Report - ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Report Overview

URL

ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
IP

199.59.243.223

ASN

#16509 AMAZON-02
Submitted

2023-05-06T10:51:20Z

Access

public
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

8
Threat Detection Systems

17

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
ww25.uhxqin.biz (7)	unknown	2023-03-03 01:20:37	2023-05-06 06:00:00	3367	27990	199.59.243.223
ocsp.pki.goog (5)	175	2018-07-01 08:43:07	2023-05-06 05:09:10	1665	3499	142.250.74.131
www.google.com (4)	7	2015-05-10 13:11:19	2023-05-06 11:10:07	3122	66027	142.250.74.164
afs.googleusercontent.com (2)	12123	2013-05-06 21:11:00	2023-05-06 05:09:55	981	2094	142.250.74.97

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-05-06T10:51:05Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator
2023-05-06	medium	ww25.uhxqin.biz/js/parking.2.104.9.js
2023-05-06	medium	ww25.uhxqin.biz/_fd?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
2023-05-06	medium	ww25.uhxqin.biz/_tr

mnemonic secure dns

Scan Date	Severity	Indicator
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz

Quad9 DNS

Scan Date	Severity	Indicator
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz
2023-05-06	medium	uhxqin.biz

ThreatFox

No alerts detected

JavaScript (5)

HTTP Transactions (18)

URL IP Response Size

ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

199.59.243.223

200 OK

731

URL User Request GET HTTP/1.1

ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (975), with no line terminators

Size

731
Hash

5ad58d67ebda8e40d5d46e7aef9d5e2f

6d8a7fd9ec03790652dccde1dd8863473d55db18

de8fa7498df12726180b96008627d85db1a4d66255fe3bc63ab8316b0933c012

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Sat, 06 May 2023 10:51:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485; expires=Sat, 06-May-2023 11:06:03 GMT; Max-Age=900; path=/; HttpOnly
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Z+APs/JYG8Eq4lMbjjCkPs2lVqP7Bzonw0iQVFvxRH9/Olx9QVC28Ok8ZqLGGmlt2ZqRKQJEKtbtS+ZQbEmPAw==
Accept-CH: sec-ch-prefers-color-scheme
Critical-CH: sec-ch-prefers-color-scheme
Vary: sec-ch-prefers-color-scheme
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

ww25.uhxqin.biz/js/parking.2.104.9.js

199.59.243.223

200 OK

22161

URL GET HTTP/1.1

ww25.uhxqin.biz/js/parking.2.104.9.js
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Magic

HTML document, ASCII text, with very long lines (65536), with no line terminators

Size

22161
Hash

4373b6882998614499e168219b1e44ca

6591de3f6d18020cc8de3549f9a87115b44bea8b

e93edbb073fa2a6feedcdcec64b6d6b2f9e85b481f11ad8f5a66facac76cb101

Detections

Analyzer	Verdict	Alert
fortinet	Malware
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /js/parking.2.104.9.js HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Sat, 06 May 2023 10:51:03 GMT
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 03 May 2023 19:31:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

ww25.uhxqin.biz/_fd?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

199.59.243.223

200 OK

1855

URL POST HTTP/1.1

ww25.uhxqin.biz/_fd?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Magic

ASCII text, with very long lines (3673), with no line terminators

Size

1855
Hash

bd92a9720df0eef62f6eabcc5ae3f620

086894f4f70321c5ad4879d606fa1ada8653793b

ed483654e8a6861da259df831342545e6c51b917d8c58ea0bb79c8c10236ac17

Detections

Analyzer	Verdict	Alert
fortinet	Malware
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        POST /_fd?subid1=20230506-2022-2259-b6f8-72f38bd2b73e HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Content-Type: application/json
Origin: http://ww25.uhxqin.biz
DNT: 1
Connection: keep-alive
Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

                                        HTTP/1.1 200 OK
Server: openresty
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Sat, 06 May 2023 10:51:03 GMT
X-Version: 2.104.9
Set-Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485; expires=Sat, 06-May-2023 11:06:03 GMT; Max-Age=900; path=/; httponly
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

ww25.uhxqin.biz/px.gif?ch=1&rn=1.7123444339238083

199.59.243.223

200 OK

URL GET HTTP/1.1

ww25.uhxqin.biz/px.gif?ch=1&rn=1.7123444339238083
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Magic

GIF image data, version 89a, 1 x 1\012- data

Size

42
Hash

d89746888da2d9510b64a9f031eaecd5

d5fceb6532643d0d84ffe09c40c481ecdf59e15a

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /px.gif?ch=1&rn=1.7123444339238083 HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Sat, 06 May 2023 10:51:04 GMT
Content-Type: image/gif
Content-Length: 42
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Accept-Ranges: bytes

ww25.uhxqin.biz/px.gif?ch=2&rn=1.7123444339238083

199.59.243.223

200 OK

URL GET HTTP/1.1

ww25.uhxqin.biz/px.gif?ch=2&rn=1.7123444339238083
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Magic

