Report - annsqehena.com/imgs/krewa/nqxa.php?id=4479xekl&s5=3159&lip=192.168.2.11&win=Unk

Report Overview

Submitted URL
annsqehena.com/imgs/krewa/nqxa.php?id=4479xekl&s5=3159&lip=192.168.2.11&win=Unk
IP
185.107.56.209
ASN
#43350 NForce Entertainment B.V.
Submitted
2023-05-29 14:36:10
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
annsqehena.com	unknown	2022-08-19	2022-08-20	2023-05-29	1.4 kB	1.3 kB	185.107.56.209
e1.o.lencr.org	6159	2020-06-29	2021-08-20	2023-05-29	328 B	729 B	23.36.76.226
ww1.annsqehena.com	unknown	2022-08-19	2023-05-26	2023-05-29	4.0 kB	82 kB	199.59.243.223
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-05-29	1.3 kB	2.8 kB	142.250.74.131
www.google.com	7	1997-09-15	2015-05-10	2023-05-29	3.5 kB	302 kB	142.250.74.132
afs.googleusercontent.com	12123	2008-11-17	2013-05-06	2023-05-29	981 B	2.1 kB	142.250.74.97

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-05-29 14:35:52	medium	185.107.56.209	Client IP	ET INFO TLS Handshake Failure
2023-05-29 14:35:53	medium	185.107.56.209	Client IP	ET INFO TLS Handshake Failure

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator
2023-05-29	medium	ww1.annsqehena.com/js/parking.2.105.3.js
2023-05-29	medium	ww1.annsqehena.com/_fd
2023-05-29	medium	ww1.annsqehena.com/_tr
2023-05-29	medium	ww1.annsqehena.com/

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	ww1.annsqehena.com/	363 B	2023-05-29	2023-05-29
Pretty URL ww1.annsqehena.com/ IP 199.59.243.223 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-29 16:36:10 Last Seen2023-05-29 16:36:10 Times Seen1 Hash f330a749a1b7e0bb34d67afc89974684 f55274f8508e0dd91cc59cce84e59536ccb61975 3f1e7f4fab8a9d1c5c5e593ecbedd6def94bca37831837d2a5985927044e296f Loading...

	ww1.annsqehena.com/js/parking.2.105.3.js	69 kB	2023-05-16	2023-06-01
Pretty URL ww1.annsqehena.com/js/parking.2.105.3.js IP 199.59.243.223 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-16 22:27:50 Last Seen2023-06-01 18:38:21 Times Seen7291 Hash db066e3eeddf5d1eb1dc837d7c0667ff 65a9543352ccdd2e698000ee08a31368df3c4237 e94c295c351e24b95c9e81fa538045590f2262f0991924e0b5b4745767706911 Loading...

	www.google.com/adsense/domains/caf.js	148 kB	2023-05-23	2023-05-30
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-23 21:57:29 Last Seen2023-05-30 16:08:44 Times Seen1625 Hash 2b9b875173663f674242c18e7b69a8ed 897b8c5a9dbc707beed032a04ff9cd8cb3ef6e53 04db145914e70b0fa266540c40ba91ffdb8598b047b16a9ef1045042bfea0c6c Loading...

	www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264	6.4 kB	2023-05-29	2023-05-29
Pretty URL www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264 IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-29 16:36:10 Last Seen2023-05-29 16:36:10 Times Seen1 Hash 189a0b147cd9e9bddd8c910c0793ece8 0f600457321a8d76a596026d5bac3f66d73b8b9d d959307651830e6ef460051e8d0f96ac9ea26e9ed38a8fa854354ae2ac245089 Loading...

	www.google.com/adsense/domains/caf.js	148 kB	2023-05-25	2023-05-30
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-25 22:52:20 Last Seen2023-05-30 16:30:03 Times Seen1350 Hash ba14d2be5e6250fd530331e1452ff2b4 fc5b18f25c11b2f3079f46c601bbcba1bb1226f2 afabc2eb29fe9571addda23feeff6993e0dc7bf26eeaba3a292317aea02c30de Loading...

HTTP Transactions (21)

URL IP Response Size

annsqehena.com/imgs/krewa/nqxa.php?id=4479xekl&s5=3159&lip=192.168.2.11&win=Unk

185.107.56.209

539 B

URL
annsqehena.com/imgs/krewa/nqxa.php?id=4479xekl&s5=3159&lip=192.168.2.11&win=Unk
IP
185.107.56.209:0
ASN
#43350 NForce Entertainment B.V.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (539), with no line terminators
Size
539 B (539 bytes)
Hash
b21ba18af3127895f5412d85207af041
7eac85ce0f9521a4fac908b5fe464f21df821b87
b27e6de5a50e202f957f01af0cf64e0aac7843df394b702522fea34d105df956

HTTP Headers

GET /imgs/krewa/nqxa.php?id=4479xekl&s5=3159&lip=192.168.2.11&win=Unk HTTP/1.1
Host: annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 539
content-type: text/html; charset=utf-8
date: Mon, 29 May 2023 14:35:52 GMT
server: nginx
set-cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; path=/; domain=.annsqehena.com; expires=Sat, 16 Jun 2091 17:50:00 GMT; max-age=2147483647; HttpOnly

annsqehena.com/imgs/krewa/nqxa.php?ch=1&id=4479xekl&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY4NTM3ODE1MywiaWF0IjoxNjg1MzcwOTUzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydGhxN3N1ZXN0MzBubGpxMGsxdTdyNDYiLCJuYmYiOjE2ODUzNzA5NTMsInRzIjoxNjg1MzcwOTUzMTEwMjc4fQ.GqkubUxcRxnCkjk9vBC4z4SwjpglAvhft5WmNJ56Ydo&lip=192.168.2.11&s5=3159&sid=1d403574-fe2e-11ed-9c83-eca7e72d449c&win=Unk

185.107.56.209

302 Found

11 B

URL User Request GET HTTP/1.1
annsqehena.com/imgs/krewa/nqxa.php?ch=1&id=4479xekl&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY4NTM3ODE1MywiaWF0IjoxNjg1MzcwOTUzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydGhxN3N1ZXN0MzBubGpxMGsxdTdyNDYiLCJuYmYiOjE2ODUzNzA5NTMsInRzIjoxNjg1MzcwOTUzMTEwMjc4fQ.GqkubUxcRxnCkjk9vBC4z4SwjpglAvhft5WmNJ56Ydo&lip=192.168.2.11&s5=3159&sid=1d403574-fe2e-11ed-9c83-eca7e72d449c&win=Unk
IP
185.107.56.209:80
ASN
#43350 NForce Entertainment B.V.

File type
ASCII text, with no line terminators
Size
11 B (11 bytes)
Hash
32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47

HTTP Headers

GET /imgs/krewa/nqxa.php?ch=1&id=4479xekl&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY4NTM3ODE1MywiaWF0IjoxNjg1MzcwOTUzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydGhxN3N1ZXN0MzBubGpxMGsxdTdyNDYiLCJuYmYiOjE2ODUzNzA5NTMsInRzIjoxNjg1MzcwOTUzMTEwMjc4fQ.GqkubUxcRxnCkjk9vBC4z4SwjpglAvhft5WmNJ56Ydo&lip=192.168.2.11&s5=3159&sid=1d403574-fe2e-11ed-9c83-eca7e72d449c&win=Unk HTTP/1.1
Host: annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://annsqehena.com/imgs/krewa/nqxa.php?id=4479xekl&s5=3159&lip=192.168.2.11&win=Unk
DNT: 1
Connection: keep-alive
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Mon, 29 May 2023 14:35:52 GMT
location: http://ww1.annsqehena.com
server: nginx
set-cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; path=/; domain=.annsqehena.com; expires=Sat, 16 Jun 2091 17:50:00 GMT; max-age=2147483647; HttpOnly

e1.o.lencr.org/

23.36.76.226

345 B

URL
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
345 B (345 bytes)
Hash
8565d933341b26fa77c3e49997bcb8df
298cad917f48d24d81aac6d6ae47e0fc8f316d76
613d0330a6b1d95ca06e774f355436edb4c3e96bdd64b4fe8e18faed528a0046

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "613D0330A6B1D95CA06E774F355436EDB4C3E96BDD64B4FE8E18FAED528A0046"
Last-Modified: Mon, 29 May 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18031
Expires: Mon, 29 May 2023 19:36:26 GMT
Date: Mon, 29 May 2023 14:35:55 GMT
Connection: keep-alive

ww1.annsqehena.com/js/parking.2.105.3.js

199.59.243.223

200 OK

22 kB

URL GET HTTP/2
ww1.annsqehena.com/js/parking.2.105.3.js
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type
gzip compressed data, max speed, from Unix\012- data
Size
22 kB (22203 bytes)
Hash
828d003a6740e9f4abd03192d6c2770f
697a22e484dc7475b48f2478727e81b8abaa77fd
c73f54cc009ef27d763137c79fdd4b3e1ea968998cd0e49850933ab019ae8a5b

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /js/parking.2.105.3.js HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; parking_session=9ca9dee1-c00c-57de-73fb-00653c357060
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Mon, 29 May 2023 14:35:56 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 16 May 2023 20:23:20 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

ww1.annsqehena.com/px.gif?ch=2&rn=2.7190507031814377

199.59.243.223

200 OK

42 B

URL GET HTTP/2
ww1.annsqehena.com/px.gif?ch=2&rn=2.7190507031814377
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

HTTP Headers

GET /px.gif?ch=2&rn=2.7190507031814377 HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; parking_session=9ca9dee1-c00c-57de-73fb-00653c357060
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Mon, 29 May 2023 14:35:56 GMT
content-type: image/gif
content-length: 42
last-modified: Wed, 15 Sep 2021 19:38:30 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ranges: bytes
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
11ddcad6f0fc074c4f1b86c66ced6d86
cdd65841fec92aca297dfc5c17dee8c8b525fd1f
64cf10b6657bc2be18416ea274885a23d1dfaab08a13f87f113e19c9aeaf4fd8

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 29 May 2023 14:35:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ww1.annsqehena.com/favicon.ico

199.59.243.223

200 OK

0 B

URL GET HTTP/2
ww1.annsqehena.com/favicon.ico
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; parking_session=9ca9dee1-c00c-57de-73fb-00653c357060
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Mon, 29 May 2023 14:35:56 GMT
content-type: image/x-icon
content-length: 0
last-modified: Wed, 15 Sep 2021 19:38:30 GMT
etag: "61424bb6-0"
x-backend-server: ip-10-201-16-65.ec2.internal
accept-ranges: bytes
X-Firefox-Spdy: h2

ww1.annsqehena.com/_fd

199.59.243.223

200 OK

56 kB

URL POST HTTP/2
ww1.annsqehena.com/_fd
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type
gzip compressed data, max speed, from Unix\012- data
Size
56 kB (56288 bytes)
Hash
a6f1c681afa444853525e1e5f4e65465
eee10e8952a5dde98598b808cb89cf69494a5772
039c1fe87d218e99eb8a0d5144c8b9486f43b2c084f339d2b0d734bd91509822

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

POST /_fd HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ww1.annsqehena.com/
Content-Type: application/json
Origin: https://ww1.annsqehena.com
DNT: 1
Connection: keep-alive
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; parking_session=9ca9dee1-c00c-57de-73fb-00653c357060
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: openresty
content-type: text/html; charset=UTF-8
date: Mon, 29 May 2023 14:35:56 GMT
x-version: 2.105.3
set-cookie: parking_session=9ca9dee1-c00c-57de-73fb-00653c357060; expires=Mon, 29-May-2023 14:50:56 GMT; Max-Age=900; path=/; httponly
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264

