Edit tour

Windows Analysis Report
https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link

Overview

General Information

Sample URL:	https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=a
Analysis ID:	1589974
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://login.microsoftonline.de

Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://uksmart.andersonsxl.com/index/... This script demonstrates high-risk behavior by redirecting the user to potentially malicious domains based on the presence of a camera. The script uses the `navigator.mediaDevices.enumerateDevices()` API to detect the presence of a camera, and then redirects the user to either a suspicious domain (`www-klarna.com/xf?kamis`) or a legitimate domain (`www.bing.com`). This behavior is considered highly suspicious and potentially malicious, as it could be used to redirect users to phishing or malware-hosting sites. Additionally, the script does not provide any transparency or user consent for the redirection, which further increases the risk.

Source: https://www.bing.com/

HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=5af0d34d-2d36-4373-bb72-b45d0bf98afb&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22682CAB0889CD430FA1EE3275350AF4B5%22%7d&sso_reload=true bing microsoftonline

Source: https://www.bing.com/

HTTP Parser: Number of links: 0

Source: https://www.bing.com/

HTTP Parser: Base64 decoded: {"balance":0,"goalTrackEnabled":true,"goalTrackBalance":200,"slim":false,"autoOpenFlyoutIdSelector":"id_h","navUrl":null}

Source: https://www.bing.com/

HTTP Parser: Title: Redirecting does not match URL

Source: https://uksmart.andersonsxl.com/index/	HTTP Parser: No favicon
Source: https://www.bing.com/	HTTP Parser: No favicon
Source: https://www.bing.com/	HTTP Parser: No favicon

Source: https://www.bing.com/

HTTP Parser: No <meta name="author".. found

Source: https://www.bing.com/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:53794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:53964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:54376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:54763 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.6:53764 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: izi.fyi to https://uksmart.andersonsxl.com/index

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET /orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link HTTP/1.1Host: shortener.kountryboyzbailbonds.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hHmxws?https%3A%2F%2Fgo_microsoft_com%2Fref= HTTP/1.1Host: izi.fyiConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index HTTP/1.1Host: uksmart.andersonsxl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index/ HTTP/1.1Host: uksmart.andersonsxl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: uksmart.andersonsxl.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=32C420A0C511633031E535D3C44D6219&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=32C420A0C511633031E535D3C44D6219&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=32C420A0C511633031E535D3C44D6219&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=32C420A0C511633031E535D3C44D6219&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: obuid=36490854-adf6-418b-861f-16d10c4f0208
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tluidp=182452588984791667886; tluid=182452588984791667886
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=32C420A0C511633031E535D3C44D6219&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=32C420A0C511633031E535D3C44D6219;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32C420A0C511633031E535D3C44D6219%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D32C420A0C511633031E535D3C44D6219%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32C420A0C511633031E535D3C44D6219%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tluid=182452588984791667886
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=32C420A0C511633031E535D3C44D6219&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ayl_visitor=48a6a58ce5dc63f3451ab1c6ef889551
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __mguid_=22210ca799c7886b13j2of00m5uysj0m
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3797695446406130000V10; data-nms=32C420A0C511633031E535D3C44D6219~~3
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __mguid_=22210ca799c7886b1be1mq00m5uysjep
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBMj5hGcCEBeRyg1C_ipnPX4c-NYgpJYFEgEBAQFLhmeOZwAAAAAA_eMAAA&S=AQAAAk76nMAUWBG4OboBpAt_iw4
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D32C420A0C511633031E535D3C44D6219%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828; anj=dTM7k!M4/8CxrEQF']wIg2C%wvA8Yn!]tbP6j2F-XstGt!@DgA$qJ_(
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32C420A0C511633031E535D3C44D6219%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828; anj=dTM7k!M4/8CxrEQF']wIg2C%wvA8Yn!]tbP6j2F-XstGt!@DgA$qJ_(
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828; anj=dTM7k!M4/8D>6NRF']wIg2C%wvA8Yn!fst<+Qjk3PlZ[C[-kX-gFA>F
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D32C420A0C511633031E535D3C44D6219%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828; anj=dTM7k!M4/8CxrEQF']wIg2C%wvA8Yn!]tay8bhzs#DIgl#Xsf[g9a1O
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=5888861485422858828; anj=dTM7k!M4.FEVNsVF']wIg2C%wvA8Yn!fst<$+O^:p?cM9Z<b=AGzkHEEHm1_Gmi[xEt+=pH!8ZOH!KOwGlzG8Es8VI=ChU7dyeB!AXTO:4=sB!J75*)#A:
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.bing.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; uuid2=5888861485422858828; anj=dTM7k!M4/8D>6NRF']wIg2C%wvA8Yn!b--?#MOY-PlZ[C[-kX-gQ6P^
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=5888861485422858828; XANDR_PANID=Utu_KUj3v6O4bYPIO-7yD7o6672Fr9iBRmdDYPOpThsusjdzMS5pCrPO5biYidr8r5QhZn9L_VAV4VgQy6uNOHgGOBa34mcRqmbpo20MBoI.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2C%wvA8Yn!b--?e'5M9Z=f1CByY$Nd>_nce8tfEcyM8fi-41ucyD$fjGe=nka.6beU_IQ?[0u+ff?^hbpRzqF1`b`)%eeWZ

