Report - ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc

Report Overview

Visited public
2024-10-09 02:54:55
Tags
Submit Tags
URL
ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Finishing URL
ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
IP / ASN
64.190.63.136
#47846 SEDO GmbH
Title
vofycot.com - Dette nettstedet er til salgs! - vofycot Ressurser og informasjon

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
img.sedoparking.com	54200	2001-09-18	2013-04-23 00:23:29	2024-10-08 17:34:21	898 B	29 kB	205.234.175.175
ww16.vofycot.com	unknown	2011-09-20	2023-11-01 22:38:13	2024-10-07 19:44:38	1.4 kB	26 kB	64.190.63.136
syndicatedsearch.goog	unknown	2023-04-14	2023-09-25 11:30:59	2024-10-08 11:03:17	5.2 kB	162 kB	172.217.21.174
afs.googleusercontent.com	12123	2008-11-17	2013-05-06 21:11:00	2024-10-07 19:37:56	977 B	2.1 kB	142.250.74.129
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-10-07 19:37:45	1.6 kB	4.4 kB	23.36.76.226
www.google.com	7	1997-09-15	2015-05-10 13:11:19	2024-09-30 04:32:43	458 B	154 kB	142.250.74.164
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-10-07 19:37:44	1.3 kB	3.5 kB	23.36.76.226
o.pki.goog	unknown	2016-06-13	2024-04-24 13:44:57	2024-10-07 19:37:47	2.6 kB	5.6 kB	216.58.207.195

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-10-08	medium	vofycot.com	Sinkholed
2024-10-08	medium	vofycot.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc	ScriptElement	4.1 kB	2024-10-11	2024-10-11
Pretty URL ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc IP 64.190.63.136 ASN #47846 SEDO GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2024-10-11 08:43 Last Seen2024-10-11 08:43 Times Seen1 Hash a511f4e222479ed1f29f504a71a61051 d8851487947b0ecd98100c35d7ac6da3c7da483c 0be104189e6a7c9efff0b10a965b97e3cf41f646c9e7fe38accb2d5a56a1190d Loading...

	www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true	ScriptElement	153 kB	2024-10-02	2024-10-11
Pretty URL www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-10-02 15:28 Last Seen2024-10-11 09:19 Times Seen399 Hash 1217ad48dffc6a9f925b6fd708780429 41cd7b64f11c25505b79bcd615f9947a9ec713d7 249ce52b32ab30357a9b061f78b007c3a913ac7ff524d4341372a32770dde660 Loading...

	ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc	ScriptElement	622 B	2023-03-07	2025-07-03
Pretty URL ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc IP 64.190.63.136 ASN #47846 SEDO GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:10 Last Seen2025-07-03 15:46 Times Seen29787 Hash 4ddc86a1d8ae00753cc792ab72a58071 b405fd8562e0d0582f25f4b7ac6d180d72e0e935 4a5f92285fc4b884f74fbf249d3c256136ae5f4c387ba90230f0f357322a6d8d Loading...

	ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc	ScriptElement	5.9 kB	2024-05-23	2025-07-04
Pretty URL ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc IP 64.190.63.136 ASN #47846 SEDO GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-23 11:11 Last Seen2025-07-04 05:25 Times Seen103581 Hash 978e89b89f929ebbd0a746295eafbcbe 6b92ab60432c1e5a8aebc60ebc94f1f24c28cea6 848eaac812a5c6ef9f75fc33f2bfbb7169bfea60bc4d4a28a7e77d1737ca42ac Loading...

	syndicatedsearch.goog/afs/ads/i/iframe.html	ScriptElement	1.3 kB	2023-04-05	2025-03-02
Pretty URL syndicatedsearch.goog/afs/ads/i/iframe.html IP 172.217.21.174 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-05 04:36 Last Seen2025-03-02 05:25 Times Seen67768 Hash 33839cb72649c81ab58b763c95b4a163 0c9b62881e660fded013cee58439ae287690065a cdded269406c9b2b49a3066d12e75913abf338cdd7fa00e31fff299efef1cb76 Loading...

	syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc	ScriptElement	866 B	2024-10-11	2024-10-11
Pretty URL syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc IP 172.217.21.174 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2024-10-11 08:43 Last Seen2024-10-11 08:43 Times Seen1 Hash 3ca6f7ae5d8761ae73942878db762de2 fd3e50be452b84b7c637754f4200e5300f2b3439 bbd1eaf3aad7bd59e17c10ebc9f50e15f065128c78263efdf33128c0ae3d126a Loading...

	syndicatedsearch.goog/adsense/domains/caf.js	ScriptElement	153 kB	2024-10-02	2024-10-11
Pretty URL syndicatedsearch.goog/adsense/domains/caf.js IP 172.217.21.174 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-10-02 16:05 Last Seen2024-10-11 09:19 Times Seen350 Hash 4c7edc182344882216d6d4d7dc46231f 4b981e96e6b665ede4426a89d121d4ae878a76da 6570292e68a16b7f4a51f9672e5f1028112066252c27273ede1f061bb104bb5e Loading...

HTTP Transactions (31)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
94a2d5e693f71770bd013db51ee0fbbe
2f5b5bd658d11088f0599e5f244740d0d8667bea
a4b45c1833f63c69b1847216d9dd0bbfc4f95f33501d88e7dc5555648f019595

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A4B45C1833F63C69B1847216D9DD0BBFC4F95F33501D88E7DC5555648F019595"
Last-Modified: Tue, 08 Oct 2024 12:10:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20294
Expires: Wed, 09 Oct 2024 08:32:42 GMT
Date: Wed, 09 Oct 2024 02:54:28 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
b5fba3de48fd6c409033029700670f78
0e348372969c771ca1d5f0ae6a944eb21c7ede05
86d583a273489c4b3d93bc10e3fa9718746ba439c1d88533f0177dec4c7183ce

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "86D583A273489C4B3D93BC10E3FA9718746BA439C1D88533F0177DEC4C7183CE"
Last-Modified: Tue, 08 Oct 2024 22:04:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4696
Expires: Wed, 09 Oct 2024 04:12:44 GMT
Date: Wed, 09 Oct 2024 02:54:28 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
33985775df7b619cb33f4050d88c5fb9
cf0b2ff92cd2f7e12ce788a164a73d75dea5da83
b6db380f5eeb73aa56abf90afa43b52cc9f51b01f33ad1eefeccc473a41ffb86

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B6DB380F5EEB73AA56ABF90AFA43B52CC9F51B01F33AD1EEFECCC473A41FFB86"
Last-Modified: Tue, 08 Oct 2024 11:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4640
Expires: Wed, 09 Oct 2024 04:11:49 GMT
Date: Wed, 09 Oct 2024 02:54:29 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
ee8a3075e7c2e453a0e7ecb6d0ffb710
8207b3beb4c30142e41563a15cc410ecab5f61a8
af0c2421d7af6507eb62dfa55b8dd2c1f969ca02692e89d3bf841cb42430ebe1

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "AF0C2421D7AF6507EB62DFA55B8DD2C1F969CA02692E89D3BF841CB42430EBE1"
Last-Modified: Tue, 08 Oct 2024 12:40:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3123
Expires: Wed, 09 Oct 2024 03:46:32 GMT
Date: Wed, 09 Oct 2024 02:54:29 GMT
Connection: keep-alive

o.pki.goog/wr2

216.58.207.195

472 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
33d4f5a6cef58799a568093402d12541
171fc7e74d9cbc6cc9e1fcb4e55e08ffd6e10ba3
f7d3da2b57c0872412a74ef15f84376a15bdb6ec765b3ae9cd81028b768a0979

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET img.sedoparking.com/templates/bg/arrows.png

205.234.175.175

200 OK

13 kB

URL GET HTTP/2
img.sedoparking.com/templates/bg/arrows.png
IP
205.234.175.175:443
ASN
#30081 CACHENETWORKS

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGlobalSign nv-sa
Subject*.cachefly.net
Fingerprint0F:4E:B2:D7:96:B9:94:D0:35:66:76:6C:4B:16:18:49:DE:42:80:71
ValidityMon, 13 Nov 2023 19:46:02 GMT - Sat, 14 Dec 2024 19:46:01 GMT