GIF image data, version 89a, 1 x 1\012- data

Size

42
Hash

d89746888da2d9510b64a9f031eaecd5

d5fceb6532643d0d84ffe09c40c481ecdf59e15a

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /px.gif?ch=2&rn=1.7123444339238083 HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Sat, 06 May 2023 10:51:04 GMT
Content-Type: image/gif
Content-Length: 42
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

471

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

02ba75903f02c48b30395328fff9927e

43f817f355059ed03490ef1bab8ff0deffbfe744

53a5ffd09f760367667dd07ef2d98936e2e49d616ed75fcac4ccf1182c89ca0e

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 06 May 2023 10:51:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ww25.uhxqin.biz/favicon.ico

199.59.243.223

200 OK

URL GET HTTP/1.1

ww25.uhxqin.biz/favicon.ico
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Sat, 06 May 2023 10:51:04 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Connection: keep-alive
ETag: "61424bb6-0"
x-backend-server: ip-10-201-16-158.ec2.internal
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

472

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

bf34384a7fd9e62b9045178ff81864df

732744c22cd182dac8ab80666ef2d8985a47d3a9

89f580bee129d929f610dcbb61af775e59ebd60acf584cf274346ecf638816f5

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 06 May 2023 10:51:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/adsense/domains/caf.js

142.250.74.164

200 OK

55932

URL GET HTTP/3

www.google.com/adsense/domains/caf.js
IP

142.250.74.164:443
ASN

#15169 GOOGLE

Requested by

https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol443&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.uhxqin.biz%3Fcaf%26subid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300965%2C17301140%2C17301141%2C17301143&format=r3&nocache=2291683370266120&num=0&output=afd_ads&domain_name=ww25.uhxqin.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1683370266122&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=528505921&uio=-&cont=rs&jsid=caf&jsv=528505921&rurl=http%3A%2F%2Fww25.uhxqin.biz%2Fktqj%3Fsubid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&adbw=master-1%3A1264
Certificate

IssuerGoogle Trust Services LLC

Subject*.google.com

FingerprintA3:4E:A3:86:10:DA:6C:D1:8C:73:54:AB:E6:8F:7D:21:72:2C:B4:D5

ValidityMon, 17 Apr 2023 08:16:32 GMT - Mon, 10 Jul 2023 08:16:31 GMT

Magic

data

Size

55932
Hash

37e3c621f4e127fa8f3a81e2a32eb9fc

5a68a9a05989bb4878944a133370d14cc14751b7

b2c45519ea32043db36cdb18155ae0c2e7752b8bacea8e2a8c1d68bfcc22a156

HTTP Headers

                                        GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sat, 06 May 2023 10:51:04 GMT
expires: Sat, 06 May 2023 10:51:04 GMT
cache-control: private, max-age=3600
etag: "12546849343905531353"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

472

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

83dad3af2b1ee0e4ce48cc6b69d62a79

df5b55e2b188311fc398f0e7d08e34a924a9e9c2

5f89aa03d3930f0afe5e5bce6e90473130d26ff85a49e2e97d1c73504debca9e

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 06 May 2023 10:51:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

472

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

83dad3af2b1ee0e4ce48cc6b69d62a79

df5b55e2b188311fc398f0e7d08e34a924a9e9c2

5f89aa03d3930f0afe5e5bce6e90473130d26ff85a49e2e97d1c73504debca9e

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 06 May 2023 10:51:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b

142.250.74.97

200 OK

174

URL GET HTTP/2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
IP

142.250.74.97:443
ASN

#15169 GOOGLE

Requested by

https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol443&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.uhxqin.biz%3Fcaf%26subid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300965%2C17301140%2C17301141%2C17301143&format=r3&nocache=2291683370266120&num=0&output=afd_ads&domain_name=ww25.uhxqin.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1683370266122&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=528505921&uio=-&cont=rs&jsid=caf&jsv=528505921&rurl=http%3A%2F%2Fww25.uhxqin.biz%2Fktqj%3Fsubid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&adbw=master-1%3A1264
Certificate

IssuerGoogle Trust Services LLC

Subject*.googleusercontent.com

Fingerprint5B:7C:CC:9B:35:65:AF:5C:4A:0A:CA:A9:D5:41:DA:66:86:43:19:CD

ValidityMon, 17 Apr 2023 08:25:28 GMT - Mon, 10 Jul 2023 08:25:27 GMT

Magic

SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators

Size

174
Hash

76243f91f45c199f29a2f9764e77fa55

b1ed51f71738d78aac5092ac24184c51dd85bd6a

428f3f236ea430d0bd41a7766888b04a7445773ee4be7597944be1f53327ec96

HTTP Headers

                                        GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Sat, 06 May 2023 06:00:13 GMT
expires: Sun, 07 May 2023 05:00:13 GMT
cache-control: public, max-age=82800
age: 17451
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff

142.250.74.97

200 OK

278

URL GET HTTP/2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
IP

142.250.74.97:443
ASN

#15169 GOOGLE

Requested by

https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol443&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.uhxqin.biz%3Fcaf%26subid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300965%2C17301140%2C17301141%2C17301143&format=r3&nocache=2291683370266120&num=0&output=afd_ads&domain_name=ww25.uhxqin.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1683370266122&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=528505921&uio=-&cont=rs&jsid=caf&jsv=528505921&rurl=http%3A%2F%2Fww25.uhxqin.biz%2Fktqj%3Fsubid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&adbw=master-1%3A1264
Certificate

IssuerGoogle Trust Services LLC

Subject*.googleusercontent.com

Fingerprint5B:7C:CC:9B:35:65:AF:5C:4A:0A:CA:A9:D5:41:DA:66:86:43:19:CD

ValidityMon, 17 Apr 2023 08:25:28 GMT - Mon, 10 Jul 2023 08:25:27 GMT

Magic

SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (306)

Size

278
Hash

bb7fc36f627255dd4783f849dca0932e

80e89ef8f3c2c8ee982523757fce214ea7323a69

735f48c2876099e6a731c65fc46ec1ec133c316e0997d04eb0ee246741bee647

HTTP Headers

                                        GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Fri, 05 May 2023 23:05:24 GMT
expires: Sat, 06 May 2023 22:05:24 GMT
cache-control: public, max-age=82800
age: 42340
last-modified: Tue, 09 Feb 2021 14:15:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

472

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

83dad3af2b1ee0e4ce48cc6b69d62a79

df5b55e2b188311fc398f0e7d08e34a924a9e9c2

5f89aa03d3930f0afe5e5bce6e90473130d26ff85a49e2e97d1c73504debca9e

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 06 May 2023 10:51:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ww25.uhxqin.biz/_tr

199.59.243.223

200 OK

URL POST HTTP/1.1

ww25.uhxqin.biz/_tr
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e

Magic

ASCII text, with no line terminators

Size

22
Hash

5cfde9b47de2d84bd26fc473632647c0

fd53c70631b6068328be57daec71bd94bf004d41

47fd05ef74fef5da03fa22483e63fc977cad8e026ae41dadbbcc3745907f306b

Detections

Analyzer	Verdict	Alert
fortinet	Malware
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        POST /_tr HTTP/1.1
Host: ww25.uhxqin.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Content-Type: application/json
Content-Length: 1689
Origin: http://ww25.uhxqin.biz
DNT: 1
Connection: keep-alive
Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Sat, 06 May 2023 10:51:05 GMT
X-Version: 2.104.9
Set-Cookie: parking_session=02246d7f-0c3a-36c0-175b-84587d8e2485; expires=Sat, 06-May-2023 11:06:05 GMT; Max-Age=900; path=/; httponly
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=govfxkzcmwk9&aqid=GDFWZNyNGsLa3wPt-YCYCA&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=528505921&csala=7%7C0%7C284%7C48%7C275&lle=0&ifv=1&usr=1

142.250.74.164

204 No Content

URL GET HTTP/3

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=govfxkzcmwk9&aqid=GDFWZNyNGsLa3wPt-YCYCA&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=528505921&csala=7%7C0%7C284%7C48%7C275&lle=0&ifv=1&usr=1
IP

142.250.74.164:443
ASN

#15169 GOOGLE

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Certificate

IssuerGoogle Trust Services LLC

Subject*.google.com

FingerprintA3:4E:A3:86:10:DA:6C:D1:8C:73:54:AB:E6:8F:7D:21:72:2C:B4:D5

ValidityMon, 17 Apr 2023 08:16:32 GMT - Mon, 10 Jul 2023 08:16:31 GMT

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=govfxkzcmwk9&aqid=GDFWZNyNGsLa3wPt-YCYCA&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=528505921&csala=7%7C0%7C284%7C48%7C275&lle=0&ifv=1&usr=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-aCtRH1338VfmM5EOqK7YEQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sat, 06 May 2023 10:51:06 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=VBPMTuAmg5yTrNm8cusv_T05JvR5I0JfbzJC48IzJoulV2zUfcNxhq7zSHaQt-saPlyd4orpK6scDlN6TeoQjMxeh2cD1WQyGQqNOkXCohpMDBswjVDlQy_eGIUqL4ZSMLK_SfQgpwE9Fh7DirLYCo7awVe978ppP59mLZ08y7E; expires=Sun, 05-Nov-2023 10:51:06 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+673; expires=Mon, 05-May-2025 10:51:06 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=zdso8s6jqtw5&aqid=GDFWZNyNGsLa3wPt-YCYCA&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=528505921&csala=7%7C0%7C284%7C48%7C275&lle=0&ifv=1&usr=1