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: shortener.kountryboyzbailbonds.com
Source: global traffic	DNS traffic detected: DNS query: izi.fyi
Source: global traffic	DNS traffic detected: DNS query: uksmart.andersonsxl.com
Source: global traffic	DNS traffic detected: DNS query: aefd.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: www.msn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: srtb.msn.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: trc.taboola.com
Source: global traffic	DNS traffic detected: DNS query: sync.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: hbx.media.net
Source: global traffic	DNS traffic detected: DNS query: cm.mgid.com
Source: global traffic	DNS traffic detected: DNS query: eb2.3lift.com
Source: global traffic	DNS traffic detected: DNS query: code.yengo.com
Source: global traffic	DNS traffic detected: DNS query: visitor.omnitagjs.com
Source: global traffic	DNS traffic detected: DNS query: trace.mediago.io
Source: global traffic	DNS traffic detected: DNS query: trace.popin.cc
Source: global traffic	DNS traffic detected: DNS query: m.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: sync.inmobi.com
Source: global traffic	DNS traffic detected: DNS query: ecn.dev.virtualearth.net
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 13 Jan 2025 11:31:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Security-Policy: frame-ansectors 'self'X-Frame-Options: DENYStrict-Transport-Security: max-age=31536000Referrer-Policy: no-referrerX-XSS-Protection: 1; mode=blockX-Permitted-Cross-Domain-Policies: noneX-Content-Type-Options: nosniffVary: User-AgentStrict-Transport-Security: max-age=31536000;