File type
PNG image data, 426 x 475, 8-bit/color RGBA, non-interlaced
Size
13 kB (12642 bytes)
Hash
6dc0bad9aa452ff871b282dabd47131e
01411e6726e033240caa3926141a6adbc18a2d73
3059fbd6cd3550047483dca4071c93e5cf4cc79ce8bafc4388166fbc5279644b

HTTP Headers

GET /templates/bg/arrows.png HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 09 Oct 2024 02:54:30 GMT
content-type: image/png
content-length: 12642
access-control-allow-origin: *
cache-control: max-age=604800
expires: Wed, 16 Oct 2024 02:54:30 GMT
x-cfhash: "6dc0bad9aa452ff871b282dabd47131e"
x-cff: B
last-modified: Mon, 11 Oct 2021 05:39:44 GMT
x-cf3: H
cf4age: 23090
x-cf-tsc: 1711144663
cf4ttl: 31512910.000
x-cf2: H
server: CFS 1124
x-cf-reqid: 53c2aa07e912c7c044209266dcdf0ac5
x-cf1: 11696:fD.arn1:cf:nom:cacheN.arn1-01:H
accept-ranges: bytes
X-Firefox-Spdy: h2

GET ww16.vofycot.com/search/tsc.php?ses=ogc1s8Bih2iAoI0QgFy4qd2xDGR0nZcG85U5_14uHqcu4uJl3I2dcpbT_FhrT9SGl4oW9pR-RCfkdP3HAd5fbXQkSOdgPzQSlr_v08Jc6QYOCC6BRfgn-U60Ih11dZccsxzr23940xhDkocA8drpSJDD1qhXXELaSLrhnFndp71hK9ZF6MKo6V8A_B2rNqJ7T-aW8Bs5BtK3tDvzs36HsegVBGADVh5nE4vHctiLWFxHnkfBSLYoqx-DdZS_8aCkWQkIGUF0ca8cvVKtkMcvBrBLDDA1JD2tRtSv2ZROGzwpt8pwd55YWyCa1hnS0xx-dSOoog6tm0F-VpZ-BtQ0LizhFpKKrCTIqQayW9AnGoFy32QJciX_Ozyp-rxkg&cv=2

64.190.63.136

200 OK

0 B

URL GET HTTP/2
ww16.vofycot.com/search/tsc.php?ses=ogc1s8Bih2iAoI0QgFy4qd2xDGR0nZcG85U5_14uHqcu4uJl3I2dcpbT_FhrT9SGl4oW9pR-RCfkdP3HAd5fbXQkSOdgPzQSlr_v08Jc6QYOCC6BRfgn-U60Ih11dZccsxzr23940xhDkocA8drpSJDD1qhXXELaSLrhnFndp71hK9ZF6MKo6V8A_B2rNqJ7T-aW8Bs5BtK3tDvzs36HsegVBGADVh5nE4vHctiLWFxHnkfBSLYoqx-DdZS_8aCkWQkIGUF0ca8cvVKtkMcvBrBLDDA1JD2tRtSv2ZROGzwpt8pwd55YWyCa1hnS0xx-dSOoog6tm0F-VpZ-BtQ0LizhFpKKrCTIqQayW9AnGoFy32QJciX_Ozyp-rxkg&cv=2
IP
64.190.63.136:443
ASN
#47846 SEDO GmbH