142.250.74.164

204 No Content

URL GET HTTP/3

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=zdso8s6jqtw5&aqid=GDFWZNyNGsLa3wPt-YCYCA&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=528505921&csala=7%7C0%7C284%7C48%7C275&lle=0&ifv=1&usr=1
IP

142.250.74.164:443
ASN

#15169 GOOGLE

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Certificate

IssuerGoogle Trust Services LLC

Subject*.google.com

FingerprintA3:4E:A3:86:10:DA:6C:D1:8C:73:54:AB:E6:8F:7D:21:72:2C:B4:D5

ValidityMon, 17 Apr 2023 08:16:32 GMT - Mon, 10 Jul 2023 08:16:31 GMT

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=zdso8s6jqtw5&aqid=GDFWZNyNGsLa3wPt-YCYCA&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=528505921&csala=7%7C0%7C284%7C48%7C275&lle=0&ifv=1&usr=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-BGorYg9irYNp_j57vVyTFw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sat, 06 May 2023 10:51:06 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=IBx03k3pQVki6SMgbHUh8s64yhdVZKB9yJZS0z_KTtjy9a2TOA9sHtIc0MCV6qTdNjVy-OR3pugav6deLu8sGxjWNNN3QQBssNParD0jS_PsqNCsr92iNyGxAhQeLsknsk8TKfQIzKX3DQXyjuTXRAwgEjWgZMhvwVaB0OC_F88; expires=Sun, 05-Nov-2023 10:51:06 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+327; expires=Mon, 05-May-2025 10:51:06 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol443&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.uhxqin.biz%3Fcaf%26subid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300965%2C17301140%2C17301141%2C17301143&format=r3&nocache=2291683370266120&num=0&output=afd_ads&domain_name=ww25.uhxqin.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1683370266122&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=528505921&uio=-&cont=rs&jsid=caf&jsv=528505921&rurl=http%3A%2F%2Fww25.uhxqin.biz%2Fktqj%3Fsubid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&adbw=master-1%3A1264

142.250.74.164

200 OK

6139

URL GET HTTP/3

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol443&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.uhxqin.biz%3Fcaf%26subid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300965%2C17301140%2C17301141%2C17301143&format=r3&nocache=2291683370266120&num=0&output=afd_ads&domain_name=ww25.uhxqin.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1683370266122&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=528505921&uio=-&cont=rs&jsid=caf&jsv=528505921&rurl=http%3A%2F%2Fww25.uhxqin.biz%2Fktqj%3Fsubid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&adbw=master-1%3A1264
IP

142.250.74.164:443
ASN

#15169 GOOGLE

Requested by

http://ww25.uhxqin.biz/ktqj?subid1=20230506-2022-2259-b6f8-72f38bd2b73e
Certificate

IssuerGoogle Trust Services LLC

Subject*.google.com

FingerprintA3:4E:A3:86:10:DA:6C:D1:8C:73:54:AB:E6:8F:7D:21:72:2C:B4:D5

ValidityMon, 17 Apr 2023 08:16:32 GMT - Mon, 10 Jul 2023 08:16:31 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6922), with no line terminators

Size

6139
Hash

457e729783014c5f4bd18e86d861e76c

5501065a1438964dbd2e77c8efec211e06fb7a23

1873a0d8dca02eb188456bb14880f81065e7c3d4b897c6ec30846fc97f33287e

HTTP Headers

                                        GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol443&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.uhxqin.biz%3Fcaf%26subid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300965%2C17301140%2C17301141%2C17301143&format=r3&nocache=2291683370266120&num=0&output=afd_ads&domain_name=ww25.uhxqin.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1683370266122&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=528505921&uio=-&cont=rs&jsid=caf&jsv=528505921&rurl=http%3A%2F%2Fww25.uhxqin.biz%2Fktqj%3Fsubid1%3D20230506-2022-2259-b6f8-72f38bd2b73e&adbw=master-1%3A1264 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.uhxqin.biz/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sat, 06 May 2023 10:51:04 GMT
expires: Sat, 06 May 2023 10:51:04 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-OZKmMnU1_L1UGgbBeXLhLA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2132
x-xss-protection: 0
set-cookie: CONSENT=PENDING+534; expires=Mon, 05-May-2025 10:51:04 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

#1 JS:Script (size: 427)

#2 JS:Script (size: 68934)

#3 JS:Script (size: 147917)

#4 JS:Script (size: 6500)

#5 JS:Script (size: 147847)

HTTP Transactions (18)

URL User Request GET HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL POST HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

Magic

Size

Hash