Source: unknown	Network traffic detected: HTTP traffic on port 54286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 54282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53964
Source: unknown	Network traffic detected: HTTP traffic on port 54760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54380
Source: unknown	Network traffic detected: HTTP traffic on port 54417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54384
Source: unknown	Network traffic detected: HTTP traffic on port 53806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54309
Source: unknown	Network traffic detected: HTTP traffic on port 54319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54307
Source: unknown	Network traffic detected: HTTP traffic on port 54283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54269
Source: unknown	Network traffic detected: HTTP traffic on port 54279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54266
Source: unknown	Network traffic detected: HTTP traffic on port 54407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54270
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54318
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54316
Source: unknown	Network traffic detected: HTTP traffic on port 53799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54281
Source: unknown	Network traffic detected: HTTP traffic on port 54380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54280
Source: unknown	Network traffic detected: HTTP traffic on port 54271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54320
Source: unknown	Network traffic detected: HTTP traffic on port 54384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 54268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54407
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53794
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54442
Source: unknown	Network traffic detected: HTTP traffic on port 54317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54291
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54373
Source: unknown	Network traffic detected: HTTP traffic on port 54267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 54307 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 --field-trial-handle=1964,i,1886670184699811256,13686911613010007438,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-dark	0%	Avira URL Cloud	safe
https://login.microsoftonline.de	100%	Avira URL Cloud	phishing
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	0%	Avira URL Cloud	safe
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	0%	Avira URL Cloud	safe
https://www-klarna.com/xf?kamis	0%	Avira URL Cloud	safe
https://sesamorestaurant.com/news/italian-cuisine-why-is-it-loved-so-much/	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13KMUG-dark	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8	0%	Avira URL Cloud	safe
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	0%	Avira URL Cloud	safe
https://www.neverendingvoyage.com/dos-and-donts-of-eating-in-italy/	0%	Avira URL Cloud	safe
https://uksmart.andersonsxl.com/index	0%	Avira URL Cloud	safe
https://www.financebuzz.com/supplement-income-55mp?utm_source=msn-money&utm_medium=feed&synd_slide=1	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark	0%	Avira URL Cloud	safe
https://terryfator.com/tour/	0%	Avira URL Cloud	safe
https://izi.fyi/hHmxws?https%3A%2F%2Fgo_microsoft_com%2Fref=	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8-dark	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13KMUG	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
nydc1.outbrain.org	64.202.112.127	true	false	high
cm.mgid.com	104.19.132.76	true	false	high
uksmart.andersonsxl.com	4.157.242.144	true	true	unknown
hbx.media.net	23.212.88.20	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
eu-eb2.3lift.com	13.248.245.213	true	false	high
lb-sin.mgid.com	172.241.51.68	true	false	high
trace.popin.cc	35.213.89.133	true	false	high
trace.mediago.io	35.208.249.213	true	false	high
dualstack.tls13.taboola.map.fastly.net	151.101.129.44	true	false	high
ds-pr-bh.ybp.gysm.yahoodns.net	3.248.108.242	true	false	high
www.google.com	142.250.184.228	true	false	high
izi.fyi	13.228.197.79	true	false	unknown
m.anycast.adnxs.com	185.89.210.244	true	false	high
visitor-fra02.omnitagjs.com	185.255.84.153	true	false	high
ib.anycast.adnxs.com	185.89.210.90	true	false	high
shortener.kountryboyzbailbonds.com	52.252.178.123	true	false	unknown
sync.inmobi.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
srtb.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ecn.dev.virtualearth.net	unknown	unknown	false	high
sync.outbrain.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
visitor.omnitagjs.com	unknown	unknown	false	high
pr-bh.ybp.yahoo.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
code.yengo.com	unknown	unknown	false	high
www.msn.com	unknown	unknown	false	high
trc.taboola.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
m.adnxs.com	unknown	unknown	false	high
aefd.nelreports.net	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
eb2.3lift.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://pr-bh.ybp.yahoo.com/sync/msn?gdpr=0&gdpr_consent=	false		high
https://uksmart.andersonsxl.com/index/	true		unknown
https://code.yengo.com/sync?ssp=msn&id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent=	false		high
https://trc.taboola.com/sg/msn/1/cm?taboola_hm=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent=	false		high
https://m.adnxs.com/mapuid?member=280&user=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32C420A0C511633031E535D3C44D6219%2526gdpr%253D0%2526gdpr_consent%253D	false		high
https://sync.outbrain.com/uidmappixel?ext_uid=32C420A0C511633031E535D3C44D6219&pname=MSN&gdpr=0&gdpr_consent=	false		high
https://m.adnxs.com/mapuid?member=280&user=32C420A0C511633031E535D3C44D6219;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32C420A0C511633031E535D3C44D6219%2526gdpr%253D0%2526gdpr_consent%253D	false		high
https://uksmart.andersonsxl.com/index	true	Avira URL Cloud: safe	unknown
https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D32C420A0C511633031E535D3C44D6219%26gdpr%3D0%26gdpr_consent%3D	false		high
https://ib.adnxs.com/setuid?entity=483&code=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent=	false		high
https://trace.mediago.io/cs/msn?id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent=	false		high
https://izi.fyi/hHmxws?https%3A%2F%2Fgo_microsoft_com%2Fref=	false	Avira URL Cloud: safe	unknown
https://cm.mgid.com/m?cdsp=516415&c=32C420A0C511633031E535D3C44D6219&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent=	false		high
https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D32C420A0C511633031E535D3C44D6219%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32C420A0C511633031E535D3C44D6219%252526gdpr%25253D0%252526gdpr_consent%25253D	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://s.ad.smaato.net/c/?adExInit=inmobi&gdpr=0&gdpr_consent=	chromecache_618.3.dr	false		high
https://www.thedailymeal.com/eat/americas-best-italian-restaurants-gallery/	chromecache_713.3.dr	false		high
https://www-klarna.com/xf?kamis	chromecache_723.3.dr	false	Avira URL Cloud: safe	unknown
https://nextdoor.com/p/P3kPc9msgHR6/?from_partner=microsoft&share_id=P3kPc9msgHR6&utm_medium=public_	chromecache_663.3.dr, chromecache_683.3.dr	false		high
https://www.msn.com/en-us/health/other/landman-takes-on-ultra-processed-foods-smoking-and-stress-how	chromecache_713.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	chromecache_247.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-dark	chromecache_713.3.dr	false	Avira URL Cloud: safe	unknown
https://b1sync.zemanta.com/usersync/inmobi/?puid=ID5-5-b0754e90-13bc-4406-a977-3dd2bed56c4f&cb=h	chromecache_618.3.dr	false		high
https://github.com/zloirock/core-js	chromecache_565.3.dr, chromecache_224.3.dr	false		high
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159035&gdpr=0&gdpr_consent=&userId	chromecache_618.3.dr	false		high
https://pixel.tapad.com/idsync/ex/receive?partner_id=3535&partner_device_id=ID5-5-b0754e90-13bc-	chromecache_618.3.dr	false		high
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	chromecache_707.3.dr, chromecache_517.3.dr	false	Avira URL Cloud: safe	unknown
https://www.cnbc.com/2015/06/09/rowan-atkinson-crashes-mclaren-f1-supercar-twice-sells-for-122-milli	chromecache_713.3.dr	false		high
https://www.msn.com/en-us/money/personalfinance/increasingly-depressed-america-ben-shapiro-says-more	chromecache_713.3.dr	false		high
https://nextdoor.com/neighborhood/weehawken--weehawken--nj/	chromecache_663.3.dr, chromecache_683.3.dr	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://s.ad.smaato.net/c/?dspInit=1001980&dspCookie=ID5-5-b0754e90-13bc-4406-a977-3dd2bed56c4f&	chromecache_618.3.dr	false		high
https://www.msn.com/en-us/music/news/saxophone-national-anthem-at-packers-eagles-gets-overwhelming-v	chromecache_713.3.dr	false		high
https://www.neverendingvoyage.com/dos-and-donts-of-eating-in-italy/	chromecache_713.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/realestate/this-florida-couple-bought-a-vacant-lot-for-17-500-but-no	chromecache_247.3.dr	false		high
