Report - ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Report Overview

URL

ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
IP

199.59.243.223

ASN

#16509 AMAZON-02
Submitted

2023-06-06T06:05:21Z

Access

public
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

2
Threat Detection Systems

14

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
ww25.anpmnmxo.biz (7)	unknown	2023-03-03 01:20:40	2023-06-06 05:17:09	3397	27817	199.59.243.223
ocsp.pki.goog (4)	175	2018-07-01 08:43:07	2023-06-06 05:09:25	1332	2796	142.250.74.131
www.google.com (2)	7	2015-05-10 13:11:19	2023-06-05 05:22:18	1765	58344	142.250.74.132
afs.googleusercontent.com (2)	12123	2013-05-06 21:11:00	2023-06-06 05:12:42	981	2094	142.250.74.97

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-06-06T06:05:03Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-06-06T06:05:03Z	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz

Quad9 DNS

Scan Date	Severity	Indicator
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz
2023-06-06	medium	anpmnmxo.biz

ThreatFox

No alerts detected

JavaScript (5)

HTTP Transactions (15)

URL IP Response Size

ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

199.59.243.223

200 OK

724

URL User Request GET HTTP/1.1

ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (983), with no line terminators

Size

724
Hash

181cec61e22e26f07c1951e94e429b9e

ae7d6077840be931932608acd1a50409ada9d574

0625c31b5f9b3d1b9f1415b5b2ee49e9a9861ee1b840a3ac0cef8a0adecd7525

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Tue, 06 Jun 2023 06:05:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c; expires=Tue, 06-Jun-2023 06:20:04 GMT; Max-Age=900; path=/; HttpOnly
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_QfG0lNJ7T//mS55FD1cl1FFQcVM9691kGuwDLuWLZ8vmVJhCFcx6R8Zl031CK74eKn/iVR3kmp4mlYZ0w+liZQ==
Accept-CH: sec-ch-prefers-color-scheme
Critical-CH: sec-ch-prefers-color-scheme
Vary: sec-ch-prefers-color-scheme
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

ww25.anpmnmxo.biz/js/parking.2.105.5.js

199.59.243.223

200 OK

21953

URL GET HTTP/1.1

ww25.anpmnmxo.biz/js/parking.2.105.5.js
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Magic

HTML document, ASCII text, with very long lines (65536), with no line terminators

Size

21953
Hash

3e1864d0725b87f7aa6af91212e93ede

07ba27733921329fe0dbad86419fdaf08ff23573

4c0831bbff079ac28d7851a6e15469845cb70f8f7de0005adcac65c5922205e5

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /js/parking.2.105.5.js HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Tue, 06 Jun 2023 06:05:04 GMT
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 01 Jun 2023 16:51:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

ww25.anpmnmxo.biz/_fd?subid1=20230606-1604-4749-ba19-51faf8a73d0b

199.59.243.223

200 OK

1897

URL POST HTTP/1.1

ww25.anpmnmxo.biz/_fd?subid1=20230606-1604-4749-ba19-51faf8a73d0b
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Magic

ASCII text, with very long lines (3745), with no line terminators

Size

1897
Hash

70cd0fec00e947a2481998bdbadcde2c

01538e4c5f98f59d638282dea00c2aa8c14a7ee5

7379696dc6b8af17de637e453628f1fc3e45b4235f62330c54dbae0613f118ff

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        POST /_fd?subid1=20230606-1604-4749-ba19-51faf8a73d0b HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Content-Type: application/json
Origin: http://ww25.anpmnmxo.biz
DNT: 1
Connection: keep-alive
Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

                                        HTTP/1.1 200 OK
Server: openresty
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 06 Jun 2023 06:05:04 GMT
X-Version: 2.105.5
Set-Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c; expires=Tue, 06-Jun-2023 06:20:04 GMT; Max-Age=900; path=/; httponly
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

ww25.anpmnmxo.biz/px.gif?ch=1&rn=10.437146381459382

199.59.243.223

200 OK

URL GET HTTP/1.1

ww25.anpmnmxo.biz/px.gif?ch=1&rn=10.437146381459382
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Magic