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerDigiCert Inc
Subjectww16.vofycot.com
Fingerprint77:E9:D4:A2:BA:16:65:DB:42:BE:75:37:14:8C:76:AC:69:F6:79:69
ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 02 Nov 2024 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /search/tsc.php?ses=ogc1s8Bih2iAoI0QgFy4qd2xDGR0nZcG85U5_14uHqcu4uJl3I2dcpbT_FhrT9SGl4oW9pR-RCfkdP3HAd5fbXQkSOdgPzQSlr_v08Jc6QYOCC6BRfgn-U60Ih11dZccsxzr23940xhDkocA8drpSJDD1qhXXELaSLrhnFndp71hK9ZF6MKo6V8A_B2rNqJ7T-aW8Bs5BtK3tDvzs36HsegVBGADVh5nE4vHctiLWFxHnkfBSLYoqx-DdZS_8aCkWQkIGUF0ca8cvVKtkMcvBrBLDDA1JD2tRtSv2ZROGzwpt8pwd55YWyCa1hnS0xx-dSOoog6tm0F-VpZ-BtQ0LizhFpKKrCTIqQayW9AnGoFy32QJciX_Ozyp-rxkg&cv=2 HTTP/1.1
Host: ww16.vofycot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Wed, 09 Oct 2024 02:54:30 GMT
server: Parking/1.0
x-cache-miss-from: parking-5879f9b8c8-n4cc7
content-length: 0
X-Firefox-Spdy: h2

o.pki.goog/wr2

216.58.207.195

472 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
b3b74002b5c9ff17dba60c23cf24b3ba
e633515685ce58e2af3a4291bc94cc572e270f13
e1286b7043408065152a3bdffe36564eafff5bc66d912f8a4a6b0d73c9dea586

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET img.sedoparking.com/templates/logos/sedo_logo.png

205.234.175.175

200 OK

15 kB

URL GET HTTP/2
img.sedoparking.com/templates/logos/sedo_logo.png
IP
205.234.175.175:443
ASN
#30081 CACHENETWORKS

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGlobalSign nv-sa
Subject*.cachefly.net
Fingerprint0F:4E:B2:D7:96:B9:94:D0:35:66:76:6C:4B:16:18:49:DE:42:80:71
ValidityMon, 13 Nov 2023 19:46:02 GMT - Sat, 14 Dec 2024 19:46:01 GMT

File type
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Size
15 kB (15086 bytes)
Hash
def00c11b1596db4efee6a9fbe64fc27
bd298981e6d8d7e4ffa18abcf687041f4246672d
95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4

HTTP Headers

GET /templates/logos/sedo_logo.png HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Wed, 09 Oct 2024 02:54:30 GMT
content-type: image/png
content-length: 15086
access-control-allow-origin: *
cache-control: max-age=604800
expires: Wed, 16 Oct 2024 02:54:30 GMT
x-cfhash: "def00c11b1596db4efee6a9fbe64fc27"
x-cff: B
last-modified: Mon, 11 Jan 2021 07:44:34 GMT
x-cf3: H
cf4age: 21299
x-cf-tsc: 1711144658
cf4ttl: 31514700.000
x-cf2: H
server: CFS 1124
x-cf-reqid: 09ae85982973ca79e748eb0fa8b5bba6
x-cf1: 11696:fD.arn1:cf:nom:cacheN.arn1-01:H
accept-ranges: bytes
X-Firefox-Spdy: h2

o.pki.goog/wr2

216.58.207.195

471 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4ff7208fb83a9edda9cd21a0b0f43105
1a237e612a2ee98ce04708bc03664381d6dccfcc
3f5188545a1f2ac0d20b4d455098d7ce36ecec2de350a183b77b6f2512e08a6b

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

o.pki.goog/wr2

216.58.207.195

471 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4ff7208fb83a9edda9cd21a0b0f43105
1a237e612a2ee98ce04708bc03664381d6dccfcc
3f5188545a1f2ac0d20b4d455098d7ce36ecec2de350a183b77b6f2512e08a6b

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET syndicatedsearch.goog/afs/ads/i/iframe.html

172.217.21.174

200 OK

726 B

URL GET HTTP/2
syndicatedsearch.goog/afs/ads/i/iframe.html
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type
HTML document, ASCII text, with very long lines (1559)
Size
726 B (726 bytes)
Hash
b3b39eea47aebd8c56402e8b40ec0d2b
dcd23920c2b81692a6228fbacc2ce412cfe5dc70
664c6da7ab75198be70ead8a2a3a18382846f993a904657eb4316700d58952eb

HTTP Headers

GET /afs/ads/i/iframe.html HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy: script-src 'nonce-mOjFoAesHFzfZ0mNmCZ3XQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-length: 726
date: Wed, 09 Oct 2024 02:54:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Tue, 17 Sep 2024 06:00:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc

172.217.21.174

200 OK

3.0 kB

URL GET HTTP/2
syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (13614)
Size
3.0 kB (3004 bytes)
Hash
7b94250ab1ee63cf0b60afd03aa56d1d
0e298a766ffd29061949c554aee604c6fef1bcbc
722bff9a7850802e282f3c6418ba1a1c8898b06fc58c0662c830b98bfb166aeb

HTTP Headers

GET /afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Wed, 09 Oct 2024 02:54:30 GMT
expires: Wed, 09 Oct 2024 02:54:30 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-2AVHuY9btJTbMQUtvvSNnw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 3004
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

o.pki.goog/wr2

216.58.207.195

471 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4ff7208fb83a9edda9cd21a0b0f43105
1a237e612a2ee98ce04708bc03664381d6dccfcc
3f5188545a1f2ac0d20b4d455098d7ce36ecec2de350a183b77b6f2512e08a6b

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

o.pki.goog/wr2

216.58.207.195

471 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
34fb1e08eebd7a54261f4f4875429675
4115c69280c91fabb624134d33c90c8a1d6a7ba3
cc63f81cfe774e57ee37083d43357f19fbcbdbd6e874bde1fc793074428d5c2b

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

o.pki.goog/wr2

216.58.207.195

471 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
34fb1e08eebd7a54261f4f4875429675
4115c69280c91fabb624134d33c90c8a1d6a7ba3
cc63f81cfe774e57ee37083d43357f19fbcbdbd6e874bde1fc793074428d5c2b

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967D2

142.250.74.129

200 OK

273 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967D2
IP
142.250.74.129:443
ASN
#15169 GOOGLE

Requested by
https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subject*.googleusercontent.com
FingerprintE4:70:0D:EE:EF:A5:22:F8:E0:2D:F4:88:B6:12:68:A2:DB:32:85:38
ValidityMon, 16 Sep 2024 09:32:18 GMT - Mon, 09 Dec 2024 09:32:17 GMT

File type
SVG Scalable Vector Graphics image
Size
273 B (273 bytes)
Hash
6751e07e0f93bd43ab90822f4b2eb62a
d1d0c6f0b4697b0a4e61ffbf171e8c60eac7c832
ff563f41765da081fe9fd40e8bb33a623df033b10050a8ae8c1b46e15107d8f1

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/search.svg?c=%231967D2 HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 273
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 08 Oct 2024 19:42:00 GMT
expires: Wed, 09 Oct 2024 18:42:00 GMT
cache-control: public, max-age=82800
age: 25950
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff

142.250.74.129

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
142.250.74.129:443
ASN
#15169 GOOGLE

Requested by
https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subject*.googleusercontent.com
FingerprintE4:70:0D:EE:EF:A5:22:F8:E0:2D:F4:88:B6:12:68:A2:DB:32:85:38
ValidityMon, 16 Sep 2024 09:32:18 GMT - Mon, 09 Dec 2024 09:32:17 GMT

File type
SVG Scalable Vector Graphics image
Size
174 B (174 bytes)
Hash
11b3089d616633ca6b73b57aa877eeb4
07632f63e06b30d9b63c97177d3a8122629bda9b
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 08 Oct 2024 13:05:51 GMT
expires: Wed, 09 Oct 2024 12:05:51 GMT
cache-control: public, max-age=82800
age: 49719
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r11.o.lencr.org/

23.36.76.226

504 B

URL
r11.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
aa746f2452828a39148ef2ed129c14f6
aab2904047696ac367e2bfc0ffb1ba44c9c84256
5c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9281
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:54:31 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL
r11.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
aa746f2452828a39148ef2ed129c14f6
aab2904047696ac367e2bfc0ffb1ba44c9c84256
5c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9281
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:54:31 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL
r11.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
aa746f2452828a39148ef2ed129c14f6
aab2904047696ac367e2bfc0ffb1ba44c9c84256
5c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9281
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:54:31 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL
r11.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
aa746f2452828a39148ef2ed129c14f6
aab2904047696ac367e2bfc0ffb1ba44c9c84256
5c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9281
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:54:31 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL
r11.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
aa746f2452828a39148ef2ed129c14f6
aab2904047696ac367e2bfc0ffb1ba44c9c84256
5c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9281
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:54:31 GMT
Connection: keep-alive

o.pki.goog/wr2

216.58.207.195

471 B

URL
o.pki.goog/wr2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
34fb1e08eebd7a54261f4f4875429675
4115c69280c91fabb624134d33c90c8a1d6a7ba3
cc63f81cfe774e57ee37083d43357f19fbcbdbd6e874bde1fc793074428d5c2b