https://image8.pubmatic.com/AdServer/ImgSync?p=157097&gdpr=0&gdpr_consent=&pu=https%3A%2	chromecache_618.3.dr	false		high
https://www.msn.com/$	chromecache_707.3.dr, chromecache_517.3.dr	false		high
https://login.microsoftonline.us	chromecache_560.3.dr, chromecache_672.3.dr	false		high
https://financebuzz.com/supplement-income-55mp?utm_source=msn-money&utm_medium=feed&synd_slide=2&syn	chromecache_247.3.dr	false		high
https://ib.adnxs.com/getuid?https://sync.inmobi.com/setuid?bidderID=32&dspUserId=$UID	chromecache_618.3.dr	false		high
https://nextdoor.com/	chromecache_539.3.dr, chromecache_663.3.dr, chromecache_683.3.dr, chromecache_297.3.dr	false		high
https://www.bbc.com/mediacentre/proginfo/2012/49/the_atkinson_people	chromecache_713.3.dr	false		high
https://sync.clearnview.com/redirect?gdpr=0&gdpr_consent=&usp_consent=&pubid=17&pubu	chromecache_618.3.dr	false		high
https://www.msn.com	chromecache_588.3.dr, chromecache_345.3.dr	false		high
https://www.msn.com/en-us/news/politics/watch-george-w-bush-shares-viral-moment-with-barack-obama/vi	chromecache_247.3.dr	false		high
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	chromecache_707.3.dr, chromecache_517.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/careersandeducation/the-new-retirement-is-no-retirement-baby-boomers	chromecache_247.3.dr	false		high
https://www.msn.com/en-us/news/us/carteret-will-improve-borough-s-longest-road-with-more-than-4m-in-	chromecache_713.3.dr	false		high
https://www.imdb.com/title/tt11212276/?ref_=fn_al_tt_1	chromecache_713.3.dr	false		high
https://www.msn.com/en-us/news/politics/vance-says-jan-6-participants-who-committed-violence-obvious	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://github.com/zloirock/core-js/blob/v3.37.1/LICENSE	chromecache_565.3.dr, chromecache_224.3.dr	false		high
https://www.cnn.com/2024/10/04/entertainment/lady-gaga-bravado-harley-quinn-joker-sequel/index.html	chromecache_713.3.dr	false		high
https://login.microsoftonline.de	chromecache_560.3.dr, chromecache_672.3.dr	false	Avira URL Cloud: phishing	unknown
https://www.msn.com/en-us/sports/other/top-10-unforgettable-legends-snubbed-for-college-football-s-h	chromecache_247.3.dr	false		high
https://www.msn.com/en-us/news/politics/senate-braces-for-train-wreck-as-hearings-kick-off-for-trump	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://match.prod.bidr.io/cookie-sync/inm	chromecache_618.3.dr	false		high
https://financebuzz.com/ways-to-make-extra-money?utm_source=msn-money&utm_medium=feed&synd_slide=1&s	chromecache_247.3.dr	false		high
http://adaptivecards.io/schemas/adaptive-card.json	chromecache_707.3.dr, chromecache_517.3.dr	false		high
https://sync.1rx.io/usersync2/inmobi&gdpr=0&gdpr_consent=	chromecache_618.3.dr	false		high
https://sesamorestaurant.com/news/italian-cuisine-why-is-it-loved-so-much/	chromecache_713.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	chromecache_713.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/my-husband-s-a-spender-and-i-m-a-saver-but-3-rules-h	chromecache_713.3.dr	false		high
https://assets.msn.com/content/view/v1/Preview/$	chromecache_707.3.dr, chromecache_517.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8	chromecache_713.3.dr, chromecache_247.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13KMUG-dark	chromecache_247.3.dr	false	Avira URL Cloud: safe	unknown
https://www.financebuzz.com/supplement-income-55mp?utm_source=msn-money&utm_medium=feed&synd_slide=1	chromecache_247.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/nextdoor/join-us-for-a-first-time-home-buyers-webinar/ar-NDANpPStxCmt	chromecache_539.3.dr, chromecache_713.3.dr, chromecache_297.3.dr, chromecache_247.3.dr	false		high
https://a-z-animals.com/blog/new-record-mississippi-river-sets-record-for-lowest-water-levels-in-202	chromecache_713.3.dr	false		high
https://www.msn.com/en-us/news/world/zelensky-offers-to-send-ukrainian-firefighters-to-california-af	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://www.thedailymeal.com/travel/culinary-tour-chianti-classico-region-italy/	chromecache_713.3.dr	false		high
https://financebuzz.com/stress-free-retirement?utm_source=msn-money&utm_medium=feed&synd_slide=1&syn	chromecache_247.3.dr	false		high
https://www.msn.com/en-us/movies/news/flashback-la-water-chief-says-her-work-is-guided-through-equit	chromecache_713.3.dr	false		high
https://nextdoor.com/neighborhood/theironbound--newark--nj/	chromecache_539.3.dr, chromecache_297.3.dr	false		high
https://www.gq-magazine.co.uk/lifestyle/article/rowan-atkinson-car-collection	chromecache_713.3.dr	false		high
https://www.msn.com/en-us/money/personalfinance/i-never-understood-why-my-uncle-didn-t-give-me-birth	chromecache_247.3.dr	false		high
https://www.msn.com/en-us/news/world/progress-made-in-talks-over-israel-hamas-ceasefire-and-hostage-	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://cs.krushmedia.com/4831fbf13dd518a56346a6e0ec8ba9d5.gif?puid=ID5-5-b0754e90-13bc-4406-a977-3d	chromecache_618.3.dr	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://sync.srv.stackadapt.com/sync?nid=138&gdpr=0&gdpr_consent=	chromecache_618.3.dr	false		high
https://www.msn.com/en-us/money/realestate/their-wealth-is-in-their-homes-their-homes-are-now-ash/ar	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://www.msn.com/en-us/money/personalfinance/here-s-the-minimum-salary-required-to-be-considered-	chromecache_247.3.dr	false		high
https://id.rlcdn.com/713074.gif?	chromecache_618.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark	chromecache_713.3.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://terryfator.com/tour/	chromecache_713.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/tv/news/leslie-charleson-general-hospital-icon-known-as-monica-quartermain	chromecache_247.3.dr	false		high
https://www.pollensense.com/	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8-dark	chromecache_713.3.dr, chromecache_247.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/movies/news/netflix-viewers-divided-as-sequel-to-hit-2023-movie-shoots-to-	chromecache_247.3.dr	false		high
https://creativecdn.com/cm-notify?pi=inmobi&gdpr=0&gdpr_consent=	chromecache_618.3.dr	false		high
https://www.msn.com/en-us/news/politics/sen-ernst-renews-push-for-bill-ending-illegal-immigration-lo	chromecache_247.3.dr	false		high
https://financebuzz.com/supplement-income-55mp?utm_source=msn-money&utm_medium=feed&synd_slide=1&syn	chromecache_247.3.dr	false		high
https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title=	chromecache_609.3.dr, chromecache_700.3.dr	false		high
https://login.chinacloudapi.cn	chromecache_560.3.dr, chromecache_672.3.dr	false		high
https://www.msn.com/en-us/autos/news/magic-johnson-on-the-culture-shock-of-moving-to-l-a/vi-BB1rifCp	chromecache_713.3.dr	false		high
https://www.msn.com/en-us/money/markets/investors-hope-earnings-season-can-revive-faltering-stock-ra	chromecache_247.3.dr	false		high
https://login.windows-ppe.net	chromecache_560.3.dr, chromecache_672.3.dr	false		high
https://www.msn.com/en-us/money/markets/why-bond-yields-are-surging-around-the-world/ar-BB1rmwom	chromecache_713.3.dr, chromecache_247.3.dr	false		high
https://www.msn.com/en-us/news/us/jeff-bezos-space-company-calls-off-debut-launch-of-massive-new-roc	chromecache_247.3.dr	false		high
https://x.bidswitch.net/sync?ssp=aerserv&user_id=ID5-5-b0754e90-13bc-4406-a977-3dd2bed56c4f&	chromecache_618.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13KMUG	chromecache_247.3.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
52.252.178.123	shortener.kountryboyzbailbonds.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
104.19.132.76	cm.mgid.com	United States	13335	CLOUDFLARENETUS	false
13.248.245.213	eu-eb2.3lift.com	United States	16509	AMAZON-02US	false
35.213.89.133	trace.popin.cc	United States	19527	GOOGLE-2US	false
185.89.210.244	m.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
4.157.242.144	uksmart.andersonsxl.com	United States	3356	LEVEL3US	true
151.101.1.44	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.212.88.20	hbx.media.net	United States	16625	AKAMAI-ASUS	false
64.202.112.223	unknown	United States	22075	AS-OUTBRAINUS	false
185.255.84.152	unknown	France	200271	IGUANE-FR	false
185.255.84.153	visitor-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
54.246.227.151	unknown	United States	16509	AMAZON-02US	false
35.208.249.213	trace.mediago.io	United States	19527	GOOGLE-2US	false
185.89.210.46	unknown	Germany	29990	ASN-APPNEXUS	false
76.223.111.18	unknown	United States	16509	AMAZON-02US	false
13.228.197.79	izi.fyi	United States	16509	AMAZON-02US	false
3.248.108.242	ds-pr-bh.ybp.gysm.yahoodns.net	United States	16509	AMAZON-02US	false
64.202.112.127	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
185.89.210.90	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
151.101.129.44	dualstack.tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
172.241.51.68	lb-sin.mgid.com	Netherlands	394380	LEASEWEB-USA-DAL-10US	false
172.241.51.69	unknown	Netherlands	394380	LEASEWEB-USA-DAL-10US	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589974
Start date and time:	2025-01-13 12:30:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@24/810@88/25