GIF image data, version 89a, 1 x 1\012- data

Size

42
Hash

d89746888da2d9510b64a9f031eaecd5

d5fceb6532643d0d84ffe09c40c481ecdf59e15a

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /px.gif?ch=1&rn=10.437146381459382 HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Tue, 06 Jun 2023 06:05:04 GMT
Content-Type: image/gif
Content-Length: 42
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Accept-Ranges: bytes

ww25.anpmnmxo.biz/px.gif?ch=2&rn=10.437146381459382

199.59.243.223

200 OK

URL GET HTTP/1.1

ww25.anpmnmxo.biz/px.gif?ch=2&rn=10.437146381459382
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Magic

GIF image data, version 89a, 1 x 1\012- data

Size

42
Hash

d89746888da2d9510b64a9f031eaecd5

d5fceb6532643d0d84ffe09c40c481ecdf59e15a

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /px.gif?ch=2&rn=10.437146381459382 HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Tue, 06 Jun 2023 06:05:04 GMT
Content-Type: image/gif
Content-Length: 42
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

471

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

f92399559e74f6a631ba6fe9986f6e21

99d11e3a579dccb7be7ded16649293ccf1767ae1

a672379c41ff33db9389a16853e4ada69f40e307119b49de18f672ff2df79fb9

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 06 Jun 2023 06:05:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ww25.anpmnmxo.biz/favicon.ico

199.59.243.223

200 OK

URL GET HTTP/1.1

ww25.anpmnmxo.biz/favicon.ico
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Date: Tue, 06 Jun 2023 06:05:05 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Connection: keep-alive
ETag: "61424bb6-0"
x-backend-server: ip-10-201-16-216.ec2.internal
Accept-Ranges: bytes

www.google.com/adsense/domains/caf.js

142.250.74.132

200 OK

54456

URL GET HTTP/3

www.google.com/adsense/domains/caf.js
IP

142.250.74.132:443
ASN

#15169 GOOGLE

Requested by

https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol306%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol424&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.anpmnmxo.biz%3Fcaf%26subid1%3D20230606-1604-4749-ba19-51faf8a73d0b&terms=cyber%20security%2Copen%20threat%20exchange%2Ccyber%20threats&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3&nocache=1351686031504701&num=0&output=afd_ads&domain_name=ww25.anpmnmxo.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1686031504703&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=536423577&uio=-&cont=rs&jsid=caf&jsv=536423577&rurl=http%3A%2F%2Fww25.anpmnmxo.biz%2Fjlay%3Fsubid1%3D20230606-1604-4749-ba19-51faf8a73d0b&adbw=master-1%3A1264
Certificate

IssuerGoogle Trust Services LLC

Subject*.google.com

Fingerprint55:5E:E6:33:AF:71:86:C2:88:4A:36:5F:68:1D:97:9D:9B:9D:2A:1D

ValidityFri, 19 May 2023 12:53:06 GMT - Fri, 11 Aug 2023 12:53:05 GMT

Magic

gzip compressed data, max compression\012- data

Size

54456
Hash

61dd44035b88e3de5927131a33833873

661f1cbc5cb31e738bed5a8f03f0f2f75c84f344

4b9e1a2e35ab9dde441dfe38bd4fac67d30b2d7d2e013ecd3f2f5741b071052b

HTTP Headers

                                        GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.anpmnmxo.biz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Tue, 06 Jun 2023 06:05:05 GMT
expires: Tue, 06 Jun 2023 06:05:05 GMT
cache-control: private, max-age=3600
etag: "7507535832772147841"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol306%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol424&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.anpmnmxo.biz%3Fcaf%26subid1%3D20230606-1604-4749-ba19-51faf8a73d0b&terms=cyber%20security%2Copen%20threat%20exchange%2Ccyber%20threats&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3&nocache=1351686031504701&num=0&output=afd_ads&domain_name=ww25.anpmnmxo.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1686031504703&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=536423577&uio=-&cont=rs&jsid=caf&jsv=536423577&rurl=http%3A%2F%2Fww25.anpmnmxo.biz%2Fjlay%3Fsubid1%3D20230606-1604-4749-ba19-51faf8a73d0b&adbw=master-1%3A1264