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Oct 2024 02:54:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=76qqu0s04iwp&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&psid=9330244380&pbt=bs&adbx=406.66668701171875&adby=134.64999389648438&adbh=533&adbw=467&adbah=171%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=17%7C0%7C315%7C81%7C49&lle=0&ifv=1&hpt=0

172.217.21.174

204 No Content

0 B

URL GET HTTP/3
syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=76qqu0s04iwp&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&psid=9330244380&pbt=bs&adbx=406.66668701171875&adby=134.64999389648438&adbh=533&adbw=467&adbah=171%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=17%7C0%7C315%7C81%7C49&lle=0&ifv=1&hpt=0
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=76qqu0s04iwp&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&psid=9330244380&pbt=bs&adbx=406.66668701171875&adby=134.64999389648438&adbh=533&adbw=467&adbah=171%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=17%7C0%7C315%7C81%7C49&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-XucmQfq_MPIomKep6FIucw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Wed, 09 Oct 2024 02:54:32 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=q5psnln4f33n&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&pbt=bs&adbx=490&adby=807.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=7%7C0%7C325%7C81%7C49&lle=0&ifv=1&hpt=0

172.217.21.174

204 No Content

0 B

URL GET HTTP/3
syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=q5psnln4f33n&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&pbt=bs&adbx=490&adby=807.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=7%7C0%7C325%7C81%7C49&lle=0&ifv=1&hpt=0
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=q5psnln4f33n&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&pbt=bs&adbx=490&adby=807.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=7%7C0%7C325%7C81%7C49&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-3e8yKcwTkb6TWKpW2VJqwA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Wed, 09 Oct 2024 02:54:32 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=2012ag4mbmvs&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&psid=9330244380&pbt=bv&adbx=406.66668701171875&adby=134.64999389648438&adbh=533&adbw=467&adbah=171%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=17%7C0%7C315%7C81%7C49&lle=0&ifv=1&hpt=0

172.217.21.174

204 No Content

0 B

URL GET HTTP/3
syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=2012ag4mbmvs&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&psid=9330244380&pbt=bv&adbx=406.66668701171875&adby=134.64999389648438&adbh=533&adbw=467&adbah=171%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=17%7C0%7C315%7C81%7C49&lle=0&ifv=1&hpt=0
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=2012ag4mbmvs&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&psid=9330244380&pbt=bv&adbx=406.66668701171875&adby=134.64999389648438&adbh=533&adbw=467&adbah=171%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=17%7C0%7C315%7C81%7C49&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-E92-S1ZPdU5_VeIhCGQWRQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Wed, 09 Oct 2024 02:54:32 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=3qlfc29r9od2&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&pbt=bv&adbx=490&adby=807.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=7%7C0%7C325%7C81%7C49&lle=0&ifv=1&hpt=0

172.217.21.174

204 No Content

0 B

URL GET HTTP/3
syndicatedsearch.goog/afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=3qlfc29r9od2&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&pbt=bv&adbx=490&adby=807.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=7%7C0%7C325%7C81%7C49&lle=0&ifv=1&hpt=0
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-sedo85_3ph&output=uds_ads_only&zx=3qlfc29r9od2&aqid=ZvAFZ5SXFoGViM0PpfjH8Qk&pbt=bv&adbx=490&adby=807.6500244140625&adbh=17&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo85_3ph&errv=681010707&csala=7%7C0%7C325%7C81%7C49&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-w16BZUZmsiLccdn02YXucQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Wed, 09 Oct 2024 02:54:32 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET syndicatedsearch.goog/adsense/domains/caf.js