Input	Output
URL: https://shortener.kountryboyzbailbonds.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": true, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://shortener.kountryboyzbailbonds.com
URL: https://uksmart.andersonsxl.com/index/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates high-risk behavior by redirecting the user to potentially malicious domains based on the presence of a camera. The script uses the `navigator.mediaDevices.enumerateDevices()` API to detect the presence of a camera, and then redirects the user to either a suspicious domain (`www-klarna.com/xf?kamis`) or a legitimate domain (`www.bing.com`). This behavior is considered highly suspicious and potentially malicious, as it could be used to redirect users to phishing or malware-hosting sites. Additionally, the script does not provide any transparency or user consent for the redirection, which further increases the risk." }
// Fungsi untuk mendeteksi kamera function checkCamera() { navigator.mediaDevices.enumerateDevices() .then(devices => { const hasCamera = devices.some(device => device.kind === 'videoinput'); if (hasCamera) { // Redirect ke SCAMs jika perangkat memiliki kamera window.location.href = 'https://www-klarna.com/xf?kamis'; } else { // Redirect ke Bing jika perangkat tidak memiliki kamera window.location.href = 'https://www.bing.com'; } }) .catch(error => { console.error('Error accessing media devices.', error); // Jika terjadi error, bisa diarahkan ke halaman lain atau tampilkan pesan error }); } // Panggil fungsi checkCamera saat halaman dimuat window.onload = checkCamera;
URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft Bing" ] }
	{ "brands": [ "Microsoft Bing" ] }
URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft Bing" ] }
	{ "brands": [ "Microsoft Bing" ] }
URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft Bing" ] }
	{ "brands": [ "Microsoft Bing" ] }
URL: https://www.bing.com/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft Bing" ] }
	{ "brands": [ "Microsoft Bing" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5082
Entropy (8bit):	5.316791263576712
Encrypted:	false
SSDEEP:	96:rkUrscBCmR3R38UMZ7EFLqoLqPFb8CYkuCtsLtaMR+tpM7:rkUrsyzCUMREFLqoLqPt8WTtNwoQ
MD5:	CCB657CD3A762F1899AF429D97FDE271
SHA1:	830BC52EC58D5F487A0FB20A114BA5F71D010A64
SHA-256:	2578AC36ACE7571568B3FC60FB6CE4A29BA444EED7C92DDD73097F667899C2C2
SHA-512:	6A865612C139DC9EF98E894DB17ED2B40A7F875625FC41829A4DC8D82B2110A708FAC3391BDBF9E344F2068274DAA9AE42FCEF6334DE3EB0206675883AE70122
Malicious:	false
Reputation:	low
URL:	https://assets.msn.com/content/v1/cms/api/amp/Document/BBI4MeJ
Preview:	{"$type":"list","title":"","_isPublishingLocked":false,"_id":"BBI4MeJ","_name":"MGXStoreWebPromo (old Backfill list - DO NOT DELETE)","_sourceMetering":{"isMetered":false},"_lastEditedDateTime":"2025-01-10T17:08:58Z","_links":{"self":[{"href":"cms/api/amp/list/BBI4MeJ"}],"parent":[{"href":"cms/api/amp/section/BBREXz4"}],"children":[],"feed":[],"provider":[],"references":[{"href":"cms/api/amp/image/AA1pt3D8"},{"href":"cms/api/amp/image/AA1pt11O"},{"href":"cms/api/amp/image/BB1lkZGB"},{"href":"cms/api/amp/image/BB1qqISQ"},{"href":"cms/api/amp/image/AA1r88cI"},{"href":"cms/api/amp/image/AA1tXNBK"},{"href":"cms/api/amp/image/AA1q4Ts4"},{"href":"cms/api/amp/image/AA1uakBE"}],"section":[]},"tagEvaluationGroups":{"_tagsHash":"3145739","tags":[],"vectors":[]},"_locale":"en-us","sourceId":"BBlbsHE","keywords":[],"facets":[],"labels":{"category":[]},"list":[{"link":{"href":"https://www.lendingtree.com/?splitterid=home-equity&cproduct=homeequity&cchannel=content&csource=tradingdesk&esourceid=6475