142.250.74.132

200 OK

2171

URL GET HTTP/3

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol306%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol424&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.anpmnmxo.biz%3Fcaf%26subid1%3D20230606-1604-4749-ba19-51faf8a73d0b&terms=cyber%20security%2Copen%20threat%20exchange%2Ccyber%20threats&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3&nocache=1351686031504701&num=0&output=afd_ads&domain_name=ww25.anpmnmxo.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1686031504703&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=536423577&uio=-&cont=rs&jsid=caf&jsv=536423577&rurl=http%3A%2F%2Fww25.anpmnmxo.biz%2Fjlay%3Fsubid1%3D20230606-1604-4749-ba19-51faf8a73d0b&adbw=master-1%3A1264
IP

142.250.74.132:443
ASN

#15169 GOOGLE

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Certificate

IssuerGoogle Trust Services LLC

Subject*.google.com

Fingerprint55:5E:E6:33:AF:71:86:C2:88:4A:36:5F:68:1D:97:9D:9B:9D:2A:1D

ValidityFri, 19 May 2023 12:53:06 GMT - Fri, 11 Aug 2023 12:53:05 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5737)

Size

2171
Hash

7791f3058e400f47c01c8efc7a79baab

d592b1ee682de625c0817556dfdd9ea65ef83397

ab5d2c6e287a655f880ae9740b64e6953ab6d6e17c8eb68a5a9379e0dc257d8a

HTTP Headers

                                        GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol306%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol424&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.anpmnmxo.biz%3Fcaf%26subid1%3D20230606-1604-4749-ba19-51faf8a73d0b&terms=cyber%20security%2Copen%20threat%20exchange%2Ccyber%20threats&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3&nocache=1351686031504701&num=0&output=afd_ads&domain_name=ww25.anpmnmxo.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1686031504703&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=536423577&uio=-&cont=rs&jsid=caf&jsv=536423577&rurl=http%3A%2F%2Fww25.anpmnmxo.biz%2Fjlay%3Fsubid1%3D20230606-1604-4749-ba19-51faf8a73d0b&adbw=master-1%3A1264 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.anpmnmxo.biz/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Tue, 06 Jun 2023 06:05:05 GMT
expires: Tue, 06 Jun 2023 06:05:05 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-qEZpp9qk8LC48x8meO26Cw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2171
x-xss-protection: 0
set-cookie: CONSENT=PENDING+287; expires=Thu, 05-Jun-2025 06:05:05 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

ocsp.pki.goog/gts1c3

142.250.74.131

471

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

92ecc8124d8a77387b48190d99e2d602

43f58e76a0a1ea98ff3d4b60a5c083e6e4875a3a

ec6f6123546a631545a0cf232023e48a1112ed6962c89372f69f10ed10a6ed9c

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 06 Jun 2023 06:05:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b

142.250.74.97

200 OK

174

URL GET HTTP/2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
IP

142.250.74.97:443
ASN

#15169 GOOGLE

Requested by

https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol306%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol424&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.anpmnmxo.biz%3Fcaf%26subid1%3D20230606-1604-4749-ba19-51faf8a73d0b&terms=cyber%20security%2Copen%20threat%20exchange%2Ccyber%20threats&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3&nocache=1351686031504701&num=0&output=afd_ads&domain_name=ww25.anpmnmxo.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1686031504703&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=536423577&uio=-&cont=rs&jsid=caf&jsv=536423577&rurl=http%3A%2F%2Fww25.anpmnmxo.biz%2Fjlay%3Fsubid1%3D20230606-1604-4749-ba19-51faf8a73d0b&adbw=master-1%3A1264
Certificate