172.217.21.174

200 OK

153 kB

URL GET HTTP/3
syndicatedsearch.goog/adsense/domains/caf.js
IP
172.217.21.174:443
ASN
#15169 GOOGLE

Requested by
https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=9330244380&channel=%2Cexp-0051%2Cauxa-control-1%2C10450790&client=dp-sedo85_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fww16.vofycot.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjg0NDI0NjkmdGNpZD13dzE2LnZvZnljb3QuY29tNjcwNWYwNjVjMmU0MjguNzc4MDc4NDMmdGFzaz1zZWFyY2gmZG9tYWluPXZvZnljb3QuY29tJmFfaWQ9MyZzZXNzaW9uPVIyUjVkZWNPeDc3Mk9DbU5kZlox&type=3&uiopt=false&swp=as-drid-2106557024922479&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=9771728442470214&num=0&output=afd_ads&domain_name=ww16.vofycot.com&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1728442470223&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=999&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=681010707&rurl=https%3A%2F%2Fww16.vofycot.com%2Flogin.php%3Fsub1%3D20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectsyndicatedsearch.goog
Fingerprint98:0A:EA:B7:A9:BE:F2:9D:18:4B:E6:C0:20:FA:9A:7A:D3:E3:73:A5
ValidityMon, 16 Sep 2024 09:44:00 GMT - Mon, 09 Dec 2024 09:43:59 GMT

File type
JavaScript source, ASCII text, with very long lines (1879)
Size
153 kB (153131 bytes)
Hash
4c7edc182344882216d6d4d7dc46231f
4b981e96e6b665ede4426a89d121d4ae878a76da
6570292e68a16b7f4a51f9672e5f1028112066252c27273ede1f061bb104bb5e

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Wed, 09 Oct 2024 02:54:30 GMT
expires: Wed, 09 Oct 2024 02:54:30 GMT
cache-control: private, max-age=3600
etag: "15838387115246319480"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true

142.250.74.164

200 OK

153 kB

URL GET HTTP/2
www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
https://ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
Certificate
IssuerGoogle Trust Services
Subjectwww.google.com
FingerprintAD:02:8F:37:49:83:F2:82:0C:84:E9:B4:A4:19:E5:DC:D0:D6:62:C9
ValidityMon, 16 Sep 2024 09:36:05 GMT - Mon, 09 Dec 2024 09:36:04 GMT

File type
JavaScript source, ASCII text, with very long lines (1879)
Size
153 kB (153115 bytes)
Hash
1217ad48dffc6a9f925b6fd708780429
41cd7b64f11c25505b79bcd615f9947a9ec713d7
249ce52b32ab30357a9b061f78b007c3a913ac7ff524d4341372a32770dde660

HTTP Headers

GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww16.vofycot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Wed, 09 Oct 2024 02:54:30 GMT
expires: Wed, 09 Oct 2024 02:54:30 GMT
cache-control: private, max-age=3600
etag: "8792537726396116611"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc

64.190.63.136

200 OK

25 kB

URL User Request GET HTTP/2
ww16.vofycot.com/login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc
IP
64.190.63.136:443
ASN
#47846 SEDO GmbH

Certificate
IssuerDigiCert Inc
Subjectww16.vofycot.com
Fingerprint77:E9:D4:A2:BA:16:65:DB:42:BE:75:37:14:8C:76:AC:69:F6:79:69
ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 02 Nov 2024 23:59:59 GMT

File type

Size
25 kB (25030 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php?sub1=20241009-1349-43b4-b33f-a875bbcfa9bc HTTP/1.1
Host: ww16.vofycot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 09 Oct 2024 02:54:29 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 09 Oct 2024 02:54:29 GMT
pragma: no-cache
server: Parking/1.0
vary: Accept-Encoding
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_rvpY8cdM2tfCNRCOjpDoK5gM8oYyW4jJPNBnOnor9aELW0VMbr2TZpVDdz7QmK+LuiuxZa/K0HmmaVIgDO+cig==
x-cache-miss-from: parking-5879f9b8c8-gtbjb
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (31)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN