Report - r2---sn-nuagpm-nuae.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?cms_redirect=yes&mh=tU&mip=208.83.5.148&mm=28&mn=sn-nuagpm-nuae&ms=nvh&mt=1718131120&mv=u&mvi=2&pl=23&shardbypass=sd

Report Overview

Visited public
2024-06-11 18:51:29
Tags
Submit Tags
URL
r2---sn-nuagpm-nuae.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?cms_redirect=yes&mh=tU&mip=208.83.5.148&mm=28&mn=sn-nuagpm-nuae&ms=nvh&mt=1718131120&mv=u&mvi=2&pl=23&shardbypass=sd
Finishing URL
about:privatebrowsing
IP / ASN
208.110.67.45
#32097 WII
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

0

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
o.pki.goog	unknown	2016-06-13	2024-04-24 13:44:57	2024-06-10 18:32:50	650 B	1.4 kB	142.250.74.131
r2---sn-nuagpm-nuae.gvt1.com	623016	2008-03-03	2023-07-28 09:36:56	2024-04-17 18:57:33	643 B	619 B	208.110.67.45
r2---sn-p5qs7n6d.gvt1.com	unknown	2008-03-03	2023-04-26 08:40:47	2024-03-01 17:37:32	747 B	684 B	173.194.7.199
r5---sn-5goeenez.gvt1.com	unknown	2008-03-03	2022-06-05 08:09:40	2024-06-07 14:48:53	812 B	9.2 MB	74.125.111.10

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (5)

	URL	IP	Response	Size
	o.pki.goog/wr2	142.250.74.131		471 B
URL o.pki.goog/wr2 IP 142.250.74.131:0 ASN #15169 GOOGLE File type data Size 471 B (471 bytes) Hash 0d4bc19390da103de6b979e42e073251 798ef4f7e17ee1ad97ec18fbe698f97ae8205d47 a1ad241f4aa45fc8137bd1d405cf8e4070a9bc0c83f325438ca31fb6982442d8 HTTP Headers `POST /wr2 HTTP/1.1 Host: o.pki.goog User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Tue, 11 Jun 2024 18:51:02 GMT Cache-Control: public, max-age=14400 Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN`

	GET r2---sn-nuagpm-nuae.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?cms_redirect=yes&mh=tU&mip=208.83.5.148&mm=28&mn=sn-nuagpm-nuae&ms=nvh&mt=1718131120&mv=u&mvi=2&pl=23&shardbypass=sd	208.110.67.45	302 Found	0 B
URL User Request GET HTTP/1.1 r2---sn-nuagpm-nuae.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?cms_redirect=yes&mh=tU&mip=208.83.5.148&mm=28&mn=sn-nuagpm-nuae&ms=nvh&mt=1718131120&mv=u&mvi=2&pl=23&shardbypass=sd IP 208.110.67.45:443 ASN #32097 WII Certificate IssuerGoogle Trust Services Subject.googlevideo.com Fingerprint24:DC:54:BD:EB:4B:5A:7F:73:3B:7F:4E:DB:FE:A4:DC:0A:98:F0:7C ValidityTue, 04 Jun 2024 14:33:27 GMT - Tue, 13 Aug 2024 14:33:26 GMT File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?cms_redirect=yes&mh=tU&mip=208.83.5.148&mm=28&mn=sn-nuagpm-nuae&ms=nvh&mt=1718131120&mv=u&mvi=2&pl=23&shardbypass=sd HTTP/1.1 Host: r2---sn-nuagpm-nuae.gvt1.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 302 Found Last-Modified: Wed, 02 May 2007 10:26:10 GMT Date: Tue, 11 Jun 2024 18:51:02 GMT Expires: Tue, 11 Jun 2024 19:06:02 GMT Cache-Control: public, max-age=900 Location: https://r2---sn-p5qs7n6d.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=23&shardbypass=sd&redirect_counter=1&rm=sn-nuagpm-nuae7l&fexp=24350485&req_id=c4588474d0d5d51f&cms_redirect=yes&mip=208.83.5.148&mm=42&mn=sn-p5qs7n6d&ms=onc&mt=1718131297&mv=u&mvi=2&smhost=r4---sn-p5qddn76.gvt1.com Content-Length: 0 Connection: close Vary: Origin X-Content-Type-Options: nosniff Content-Type: text/html Server: gvs 1.0

	o.pki.goog/wr2	142.250.74.131		471 B
URL o.pki.goog/wr2 IP 142.250.74.131:0 ASN #15169 GOOGLE File type data Size 471 B (471 bytes) Hash 2a1a80cc3b5ce79644fede57f35e033e 973030fe5af60407d113cf4b754137206a6441a4 e181d4cad42c3422238e6e62f49fec5d0023e2737c9d1e8f1db2d853bf5501aa HTTP Headers `POST /wr2 HTTP/1.1 Host: o.pki.goog User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Tue, 11 Jun 2024 18:51:02 GMT Cache-Control: public, max-age=14400 Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN`