IssuerGoogle Trust Services LLC

Subject*.googleusercontent.com

FingerprintAC:83:32:AA:E9:4D:2F:A2:F2:C9:F0:F3:7B:98:49:1B:5B:DE:7E:44

ValidityFri, 19 May 2023 12:57:31 GMT - Fri, 11 Aug 2023 12:57:30 GMT

Magic

SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators

Size

174
Hash

d47125b2ba92be53dcff07ba322ce1de

e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28

5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6

HTTP Headers

                                        GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 05 Jun 2023 22:03:16 GMT
expires: Tue, 06 Jun 2023 21:03:16 GMT
cache-control: public, max-age=82800
age: 28909
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

92ecc8124d8a77387b48190d99e2d602

43f58e76a0a1ea98ff3d4b60a5c083e6e4875a3a

ec6f6123546a631545a0cf232023e48a1112ed6962c89372f69f10ed10a6ed9c

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 06 Jun 2023 06:05:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff

142.250.74.97

200 OK

278

URL GET HTTP/2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
IP

142.250.74.97:443
ASN

#15169 GOOGLE

Requested by

https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol306%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol424&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.anpmnmxo.biz%3Fcaf%26subid1%3D20230606-1604-4749-ba19-51faf8a73d0b&terms=cyber%20security%2Copen%20threat%20exchange%2Ccyber%20threats&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2936916502645281&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301187%2C17301190&format=r3&nocache=1351686031504701&num=0&output=afd_ads&domain_name=ww25.anpmnmxo.biz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1686031504703&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=536423577&uio=-&cont=rs&jsid=caf&jsv=536423577&rurl=http%3A%2F%2Fww25.anpmnmxo.biz%2Fjlay%3Fsubid1%3D20230606-1604-4749-ba19-51faf8a73d0b&adbw=master-1%3A1264
Certificate

IssuerGoogle Trust Services LLC

Subject*.googleusercontent.com

FingerprintAC:83:32:AA:E9:4D:2F:A2:F2:C9:F0:F3:7B:98:49:1B:5B:DE:7E:44

ValidityFri, 19 May 2023 12:57:31 GMT - Fri, 11 Aug 2023 12:57:30 GMT

Magic

SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (306)

Size

278
Hash

fe7dd8c3c629cc6e9cd6d3e4d3cbe905

59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18

5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e

HTTP Headers

                                        GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 05 Jun 2023 19:32:05 GMT
expires: Tue, 06 Jun 2023 18:32:05 GMT
cache-control: public, max-age=82800
age: 37980
last-modified: Tue, 09 Feb 2021 14:15:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471

URL

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

92ecc8124d8a77387b48190d99e2d602

43f58e76a0a1ea98ff3d4b60a5c083e6e4875a3a

ec6f6123546a631545a0cf232023e48a1112ed6962c89372f69f10ed10a6ed9c

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 06 Jun 2023 06:05:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ww25.anpmnmxo.biz/_tr

199.59.243.223

200 OK

URL POST HTTP/1.1

ww25.anpmnmxo.biz/_tr
IP

199.59.243.223:80
ASN

#16509 AMAZON-02

Requested by

http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b

Magic

ASCII text, with no line terminators

Size

22
Hash

444bcb3a3fcf8389296c49467f27e1d6

7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Detections

Analyzer	Verdict	Alert
mnemonic_dns	Sinkholed
quad9	Sinkholed

HTTP Headers

                                        POST /_tr HTTP/1.1
Host: ww25.anpmnmxo.biz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.anpmnmxo.biz/jlay?subid1=20230606-1604-4749-ba19-51faf8a73d0b
Content-Type: application/json
Content-Length: 1765
Origin: http://ww25.anpmnmxo.biz
DNT: 1
Connection: keep-alive
Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: openresty
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 06 Jun 2023 06:05:05 GMT
X-Version: 2.105.5
Set-Cookie: parking_session=14c31ea2-fa68-15e8-2cd7-3facf2bf682c; expires=Tue, 06-Jun-2023 06:20:05 GMT; Max-Age=900; path=/; httponly
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

#1 JS:Script (size: 435)

#2 JS:Script (size: 67360)

#3 JS:Script (size: 148412)

#4 JS:Script (size: 6596)

#5 JS:Script (size: 148360)

HTTP Transactions (15)

URL User Request GET HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL POST HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Magic

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

Magic

Size

Hash