142.250.74.132

200 OK

2.1 kB

URL GET HTTP/3
www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:BA:19:A5:81:25:05:32:72:13:A7:18:CF:67:8C:D6:6F:13:B3:EF
ValidityMon, 08 May 2023 08:20:09 GMT - Mon, 31 Jul 2023 08:20:08 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5507)
Size
2.1 kB (2085 bytes)
Hash
2e65f0b3c5e41aa107c6f90d02739e44
10e3afb04371c3b2bbff3c93e0939b504ea08d36
8cecf8041e2cedda000a67a9f4dbaa25eff4c46787cd582fb485118349addcc7

HTTP Headers

GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Mon, 29 May 2023 14:35:56 GMT
expires: Mon, 29 May 2023 14:35:56 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-UeKH4iY_Qs0WRzzTwEuGhw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2085
x-xss-protection: 0
set-cookie: CONSENT=PENDING+807; expires=Wed, 28-May-2025 14:35:56 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
e202444f49089fa6735f57e2f885afc1
b43c6fef9149614a86afb99c181201b13b33559e
69602a4c6fcac3fe2c73366b48d5998f803bd55e9ea83645e8dccdc2f1349fab

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 29 May 2023 14:35:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
e202444f49089fa6735f57e2f885afc1
b43c6fef9149614a86afb99c181201b13b33559e
69602a4c6fcac3fe2c73366b48d5998f803bd55e9ea83645e8dccdc2f1349fab

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 29 May 2023 14:35:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b

142.250.74.97

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE9:43:A2:2D:EB:A2:E1:09:B0:36:19:CF:E3:9C:F0:37:52:4F:DB:7A
ValidityMon, 08 May 2023 08:24:36 GMT - Mon, 31 Jul 2023 08:24:35 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
174 B (174 bytes)
Hash
d47125b2ba92be53dcff07ba322ce1de
e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28
5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 29 May 2023 06:02:41 GMT
expires: Tue, 30 May 2023 05:02:41 GMT
cache-control: public, max-age=82800
age: 30796
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff

142.250.74.97

200 OK

278 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE9:43:A2:2D:EB:A2:E1:09:B0:36:19:CF:E3:9C:F0:37:52:4F:DB:7A
ValidityMon, 08 May 2023 08:24:36 GMT - Mon, 31 Jul 2023 08:24:35 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (306)
Size
278 B (278 bytes)
Hash
fe7dd8c3c629cc6e9cd6d3e4d3cbe905
59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18
5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 29 May 2023 08:39:40 GMT
expires: Tue, 30 May 2023 07:39:40 GMT
cache-control: public, max-age=82800
age: 21377
last-modified: Tue, 09 Feb 2021 14:15:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
e202444f49089fa6735f57e2f885afc1
b43c6fef9149614a86afb99c181201b13b33559e
69602a4c6fcac3fe2c73366b48d5998f803bd55e9ea83645e8dccdc2f1349fab

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 29 May 2023 14:35:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ww1.annsqehena.com/_tr

199.59.243.223

200 OK

22 B

URL POST HTTP/2
ww1.annsqehena.com/_tr
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type
ASCII text, with no line terminators
Size
22 B (22 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

POST /_tr HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ww1.annsqehena.com/
Content-Type: application/json
Content-Length: 1645
Origin: https://ww1.annsqehena.com
DNT: 1
Connection: keep-alive
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; parking_session=9ca9dee1-c00c-57de-73fb-00653c357060
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
content-type: text/html; charset=UTF-8
date: Mon, 29 May 2023 14:35:57 GMT
x-version: 2.105.3
set-cookie: parking_session=9ca9dee1-c00c-57de-73fb-00653c357060; expires=Mon, 29-May-2023 14:50:57 GMT; Max-Age=900; path=/; httponly
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=h15nflnf5err&aqid=TLh0ZNn1JfOUiM0PsdOwwA8&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=534159633&csala=14%7C0%7C299%7C49%7C397&lle=0&ifv=1&usr=1

142.250.74.132

204 No Content

0 B

URL GET HTTP/3
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=h15nflnf5err&aqid=TLh0ZNn1JfOUiM0PsdOwwA8&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=534159633&csala=14%7C0%7C299%7C49%7C397&lle=0&ifv=1&usr=1
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:BA:19:A5:81:25:05:32:72:13:A7:18:CF:67:8C:D6:6F:13:B3:EF
ValidityMon, 08 May 2023 08:20:09 GMT - Mon, 31 Jul 2023 08:20:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=h15nflnf5err&aqid=TLh0ZNn1JfOUiM0PsdOwwA8&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=534159633&csala=14%7C0%7C299%7C49%7C397&lle=0&ifv=1&usr=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-szB8GtyTkTAeFreQ_I41Gw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Mon, 29 May 2023 14:35:59 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=FBLe-hPc-Ih9tpO6-J6AG-Alr8q5K84hy-6VJLvRZBynJGoLX1dHlLHm0JpyLspu1SbiPaCQHH_DpoHs6wOx-Hzi9HgxfOCwVU804f9LGWSamuGE4dQnBb3nCmhr23Z64kaGrDLQSdLECE18ywIJPBZpb3NZBqTPiwpC7PYgciE; expires=Tue, 28-Nov-2023 14:35:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+927; expires=Wed, 28-May-2025 14:35:59 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/adsense/domains/caf.js

142.250.74.132

200 OK

148 kB

URL GET HTTP/3
www.google.com/adsense/domains/caf.js
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol130%2Cpid-bodis-gcontrol47%2Cpid-bodis-gcontrol48%2Cpid-bodis-gcontrol314%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol458&client=dp-bodis30_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fww1.annsqehena.com%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002&format=r3&nocache=6631685370956216&num=0&output=afd_ads&domain_name=ww1.annsqehena.com&v=3&bsl=8&pac=2&u_his=3&u_tz=0&dt=1685370956217&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=534159633&uio=-&cont=rs&jsid=caf&jsv=534159633&rurl=https%3A%2F%2Fww1.annsqehena.com%2F&referer=http%3A%2F%2Fannsqehena.com%2F&adbw=master-1%3A1264
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:BA:19:A5:81:25:05:32:72:13:A7:18:CF:67:8C:D6:6F:13:B3:EF
ValidityMon, 08 May 2023 08:20:09 GMT - Mon, 31 Jul 2023 08:20:08 GMT

File type
ASCII text, with very long lines (2125)
Size
148 kB (147846 bytes)
Hash
ba14d2be5e6250fd530331e1452ff2b4
fc5b18f25c11b2f3079f46c601bbcba1bb1226f2
afabc2eb29fe9571addda23feeff6993e0dc7bf26eeaba3a292317aea02c30de

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Mon, 29 May 2023 14:35:56 GMT
expires: Mon, 29 May 2023 14:35:56 GMT
cache-control: private, max-age=3600
etag: "522312598558686774"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=pks9wywd0nsr&aqid=TLh0ZNn1JfOUiM0PsdOwwA8&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=534159633&csala=14%7C0%7C299%7C49%7C397&lle=0&ifv=1&usr=1

142.250.74.132

204 No Content

0 B

URL GET HTTP/3
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=pks9wywd0nsr&aqid=TLh0ZNn1JfOUiM0PsdOwwA8&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=534159633&csala=14%7C0%7C299%7C49%7C397&lle=0&ifv=1&usr=1
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:BA:19:A5:81:25:05:32:72:13:A7:18:CF:67:8C:D6:6F:13:B3:EF
ValidityMon, 08 May 2023 08:20:09 GMT - Mon, 31 Jul 2023 08:20:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=pks9wywd0nsr&aqid=TLh0ZNn1JfOUiM0PsdOwwA8&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=534159633&csala=14%7C0%7C299%7C49%7C397&lle=0&ifv=1&usr=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-dtZ2RDChDCxQtZjEsHx7Zg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Mon, 29 May 2023 14:35:58 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=gwypMAYuNuaGXFvntOyoM5ulBbWtj1B10Z2wKWOusKzCUhYd9qaWQkJouHO2E1nkePFwhWFMchZvsv9gQPJLQ7hdgYqBgN61npqtF4wjU_-G7k38Jv2sOe6hiG8Mv9G_MOvIsoWPVuugaNs6O59a3I1te6ehGPnQuH9UVzV3sxo; expires=Tue, 28-Nov-2023 14:35:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+764; expires=Wed, 28-May-2025 14:35:58 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

ww1.annsqehena.com/

199.59.243.223

200 OK

911 B

URL User Request GET HTTP/2
ww1.annsqehena.com/
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (929), with no line terminators
Size
911 B (911 bytes)
Hash
379853157fd9c2e65ceef50d5a196e5c
a73484669524f9a87899f9c8412ad50db236acd7
e31ff8b2086f5075f2cfee5c0e89f64ee9cb1b6cffcb08959d5a1b11f9666e5e

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET / HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://annsqehena.com/
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Mon, 29 May 2023 14:35:55 GMT
content-type: text/html; charset=UTF-8
set-cookie: parking_session=9ca9dee1-c00c-57de-73fb-00653c357060; expires=Mon, 29-May-2023 14:50:55 GMT; Max-Age=900; path=/; HttpOnly
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_EO+Xjx8zdZP+GUbnHYKOstuRbX8NyfN9HkTtz2dnj6dzQUBzDOL1bVo/buTCKPzTwkChN44KGibAR2V9Eff+sw==
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

ww1.annsqehena.com/px.gif?ch=1&rn=2.7190507031814377

199.59.243.223

200 OK

42 B

URL GET HTTP/2
ww1.annsqehena.com/px.gif?ch=1&rn=2.7190507031814377
IP
199.59.243.223:443
ASN
#16509 AMAZON-02

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerLet's Encrypt
Subjectannsqehena.com
Fingerprint8E:F3:74:2D:00:EE:1B:E1:B2:48:63:53:DA:B6:14:75:A5:77:FD:DD
ValidityWed, 17 May 2023 09:44:22 GMT - Tue, 15 Aug 2023 09:44:21 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

HTTP Headers

GET /px.gif?ch=1&rn=2.7190507031814377 HTTP/1.1
Host: ww1.annsqehena.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Cookie: sid=1d403574-fe2e-11ed-9c83-eca7e72d449c; parking_session=9ca9dee1-c00c-57de-73fb-00653c357060
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Mon, 29 May 2023 14:35:56 GMT
content-type: image/gif
content-length: 42
last-modified: Wed, 15 Sep 2021 19:38:30 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ranges: bytes
X-Firefox-Spdy: h2

www.google.com/adsense/domains/caf.js

142.250.74.132

200 OK

148 kB

URL GET HTTP/2
www.google.com/adsense/domains/caf.js
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://ww1.annsqehena.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint48:E3:15:66:FC:EA:15:BF:D2:34:C1:DD:60:D4:23:A3:63:57:89:8D
ValidityMon, 08 May 2023 08:25:18 GMT - Mon, 31 Jul 2023 08:25:17 GMT

File type
ASCII text, with very long lines (2125)
Size
148 kB (147895 bytes)
Hash
2b9b875173663f674242c18e7b69a8ed
897b8c5a9dbc707beed032a04ff9cd8cb3ef6e53
04db145914e70b0fa266540c40ba91ffdb8598b047b16a9ef1045042bfea0c6c

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww1.annsqehena.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Mon, 29 May 2023 14:35:56 GMT
expires: Mon, 29 May 2023 14:35:56 GMT
cache-control: private, max-age=3600
etag: "12740515928199361861"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (21)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type