	GET r2---sn-p5qs7n6d.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=23&shardbypass=sd&redirect_counter=1&rm=sn-nuagpm-nuae7l&fexp=24350485&req_id=c4588474d0d5d51f&cms_redirect=yes&mip=208.83.5.148&mm=42&mn=sn-p5qs7n6d&ms=onc&mt=1718131297&mv=u&mvi=2&smhost=r4---sn-p5qddn76.gvt1.com	173.194.7.199	302 Found	0 B
URL User Request GET HTTP/1.1 r2---sn-p5qs7n6d.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=23&shardbypass=sd&redirect_counter=1&rm=sn-nuagpm-nuae7l&fexp=24350485&req_id=c4588474d0d5d51f&cms_redirect=yes&mip=208.83.5.148&mm=42&mn=sn-p5qs7n6d&ms=onc&mt=1718131297&mv=u&mvi=2&smhost=r4---sn-p5qddn76.gvt1.com IP 173.194.7.199:443 ASN #15169 GOOGLE Certificate IssuerGoogle Trust Services Subject.c.docs.google.com FingerprintFF:18:57:FA:E7:6E:1E:B5:15:A5:75:DE:FA:BA:E4:63:86:4C:84:77 ValidityTue, 04 Jun 2024 14:34:00 GMT - Tue, 13 Aug 2024 14:33:59 GMT File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=23&shardbypass=sd&redirect_counter=1&rm=sn-nuagpm-nuae7l&fexp=24350485&req_id=c4588474d0d5d51f&cms_redirect=yes&mip=208.83.5.148&mm=42&mn=sn-p5qs7n6d&ms=onc&mt=1718131297&mv=u&mvi=2&smhost=r4---sn-p5qddn76.gvt1.com HTTP/1.1 Host: r2---sn-p5qs7n6d.gvt1.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 302 Found Last-Modified: Wed, 02 May 2007 10:26:10 GMT Date: Tue, 11 Jun 2024 18:51:02 GMT Expires: Tue, 11 Jun 2024 19:06:02 GMT Cache-Control: public, max-age=900 Location: https://r5---sn-5goeenez.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=21&shardbypass=sd&rm=sn-nuagpm-nuae7l,sn-p5qell7l&fexp=24350485&req_id=c4588474d0d5d51f&redirect_counter=2&cms_redirect=yes&cmsv=e&ipbypass=yes&mip=91.90.42.154&mm=42&mn=sn-5goeenez&ms=onc&mt=1718131297&mv=u&mvi=5&rmhost=r3---sn-5goeenez.gvt1.com&smhost=r2---sn-5goeenes.gvt1.com Content-Length: 0 Connection: close Vary: Origin X-Content-Type-Options: nosniff Content-Type: text/html Server: gvs 1.0

	GET r5---sn-5goeenez.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=21&shardbypass=sd&rm=sn-nuagpm-nuae7l,sn-p5qell7l&fexp=24350485&req_id=c4588474d0d5d51f&redirect_counter=2&cms_redirect=yes&cmsv=e&ipbypass=yes&mip=91.90.42.154&mm=42&mn=sn-5goeenez&ms=onc&mt=1718131297&mv=u&mvi=5&rmhost=r3---sn-5goeenez.gvt1.com&smhost=r2---sn-5goeenes.gvt1.com	74.125.111.10	200 OK	9.2 MB
URL User Request GET HTTP/1.1 r5---sn-5goeenez.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=21&shardbypass=sd&rm=sn-nuagpm-nuae7l,sn-p5qell7l&fexp=24350485&req_id=c4588474d0d5d51f&redirect_counter=2&cms_redirect=yes&cmsv=e&ipbypass=yes&mip=91.90.42.154&mm=42&mn=sn-5goeenez&ms=onc&mt=1718131297&mv=u&mvi=5&rmhost=r3---sn-5goeenez.gvt1.com&smhost=r2---sn-5goeenes.gvt1.com IP 74.125.111.10:443 ASN #15169 GOOGLE Certificate IssuerGoogle Trust Services LLC Subject.c.docs.google.com Fingerprint4A:C2:0A:61:A2:BE:B0:4C:73:0C:7F:BC:00:EE:C6:D0:D6:56:E6:0C ValidityTue, 14 May 2024 14:31:14 GMT - Tue, 23 Jul 2024 14:31:13 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 9.2 MB (9160906 bytes) Hash f101820264b47ebf64900d261b4c3998 db767d86c075d14f75d4df61a69ce257d75104a6 719296cfece6afed4f33863ba92a79abdebd9bd0bd3ee69f70836d26e523aa0c HTTP Headers GET /edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip?mh=tU&pl=21&shardbypass=sd&rm=sn-nuagpm-nuae7l,sn-p5qell7l&fexp=24350485&req_id=c4588474d0d5d51f&redirect_counter=2&cms_redirect=yes&cmsv=e&ipbypass=yes&mip=91.90.42.154&mm=42&mn=sn-5goeenez&ms=onc&mt=1718131297&mv=u&mvi=5&rmhost=r3---sn-5goeenez.gvt1.com&smhost=r2---sn-5goeenes.gvt1.com HTTP/1.1 Host: r5---sn-5goeenez.gvt1.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: public,max-age=86400 Content-Disposition: attachment Content-Length: 9160906 Content-Security-Policy: default-src 'none' Content-Type: application/zip Etag: "1038511" Server: downloads X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Date: Tue, 11 Jun 2024 18:51:03 GMT Last-Modified: Wed, 16 Nov 2022 03:24:42 GMT Connection: keep-alive Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" Vary: Origin