:30:51 GMT
Expires: Thu, 01 Jun 2023 05:30:51 GMT
Cache-Control: private, max-age=3600
ETag: "13216162555417830531"
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0

www1.lygygin.com/track.php?domain=lygygin.com&toggle=browserjs&uid=MTY4NTU5NzQ1MS4yNTU2OmFiZTQ2ZGJmNjg0NDI0ZTdhYzc0ZDYzYzdhNDc1Mzg5YmM2ODJjZDk1Nzk5NmRhMzUxM2I2NDFiYTkxNzM4ZmY6NjQ3ODJkMGIzZTY1NA%3D%3D

76.223.26.96

200 OK

20 B

URL GET HTTP/1.1
www1.lygygin.com/track.php?domain=lygygin.com&toggle=browserjs&uid=MTY4NTU5NzQ1MS4yNTU2OmFiZTQ2ZGJmNjg0NDI0ZTdhYzc0ZDYzYzdhNDc1Mzg5YmM2ODJjZDk1Nzk5NmRhMzUxM2I2NDFiYTkxNzM4ZmY6NjQ3ODJkMGIzZTY1NA%3D%3D
IP
76.223.26.96:80
ASN
#16509 AMAZON-02

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

File type
gzip compressed data, max speed, from Unix\012- data
Size
20 B (20 bytes)
Hash
a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /track.php?domain=lygygin.com&toggle=browserjs&uid=MTY4NTU5NzQ1MS4yNTU2OmFiZTQ2ZGJmNjg0NDI0ZTdhYzc0ZDYzYzdhNDc1Mzg5YmM2ODJjZDk1Nzk5NmRhMzUxM2I2NDFiYTkxNzM4ZmY6NjQ3ODJkMGIzZTY1NA%3D%3D HTTP/1.1
Host: www1.lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 05:30:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.3

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
2e49fbb441f0fbebc6ce31ee4abd5600
f586dcfb316f20902e5b479d482f91138efafa28
8fda5c8ae8be7dd24164ca2cf2ea3f0b7271c4735a653e972f69dea503bc24ba

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 05:30:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png

54.230.245.8

200 OK

11 kB

URL GET HTTP/1.1
d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
IP
54.230.245.8:80
ASN
#16509 AMAZON-02

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

File type
PNG image data, 1500 x 600, 8-bit colormap, non-interlaced\012- data
Size
11 kB (11375 bytes)
Hash
0cb2e5165dc9324eb462199f04e1ffa9
9e0f89847ec8a98d98a6020bc5c4ed32b7a48bf8
67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865

HTTP Headers

GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 11375
Connection: keep-alive
Server: nginx
Date: Thu, 01 Jun 2023 01:25:02 GMT
Last-Modified: Thu, 23 Jun 2022 10:44:43 GMT
Accept-Ranges: bytes
ETag: "62b4441b-2c6f"
X-Cache: Hit from cloudfront
Via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Dw7nOfXnRGtOdXhYyeVujmlqHQSKMdo4DTakYkJL3IpNtlETz9krew==
Age: 14749

www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530

142.250.74.164

200 OK

3.4 kB

URL GET HTTP/2
www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint48:E3:15:66:FC:EA:15:BF:D2:34:C1:DD:60:D4:23:A3:63:57:89:8D
ValidityMon, 08 May 2023 08:25:18 GMT - Mon, 31 Jul 2023 08:25:17 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (15117)
Size
3.4 kB (3357 bytes)
Hash
fd30d6e7ddbde887903faf17f4b0f7f8
c273aa451495bd16898888634a3b6a9f83717752
fb8ff5b3826aca178b433411a31207d0437f380df367dc2e527b3c6fc35349d4

HTTP Headers

GET /afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Thu, 01 Jun 2023 05:30:51 GMT
expires: Thu, 01 Jun 2023 05:30:51 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-nBd9qnmxpvF_Z8GrAk87iw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 3357
x-xss-protection: 0
set-cookie: NID=511=TWuXvtm0qnDVkmEf5UpkjbOaz2l18EuzZHTTSan3rSQNDR4ANn8Ww6naVEhJ3E6ivx3WgghvqRsosr2zp4-tejX6QnqcCCHLLhztdy4WiVtzGj353uAlr2oKnW6ZRQDmy5ur58xJzGu7dwmhiAwZ5syT0OGY0zM63rWXM1L3KLY; expires=Fri, 01-Dec-2023 05:30:51 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+042; expires=Sat, 31-May-2025 05:30:51 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www1.lygygin.com/favicon.ico

13.248.148.254

200 OK

0 B

URL GET HTTP/1.1
www1.lygygin.com/favicon.ico
IP
13.248.148.254:80
ASN
#16509 AMAZON-02

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www1.lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 05:30:51 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.3

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
aaa62c1792576f29afd83c721c769ae2
a91969d4ec40a18844781b9364d60e9ae0cb1b52
3ef969ba686248b09252da03a2effad7d8e09e7192ae1daa6e3b8d0240405c43

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 05:30:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www1.lygygin.com/ls.php?t=64782d0b&token=1e414badabd6e4be372c854bc75ae196429e6d7e

76.223.26.96

201 Created

16 B

URL GET HTTP/1.1
www1.lygygin.com/ls.php?t=64782d0b&token=1e414badabd6e4be372c854bc75ae196429e6d7e
IP
76.223.26.96:80
ASN
#16509 AMAZON-02

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

File type
JSON data\012- , ASCII text, with no line terminators
Size
16 B (16 bytes)
Hash
7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /ls.php?t=64782d0b&token=1e414badabd6e4be372c854bc75ae196429e6d7e HTTP/1.1
Host: www1.lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Thu, 01 Jun 2023 05:30:51 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 64782d0b678fd366dd05c3e6
Charset: utf-8
Access-Control-Allow-Origin: 
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_MZZIT8GzaKUeaW4PDCGAIX0u6PuNx03+WGlrpxqoNMz2EaodlUL+QT9hkQWI4A68hBkZ9WpejfSFQR2XyWLODQ==

ocsp.pki.goog/gts1c3

142.250.74.3

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4f25832062da8d4729b5be811b75be0a
d6e10effb5d9ce1bf56524ff0bbb3d5891fb522d
c526adeedcb442f61f4303bd5a219fb6ef6132d18dfdb4ae5f4f09400852156e

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 05:30:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.3

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4f25832062da8d4729b5be811b75be0a
d6e10effb5d9ce1bf56524ff0bbb3d5891fb522d
c526adeedcb442f61f4303bd5a219fb6ef6132d18dfdb4ae5f4f09400852156e

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 05:30:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/adsense/domains/caf.js

142.250.74.164

200 OK

54 kB

URL GET HTTP/3
www.google.com/adsense/domains/caf.js
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:BA:19:A5:81:25:05:32:72:13:A7:18:CF:67:8C:D6:6F:13:B3:EF
ValidityMon, 08 May 2023 08:20:09 GMT - Mon, 31 Jul 2023 08:20:08 GMT

File type
ASCII text, with very long lines (2125)
Size
54 kB (54248 bytes)
Hash
a5a849a82d57291eea539c8680f19ff8
b50a24b6bda406af463c1651e98a9446dd1ae65f
f76356b43dbaa7228f682b686e973d3166df6401f91a5a8f98d0528eda680c44

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 01 Jun 2023 05:30:51 GMT
expires: Thu, 01 Jun 2023 05:30:51 GMT
cache-control: private, max-age=3600
etag: "2077905634364099467"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff

142.250.74.97

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE9:43:A2:2D:EB:A2:E1:09:B0:36:19:CF:E3:9C:F0:37:52:4F:DB:7A
ValidityMon, 08 May 2023 08:24:36 GMT - Mon, 31 Jul 2023 08:24:35 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
174 B (174 bytes)
Hash
11b3089d616633ca6b73b57aa877eeb4
07632f63e06b30d9b63c97177d3a8122629bda9b
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Wed, 31 May 2023 14:43:07 GMT
expires: Thu, 01 Jun 2023 13:43:07 GMT
cache-control: public, max-age=82800
age: 53264
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www1.lygygin.com/track.php?domain=lygygin.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTU5NzQ1MS4yNTU2OmFiZTQ2ZGJmNjg0NDI0ZTdhYzc0ZDYzYzdhNDc1Mzg5YmM2ODJjZDk1Nzk5NmRhMzUxM2I2NDFiYTkxNzM4ZmY6NjQ3ODJkMGIzZTY1NA%3D%3D

13.248.148.254

200 OK

20 B

URL GET HTTP/1.1
www1.lygygin.com/track.php?domain=lygygin.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTU5NzQ1MS4yNTU2OmFiZTQ2ZGJmNjg0NDI0ZTdhYzc0ZDYzYzdhNDc1Mzg5YmM2ODJjZDk1Nzk5NmRhMzUxM2I2NDFiYTkxNzM4ZmY6NjQ3ODJkMGIzZTY1NA%3D%3D
IP
13.248.148.254:80
ASN
#16509 AMAZON-02

Requested by
http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000

File type
gzip compressed data, max speed, from Unix\012- data
Size
20 B (20 bytes)
Hash
a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

GET /track.php?domain=lygygin.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTU5NzQ1MS4yNTU2OmFiZTQ2ZGJmNjg0NDI0ZTdhYzc0ZDYzYzdhNDc1Mzg5YmM2ODJjZDk1Nzk5NmRhMzUxM2I2NDFiYTkxNzM4ZmY6NjQ3ODJkMGIzZTY1NA%3D%3D HTTP/1.1
Host: www1.lygygin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www1.lygygin.com/?tm=1&subid4=1685597450.0201200000
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 05:30:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: answercheck
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.3

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4f25832062da8d4729b5be811b75be0a
d6e10effb5d9ce1bf56524ff0bbb3d5891fb522d
c526adeedcb442f61f4303bd5a219fb6ef6132d18dfdb4ae5f4f09400852156e

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 01 Jun 2023 05:30:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff

142.250.74.97

200 OK

391 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=8676772880&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fwww1.lygygin.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2NDc4MmQwYjNlNjNlfHx8MTY4NTU5NzQ1MS4yNjE0fDY5NGNmMGI0ZmFhNTliZGYyMjRkODIwNWNlYmZmMWFhMTQ1YTRlZDB8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8ZXlKemRXSnBaRFFpT2lJeE5qZzFOVGszTkRVd0xqQXlNREV5TURBd01EQWlmUT09fDFlNDE0YmFkYWJkNmU0YmUzNzJjODU0YmM3NWFlMTk2NDI5ZTZkN2V8MHxkcC10ZWFtaW50ZXJuZXQwOV8zcGh8MHww&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2920222099909144&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301099%2C17301187%2C17301190&format=r3%7Cs&nocache=9621685597451073&num=0&output=afd_ads&domain_name=www1.lygygin.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1685597451074&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&cl=534159633&uio=--&cont=tc&jsid=caf&jsv=534159633&rurl=http%3A%2F%2Fwww1.lygygin.com%2F%3Ftm%3D1%26subid4%3D1685597450.0201200000&adbw=master-1%3A530
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE9:43:A2:2D:EB:A2:E1:09:B0:36:19:CF:E3:9C:F0:37:52:4F:DB:7A
ValidityMon, 08 May 2023 08:24:36 GMT - Mon, 31 Jul 2023 08:24:35 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (406), with no line terminators
Size
391 B (391 bytes)
Hash
249bb4c6a37dfa60d6ecf838cada5020
4e56099d13b015804f79d1182f66982bc6e4662b
a2cebc2af2fd29cbee1ed7860ef5b12088b85259918d8bf2f2aaa99b915fa3f4

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Thu, 01 Jun 2023 03:48:34 GMT
expires: Fri, 02 Jun 2023 02:48:34 GMT
cache-control: public, max-age=82800
age: 6137
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML