| syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol454%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww7.tv0800.zip%2F%3Fcaf%3D1%26bpt%3D345%26usid%3D20%26utid%3D16035911385&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2235178347295149&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717108&format=r3&nocache=5541746970882699&num=0&output=afd_ads&domain_name=ww7.tv0800.zip&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1746970882702&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=754937097&rurl=http%3A%2F%2Fww7.tv0800.zip%2F%3Fusid%3D20%26utid%3D16035911385 |  216.58.207.238 | 200 OK | 986 B |
URL GET syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol454%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww7.tv0800.zip%2F%3Fcaf%3D1%26bpt%3D345%26usid%3D20%26utid%3D16035911385&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2235178347295149&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717108&format=r3&nocache=5541746970882699&num=0&output=afd_ads&domain_name=ww7.tv0800.zip&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1746970882702&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=754937097&rurl=http%3A%2F%2Fww7.tv0800.zip%2F%3Fusid%3D20%26utid%3D16035911385 IP216.58.207.238:443
Requested byhttp://ww7.tv0800.zip/?usid=20&utid=16035911385 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog FingerprintDC:F5:98:68:53:E0:CF:EF:0C:D9:7C:BF:2E:FE:35:0F:48:72:BE:F4 ValidityMon, 21 Apr 2025 08:43:52 GMT - Mon, 14 Jul 2025 08:43:51 GMT
File typeHTML document, ASCII text, with very long lines (492) Hashfc082a1032bc4bd3aed7f955bccbccc5 56e58196c89a2608d97f69c36d624b0c1870cf8b 94376f37e4113415ae0c8a0c22393205adc1b805008fc8b6c94688587340cb50
GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol454%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww7.tv0800.zip%2F%3Fcaf%3D1%26bpt%3D345%26usid%3D20%26utid%3D16035911385&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2235178347295149&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717108&format=r3&nocache=5541746970882699&num=0&output=afd_ads&domain_name=ww7.tv0800.zip&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1746970882702&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=754937097&rurl=http%3A%2F%2Fww7.tv0800.zip%2F%3Fusid%3D20%26utid%3D16035911385 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww7.tv0800.zip/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sun, 11 May 2025 13:41:22 GMT
expires: Sun, 11 May 2025 13:41:22 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-QEPFUnc7C6N1IQbmYBGB7w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 580
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ww7.tv0800.zip/_zc | 199.59.243.228 | 500 Internal Server Error | 25 B |
IP199.59.243.228:80
Requested byhttp://ww7.tv0800.zip/?usid=20&utid=16035911385
File typeASCII text, with no line terminators Hasha8006331287f708f5ec230ffb88be0b3 fb16894e76f477aa0bd76cf71da5af79ae14e4ed 3290109709a4ec715d72d9f6d1d903b5de76f8d5d44a65ec1c708e922e9d2da9
POST /_zc HTTP/1.1
Host: ww7.tv0800.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww7.tv0800.zip/?usid=20&utid=16035911385
Content-Type: application/json
Content-Length: 5745
Origin: http://ww7.tv0800.zip
DNT: 1
Connection: keep-alive
Cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 500 Internal Server Error
date: Sun, 11 May 2025 13:41:22 GMT
content-type: application/json; charset=utf-8
content-length: 25
x-request-id: 018bbafa-69b3-48f4-8343-c519187f78e3
set-cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a; expires=Sun, 11 May 2025 13:56:23 GMT
|
|
| ww7.tv0800.zip/_tr | 199.59.243.228 | 200 OK | 2 B |
IP199.59.243.228:80
Requested byhttp://ww7.tv0800.zip/?usid=20&utid=16035911385
File typeASCII text, with no line terminators Hash444bcb3a3fcf8389296c49467f27e1d6 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
POST /_tr HTTP/1.1
Host: ww7.tv0800.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww7.tv0800.zip/?usid=20&utid=16035911385
Content-Type: application/json
Content-Length: 1953
Origin: http://ww7.tv0800.zip
DNT: 1
Connection: keep-alive
Cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sun, 11 May 2025 13:41:23 GMT
content-type: application/json; charset=utf-8
content-length: 2
x-request-id: 54e84a4e-6246-4800-b045-4c2bfd75c578
set-cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a; expires=Sun, 11 May 2025 13:56:23 GMT
|
|
| | 72.52.179.175 | 302 Found | 1.1 kB |
IP72.52.179.175:443
CertificateIssuerLet's Encrypt Subjecttv0800.zip Fingerprint0D:E7:7C:9A:EA:E2:40:4D:7B:1A:17:EF:BF:EF:D0:09:EF:75:07:77 ValidityMon, 28 Apr 2025 00:12:46 GMT - Sun, 27 Jul 2025 00:12:45 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: tv0800.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sun, 11 May 2025 13:41:21 GMT
content-type: text/html
content-length: 0
location: http://ww7.tv0800.zip/?usid=20&utid=16035911385
cache-control: no-cache
pragma: no-cache
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| ww7.tv0800.zip/?usid=20&utid=16035911385 | 199.59.243.228 | 200 OK | 1.1 kB |
URL User Request GET ww7.tv0800.zip/?usid=20&utid=16035911385 IP199.59.243.228:80
File typeHTML document, ASCII text, with very long lines (394) Hash954af8f42493df05c9c8762d1ab3f5dd 2ca356aef9dc0deae5176923905341879ffd957c ecac652ec71814d4fbca07f705a7a3fa0c9934832bf714c3d9f6cc2227eeb3c4
| NIDS | Severity | Alert |
|---|
| suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /?usid=20&utid=16035911385 HTTP/1.1
Host: ww7.tv0800.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sun, 11 May 2025 13:41:21 GMT
content-type: text/html; charset=utf-8
content-length: 1126
x-request-id: 57be110e-0fce-4e64-9a53-2829b8925b7a
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_EGUtijEe31Tw03jawza/kiqNou1CePPM4ICN6SrqpW67YCx2QeoQKK5fZDyEBnhQoNnA5zcasCP35XoWW1okYA==
set-cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a; expires=Sun, 11 May 2025 13:56:21 GMT; path=/
|
|
| ww7.tv0800.zip/bIXcqLSpU.js | 199.59.243.228 | 200 OK | 36 kB |
URL GET ww7.tv0800.zip/bIXcqLSpU.js IP199.59.243.228:80
Requested byhttp://ww7.tv0800.zip/?usid=20&utid=16035911385
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (36279) Hash82325fd279d4e5a3e2578b2ccb5b4386 8da650feff7f8b773ae21fd618da7fd582d0a0ff d888611f6e81c27e41550584e3ae0e6507e2c43a592edddc3981bb774c5583dc
| NIDS | Severity | Alert |
|---|
| suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /bIXcqLSpU.js HTTP/1.1
Host: ww7.tv0800.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww7.tv0800.zip/?usid=20&utid=16035911385
Cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sun, 11 May 2025 13:41:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 36282
x-request-id: 13c56cb7-f352-4ff0-93b6-317f9e4701ff
set-cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a; expires=Sun, 11 May 2025 13:56:22 GMT
|
|
| www.google.com/adsense/domains/caf.js?abp=1&bodis=true | 142.250.74.68 | 200 OK | 143 kB |
URL GET www.google.com/adsense/domains/caf.js?abp=1&bodis=true IP142.250.74.68:443
Requested byhttp://ww7.tv0800.zip/?usid=20&utid=16035911385 CertificateIssuerGoogle Trust Services Subjectwww.google.com FingerprintC0:9B:21:A5:10:36:7E:DC:25:8D:0B:AB:4B:D9:D7:AD:92:06:96:49 ValidityMon, 21 Apr 2025 08:42:35 GMT - Mon, 14 Jul 2025 08:42:34 GMT
File typeJavaScript source, ASCII text, with very long lines (1839) Size143 kB (143318 bytes) Hash3304efd24dfa8c4c7ce40f3de600b4e9 03123332d63cb05c2e839167db15d213579b351d 0c52f00df6667982d053daab715ab61912b336347026c51bfb3afd401213a787
GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww7.tv0800.zip/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sun, 11 May 2025 13:41:22 GMT
expires: Sun, 11 May 2025 13:41:22 GMT
cache-control: private, max-age=3600
etag: "4995297505324853359"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ww7.tv0800.zip/_fd?usid=20&utid=16035911385 | 199.59.243.228 | 200 OK | 5.2 kB |
URL POST ww7.tv0800.zip/_fd?usid=20&utid=16035911385 IP199.59.243.228:80
Requested byhttp://ww7.tv0800.zip/?usid=20&utid=16035911385
File typeASCII text, with very long lines (5173), with no line terminators Hash91666de03e536ecc563f801e799a62e0 2d2ed99d4580ef82a1cd35d394aca99f7b3aeea7 fd5627e95e72695679c49246a4951a4e7806715a8ac44966319b15d5db033691
| NIDS | Severity | Alert |
|---|
| suricata | low | ET INFO HTTP Request to a *.zip Domain |
POST /_fd?usid=20&utid=16035911385 HTTP/1.1
Host: ww7.tv0800.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww7.tv0800.zip/?usid=20&utid=16035911385
Content-Type: application/json
Origin: http://ww7.tv0800.zip
DNT: 1
Connection: keep-alive
Cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/1.1 200 OK
date: Sun, 11 May 2025 13:41:21 GMT
content-type: application/json; charset=utf-8
content-length: 5173
x-request-id: b3ca1393-27dc-451a-8d14-da5d4d400c89
set-cookie: parking_session=57be110e-0fce-4e64-9a53-2829b8925b7a; expires=Sun, 11 May 2025 13:56:22 GMT
|
|
0.0.0.0