Report - lsbozonsta.wcnv20.cn/

Report Overview

Visitedpublic

2025-06-06 15:08:19

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
lsbozonsta.wcnv20.cn	unknown	2022-12-20	2025-03-09	2025-03-09	1.9 kB	35 kB	139.162.174.209
www.google.com	7	1997-09-15	2015-05-10	2025-06-04	447 B	144 kB	142.250.74.68

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-06-06	medium	wcnv20.cn	Sinkholed
2025-06-06	medium	wcnv20.cn	Sinkholed
2025-06-06	medium	wcnv20.cn	Sinkholed
2025-06-06	medium	wcnv20.cn	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	From	Size	First Seen	Last Seen
	lsbozonsta.wcnv20.cn/_static/deliver.js?nonce=3498571	ScriptElement	29 kB	2025-05-30	2025-06-09
URL lsbozonsta.wcnv20.cn/_static/deliver.js?nonce=3498571 IP / ASN 139.162.174.209 #63949 Akamai Connected Cloud Introduced by ScriptElement Embedded false Resource Info First Seen 2025-05-30 Last Seen 2025-06-09 Times Seen 58 Size 29 kB (29008 bytes) MD5 bbcd106a0a21ddb8d9775233e8d92024 SHA1 cee63d5035bfda975fb38bf606f2cba053fa1172 SHA256 5e4314b76c73b7c52de707317456138d833320cfc2d6ce68c7d1e2f872d73993 Format Code Loading...

	www.google.com/adsense/domains/caf.js?abp=1&abpgo=true	ScriptElement	143 kB	2025-06-06	2025-06-10
URL www.google.com/adsense/domains/caf.js?abp=1&abpgo=true IP / ASN 142.250.74.68 #15169 GOOGLE Introduced by ScriptElement Embedded false Resource Info First Seen 2025-06-06 Last Seen 2025-06-10 Times Seen 1939 Size 143 kB (143195 bytes) MD5 0c12d599500cae6d08feb2adda22ce4a SHA1 efe791909c852f40a8346177f40b4979691208eb SHA256 39e7dd999707b167c0a3e1830469e5cafb0c34626b8e7057044cc3e3344111bb Format Code Loading...

HTTP Transactions (5)

URL IP Response Size

GET lsbozonsta.wcnv20.cn/

139.162.174.209

200 OK

3.3 kB

URL

lsbozonsta.wcnv20.cn/

IP / ASN

139.162.174.209

#63949 Akamai Connected Cloud

Requested byN/A

Resource Info

File typeHTML document, ASCII text

First Seen2025-06-06

Last Seen2025-06-06

Times Seen2

Size3.3 kB (3266 bytes)

MD5661a6134116817132e520fd6995bff5a

SHA199f73ba27a28a57eeeb1508d002cd587a3e090bd

SHA25685d00e46161cfaa185eb53d8d3f56519859519f4e239137edcc9ae30f726baff

Certificate Info

IssuerLet's Encrypt

Subjectwcnv20.cn

FingerprintBF:AB:A9:75:1A:1E:D1:1F:59:94:4D:BA:4B:2F:7F:D0:19:06:68:30

ValiditySun, 20 Apr 2025 12:14:39 GMT - Sat, 19 Jul 2025 12:14:38 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: lsbozonsta.wcnv20.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.27.1.2
date: Fri, 06 Jun 2025 15:07:57 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=0; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

GET lsbozonsta.wcnv20.cn/_static/deliver.js?nonce=3498571

139.162.174.209

200 OK

29 kB

URL

lsbozonsta.wcnv20.cn/_static/deliver.js?nonce=3498571

IP / ASN

139.162.174.209

#63949 Akamai Connected Cloud

Requested byhttps://lsbozonsta.wcnv20.cn/

Resource Info

File typeC++ source, ASCII text

First Seen2025-05-30

Last Seen2025-06-09

Times Seen58

Size29 kB (29008 bytes)

MD5bbcd106a0a21ddb8d9775233e8d92024

SHA1cee63d5035bfda975fb38bf606f2cba053fa1172

SHA2565e4314b76c73b7c52de707317456138d833320cfc2d6ce68c7d1e2f872d73993

Certificate Info

IssuerLet's Encrypt

Subjectwcnv20.cn

FingerprintBF:AB:A9:75:1A:1E:D1:1F:59:94:4D:BA:4B:2F:7F:D0:19:06:68:30

ValiditySun, 20 Apr 2025 12:14:39 GMT - Sat, 19 Jul 2025 12:14:38 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /_static/deliver.js?nonce=3498571 HTTP/1.1
Host: lsbozonsta.wcnv20.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lsbozonsta.wcnv20.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.27.1.2
date: Fri, 06 Jun 2025 15:07:57 GMT
content-type: application/javascript
last-modified: Fri, 30 May 2025 11:51:00 GMT
vary: Accept-Encoding
etag: W/"68399ba4-7150"
strict-transport-security: max-age=0; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

POST lsbozonsta.wcnv20.cn/_d

139.162.174.209

200 OK

968 B

URL

lsbozonsta.wcnv20.cn/_d

IP / ASN

139.162.174.209

#63949 Akamai Connected Cloud

Requested byhttps://lsbozonsta.wcnv20.cn/

Resource Info

File typeJSON text data

First Seen2025-06-06

Last Seen2025-06-06

Times Seen1

Size968 B (968 bytes)

MD5f48334661132b2bb6ae0d56711a4510a

SHA1b0c638511e26f235164e70b4a95092dcb8bee3ec

SHA25603d5f94cbc58660e94a94b63dcfd5d43f2e0df5b5ac00f8b3f31a7ca831e6682

Certificate Info

IssuerLet's Encrypt

Subjectwcnv20.cn

FingerprintBF:AB:A9:75:1A:1E:D1:1F:59:94:4D:BA:4B:2F:7F:D0:19:06:68:30

ValiditySun, 20 Apr 2025 12:14:39 GMT - Sat, 19 Jul 2025 12:14:38 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /_d HTTP/1.1
Host: lsbozonsta.wcnv20.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lsbozonsta.wcnv20.cn/
Content-Type: application/json
Content-Length: 285
Origin: https://lsbozonsta.wcnv20.cn
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.27.1.2
date: Fri, 06 Jun 2025 15:07:57 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
set-cookie: session_id=213ee92d5f68d3de192ff4939a6c4fde; Max-Age=86400; Path=/; HttpOnly; SameSite=Lax
strict-transport-security: max-age=0; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

GET lsbozonsta.wcnv20.cn/apple-touch-icon.png

139.162.174.209

404 Not Found

159 B

URL

lsbozonsta.wcnv20.cn/apple-touch-icon.png

IP / ASN

139.162.174.209

#63949 Akamai Connected Cloud

Requested byhttps://lsbozonsta.wcnv20.cn/

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2025-04-14

Last Seen2025-08-01

Times Seen347

Size159 B (159 bytes)

MD51620e905665c273e91a8cb2a00df1509

SHA1e0ea169369ad349affad0f6d41987a73fea0280f

SHA2565a41c6b1c3d5061adbd15744312c919ee4a639abc0572a2927b06838bec1a6ed

Certificate Info

IssuerLet's Encrypt

Subjectwcnv20.cn

FingerprintBF:AB:A9:75:1A:1E:D1:1F:59:94:4D:BA:4B:2F:7F:D0:19:06:68:30

ValiditySun, 20 Apr 2025 12:14:39 GMT - Sat, 19 Jul 2025 12:14:38 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /apple-touch-icon.png HTTP/1.1
Host: lsbozonsta.wcnv20.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lsbozonsta.wcnv20.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
server: openresty/1.27.1.2
date: Fri, 06 Jun 2025 15:07:57 GMT
content-type: text/html
vary: Accept-Encoding
strict-transport-security: max-age=0; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

GET www.google.com/adsense/domains/caf.js?abp=1&abpgo=true

142.250.74.68

200 OK

143 kB

URL

www.google.com/adsense/domains/caf.js?abp=1&abpgo=true

IP / ASN

142.250.74.68

#15169 GOOGLE

Requested byhttps://lsbozonsta.wcnv20.cn/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (1839)

First Seen2025-06-06

Last Seen2025-06-10

Times Seen1939

Size143 kB (143195 bytes)

MD50c12d599500cae6d08feb2adda22ce4a

SHA1efe791909c852f40a8346177f40b4979691208eb

SHA25639e7dd999707b167c0a3e1830469e5cafb0c34626b8e7057044cc3e3344111bb

Certificate Info

IssuerGoogle Trust Services

Subjectwww.google.com

Fingerprint84:BD:0D:9A:51:CC:86:3E:E9:2F:6E:7C:2D:58:AC:4C:FB:B5:3D:8C

ValidityMon, 12 May 2025 08:44:44 GMT - Mon, 04 Aug 2025 08:44:43 GMT

HTTP Headers

GET /adsense/domains/caf.js?abp=1&abpgo=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lsbozonsta.wcnv20.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Fri, 06 Jun 2025 15:07:57 GMT
expires: Fri, 06 Jun 2025 15:07:57 GMT
cache-control: private, max-age=3600
etag: "560773302986700416"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2