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 12:31:46.317713022 CET	53	62488	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:46.355607986 CET	53	49667	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:47.344115973 CET	53	55267	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:50.427659988 CET	56123	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:50.427942038 CET	51920	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:50.434647083 CET	53	56123	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:50.434879065 CET	53	51920	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:51.386341095 CET	53	53602	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:52.352407932 CET	59823	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:52.353053093 CET	58110	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:52.567652941 CET	53	58110	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:52.759099960 CET	53	59823	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:53.547821045 CET	56319	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:53.548201084 CET	65356	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:53.559555054 CET	53	56319	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:53.668937922 CET	53	65356	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:55.161309004 CET	55143	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:55.161446095 CET	64441	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:31:55.373579025 CET	53	64441	1.1.1.1	192.168.2.6
Jan 13, 2025 12:31:55.374912024 CET	53	55143	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:01.925137997 CET	64680	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:01.925285101 CET	51894	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:07.965369940 CET	49882	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:07.965564013 CET	56479	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:09.205724001 CET	50879	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:09.205965042 CET	59739	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:09.215609074 CET	53	59739	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:09.323391914 CET	51182	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:09.323622942 CET	60763	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:10.816001892 CET	56193	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:10.816147089 CET	53065	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:10.822953939 CET	53	53065	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:18.472572088 CET	52884	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:18.472703934 CET	55741	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:20.237869978 CET	57923	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:20.238087893 CET	63317	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:20.244774103 CET	53	63317	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:20.425610065 CET	59253	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:20.426023006 CET	56597	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.487799883 CET	57807	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.487940073 CET	61382	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.495229959 CET	53	61382	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.733531952 CET	59337	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.733673096 CET	51761	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.734241009 CET	63046	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.734364033 CET	62570	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.734865904 CET	52320	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.734997034 CET	58671	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.735419989 CET	55835	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.735551119 CET	63525	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.736035109 CET	49656	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.736175060 CET	54563	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.736573935 CET	60532	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.736753941 CET	57369	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.737232924 CET	54081	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.737361908 CET	59512	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.739415884 CET	58379	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.739583015 CET	62782	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:23.740792990 CET	53	51761	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.741511106 CET	53	62570	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.741565943 CET	53	52320	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.742023945 CET	53	63525	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.742046118 CET	53	58671	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.742095947 CET	53	55835	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.742664099 CET	53	49656	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.742793083 CET	53	54563	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.743880033 CET	53	60532	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.743978024 CET	53	54081	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.743992090 CET	53	57369	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.745073080 CET	53	59512	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.745968103 CET	53	58379	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:23.746258020 CET	53	62782	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.354949951 CET	59182	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.355134010 CET	49157	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.362380028 CET	65274	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.362560034 CET	51265	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.362925053 CET	53	49157	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.362942934 CET	53	59182	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.365998983 CET	64957	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.366132021 CET	63548	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.367883921 CET	53184	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.368022919 CET	60132	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.368942022 CET	53	65274	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.369388103 CET	53	51265	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.369687080 CET	62667	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.369834900 CET	63268	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.372504950 CET	53	64957	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.372684956 CET	53	63548	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.374521017 CET	53	53184	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.375462055 CET	53	60132	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.376336098 CET	53	62667	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.376353025 CET	53	63268	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.414918900 CET	54591	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.415054083 CET	61585	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.421610117 CET	53	54591	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.421914101 CET	53	61585	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.451631069 CET	61875	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.451766014 CET	62543	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.459178925 CET	53	62543	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.485181093 CET	51412	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.485315084 CET	52275	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.487133980 CET	56343	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.487262011 CET	61381	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.492778063 CET	53	52275	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.493786097 CET	53	61381	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:24.825330973 CET	60315	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.828159094 CET	63165	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:24.834956884 CET	53	63165	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.634643078 CET	50144	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.634778023 CET	56077	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.636805058 CET	59356	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.637202978 CET	62614	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.640436888 CET	62973	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.640572071 CET	54828	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.641551018 CET	53	56077	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.641824007 CET	62956	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.641953945 CET	53	50144	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.641961098 CET	56801	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.643538952 CET	54046	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.643740892 CET	51368	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.644000053 CET	53	59356	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.645152092 CET	53	62614	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.647176981 CET	53	62973	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.647998095 CET	53	54828	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.648380041 CET	53	62956	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.649590015 CET	53	56801	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.650310993 CET	53	54046	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.650724888 CET	53	51368	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.685432911 CET	59238	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.685581923 CET	62291	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:25.692223072 CET	53	62291	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:25.692584038 CET	53	59238	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:26.309449911 CET	52695	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:26.309587002 CET	57703	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:26.317025900 CET	53	57703	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:26.317331076 CET	53	52695	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:26.736865044 CET	56541	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:26.737013102 CET	52547	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:26.743558884 CET	53	52547	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:26.845180988 CET	57154	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:26.845338106 CET	53527	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:26.853233099 CET	53	53527	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:28.380837917 CET	64499	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:28.380837917 CET	56865	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:28.388849974 CET	53	64499	1.1.1.1	192.168.2.6
Jan 13, 2025 12:32:33.359589100 CET	51392	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:33.360023975 CET	62885	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:34.463839054 CET	60941	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:34.463996887 CET	62683	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:32:46.194494963 CET	53	62699	1.1.1.1	192.168.2.6
Jan 13, 2025 12:33:01.938729048 CET	55908	53	192.168.2.6	1.1.1.1
Jan 13, 2025 12:33:01.938857079 CET	51233	53	192.168.2.6	1.1.1.1

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 13, 2025 12:31:53.669003010 CET	192.168.2.6	1.1.1.1	c21d	(Port unreachable)	Destination Unreachable
Jan 13, 2025 12:32:51.047545910 CET	192.168.2.6	1.1.1.1	c21e	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:31:47 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 51 63 32 64 77 30 6c 70 6b 71 37 68 38 41 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 35 33 32 39 35 35 64 31 61 32 32 39 31 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6Qc2dw0lpkq7h8Au.1Context: e9532955d1a22910
2025-01-13 11:31:47 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 11:31:47 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 51 63 32 64 77 30 6c 70 6b 71 37 68 38 41 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 35 33 32 39 35 35 64 31 61 32 32 39 31 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 48 66 5a 49 62 71 74 72 56 4f 6d 47 75 61 57 39 64 48 2b 32 59 55 76 65 67 6e 7a 59 56 39 48 6a 6d 4a 64 6c 32 4c 75 6c 35 6b 70 4f 5a 52 50 34 41 71 35 64 52 39 73 6c 66 59 42 38 2f 39 68 46 68 36 56 59 4c 77 61 32 4c 64 72 66 64 35 45 6c 66 79 67 4f 49 38 4f 79 49 4d 46 2b 78 6f 4b 65 47 2b 67 31 61 78 6e 77 70 39 48 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6Qc2dw0lpkq7h8Au.2Context: e9532955d1a22910<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXHfZIbqtrVOmGuaW9dH+2YUvegnzYV9HjmJdl2Lul5kpOZRP4Aq5dR9slfYB8/9hFh6VYLwa2Ldrfd5ElfygOI8OyIMF+xoKeG+g1axnwp9Hh
2025-01-13 11:31:47 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 51 63 32 64 77 30 6c 70 6b 71 37 68 38 41 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 35 33 32 39 35 35 64 31 61 32 32 39 31 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6Qc2dw0lpkq7h8Au.3Context: e9532955d1a22910<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 11:31:47 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 11:31:47 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 72 39 4d 58 4a 68 6c 75 30 6d 49 64 7a 4b 41 51 38 6b 35 35 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Nr9MXJhlu0mIdzKAQ8k55w.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:31:53 UTC	859	OUT	GET /orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link HTTP/1.1 Host: shortener.kountryboyzbailbonds.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:31:53 UTC	544	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 13 Jan 2025 11:31:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=kaigbigdch2ton6opkeh1t9rml; path=/ Set-Cookie: short_51=1; expires=Mon, 13 Jan 2025 11:46:53 GMT; Max-Age=900; path=/; HttpOnly location: https://izi.fyi/hHmxws?https%3A%2F%2Fgo_microsoft_com%2Fref= Strict-Transport-Security: max-age=31536000;

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:31:54 UTC	694	OUT	GET /hHmxws?https%3A%2F%2Fgo_microsoft_com%2Fref= HTTP/1.1 Host: izi.fyi Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:31:55 UTC	513	IN	HTTP/1.1 302 Found Server: openresty Date: Mon, 13 Jan 2025 11:31:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 118 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: https://uksmart.andersonsxl.com/index Vary: Accept Strict-Transport-Security: max-age=31536000; preload X-Served-By: izi.fyi
2025-01-13 11:31:55 UTC	118	IN	Data Raw: 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 6b 73 6d 61 72 74 2e 61 6e 64 65 72 73 6f 6e 73 78 6c 2e 63 6f 6d 2f 69 6e 64 65 78 22 3e 68 74 74 70 73 3a 2f 2f 75 6b 73 6d 61 72 74 2e 61 6e 64 65 72 73 6f 6e 73 78 6c 2e 63 6f 6d 2f 69 6e 64 65 78 3c 2f 61 3e 3c 2f 70 3e Data Ascii: <p>Found. Redirecting to <a href="https://uksmart.andersonsxl.com/index">https://uksmart.andersonsxl.com/index</a></p>

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:31:55 UTC	671	OUT	GET /index HTTP/1.1 Host: uksmart.andersonsxl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:31:55 UTC	296	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 13 Jan 2025 11:31:55 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 246 Connection: close X-Frame-Options: SAMEORIGIN Location: https://uksmart.andersonsxl.com/index/ Strict-Transport-Security: max-age=31536000;
2025-01-13 11:31:55 UTC	246	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 6b 73 6d 61 72 74 2e 61 6e 64 65 72 73 6f 6e 73 78 6c 2e 63 6f 6d 2f 69 6e 64 65 78 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://uksmart.andersonsxl.com/index/">here</a>.</p></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:31:56 UTC	672	OUT	GET /index/ HTTP/1.1 Host: uksmart.andersonsxl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:31:56 UTC	633	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 11:31:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1252 Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Last-Modified: Mon, 13 Jan 2025 11:08:50 GMT ETag: "4e4-62b94781b1386" Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Content-Security-Policy: frame-ansectors 'self' X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer X-XSS-Protection: 1; mode=block X-Permitted-Cross-Domain-Policies: none X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000;
2025-01-13 11:31:56 UTC	736	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 65 76 69 63 65 20 43 61 6d 65 72 61 20 44 65 74 65 63 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 2f 2f 20 46 75 6e 67 73 69 20 75 6e 74 75 6b 20 6d 65 6e 64 65 74 65 6b 73 69 20 6b 61 6d 65 72 61 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Device Camera Detection</title></head><body> <script> // Fungsi untuk mendeteksi kamera
2025-01-13 11:31:56 UTC	516	IN	Data Raw: 20 6a 69 6b 61 20 70 65 72 61 6e 67 6b 61 74 20 74 69 64 61 6b 20 6d 65 6d 69 6c 69 6b 69 20 6b 61 6d 65 72 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 61 74 63 68 28 65 72 72 6f 72 20 3d 3e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 45 72 72 6f 72 20 61 63 63 65 73 73 69 6e 67 20 6d 65 64 69 61 20 64 65 76 69 63 65 73 2e 27 2c 20 65 72 72 Data Ascii: jika perangkat tidak memiliki kamera window.location.href = 'https://www.bing.com'; } }) .catch(error => { console.error('Error accessing media devices.', err

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:31:57 UTC	559	OUT	GET /favicon.ico HTTP/1.1 Host: uksmart.andersonsxl.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:31:57 UTC	535	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 13 Jan 2025 11:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ansectors 'self' X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer X-XSS-Protection: 1; mode=block X-Permitted-Cross-Domain-Policies: none X-Content-Type-Options: nosniff Vary: User-Agent Strict-Transport-Security: max-age=31536000;
2025-01-13 11:31:57 UTC	27	IN	Data Raw: 31 30 0d 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 10File not found.0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 71 39 6d 46 49 33 56 35 55 57 35 41 4e 77 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 37 65 33 62 62 30 30 34 36 38 35 64 66 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +q9mFI3V5UW5ANwP.1Context: 827e3bb004685df7
2025-01-13 11:32:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 11:32:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 71 39 6d 46 49 33 56 35 55 57 35 41 4e 77 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 37 65 33 62 62 30 30 34 36 38 35 64 66 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 48 66 5a 49 62 71 74 72 56 4f 6d 47 75 61 57 39 64 48 2b 32 59 55 76 65 67 6e 7a 59 56 39 48 6a 6d 4a 64 6c 32 4c 75 6c 35 6b 70 4f 5a 52 50 34 41 71 35 64 52 39 73 6c 66 59 42 38 2f 39 68 46 68 36 56 59 4c 77 61 32 4c 64 72 66 64 35 45 6c 66 79 67 4f 49 38 4f 79 49 4d 46 2b 78 6f 4b 65 47 2b 67 31 61 78 6e 77 70 39 48 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +q9mFI3V5UW5ANwP.2Context: 827e3bb004685df7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXHfZIbqtrVOmGuaW9dH+2YUvegnzYV9HjmJdl2Lul5kpOZRP4Aq5dR9slfYB8/9hFh6VYLwa2Ldrfd5ElfygOI8OyIMF+xoKeG+g1axnwp9Hh
2025-01-13 11:32:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 71 39 6d 46 49 33 56 35 55 57 35 41 4e 77 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 37 65 33 62 62 30 30 34 36 38 35 64 66 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +q9mFI3V5UW5ANwP.3Context: 827e3bb004685df7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 11:32:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 11:32:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 45 43 49 4b 2f 4f 79 48 6b 4b 32 63 41 75 66 33 51 57 54 6d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IECIK/OyHkK2cAuf3QWTmA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	647	OUT	GET /sg/msn/1/cm?taboola_hm=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1 Host: trc.taboola.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:24 UTC	591	IN	HTTP/1.1 200 OK Connection: close Server: nginx Cache-Control: no-cache, no-store Pragma: no-cache P3P: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-to-NLB-rtt: 253 Accept-Ranges: bytes Date: Mon, 13 Jan 2025 11:32:24 GMT Via: 1.1 varnish X-SERVICE-VERSION: v1 X-Served-By: cache-nyc-kteb1890099-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1736767944.273500,VS0,VE2 X-vcl-time-ms: 2 transfer-encoding: chunked
2025-01-13 11:32:24 UTC	4	IN	Data Raw: 32 62 0d 0a Data Ascii: 2b
2025-01-13 11:32:24 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;
2025-01-13 11:32:24 UTC	7	IN	Data Raw: 0d 0a 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Chrome Cache Entry: 224

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Windows Analysis Report
https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20link

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	662	OUT	GET /m?cdsp=516415&c=32C420A0C511633031E535D3C44D6219&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.mgid.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:24 UTC	347	IN	HTTP/1.1 400 Bad Request Date: Mon, 13 Jan 2025 11:32:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Robots-Tag: noindex Server: cloudflare CF-RAY: 901510c3dc0241cd-EWR alt-svc: h3=":443"; ma=86400
2025-01-13 11:32:24 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	656	OUT	GET /uidmappixel?ext_uid=32C420A0C511633031E535D3C44D6219&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.outbrain.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:24 UTC	375	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 11:32:24 GMT content-length: 0 x-traceid: e26bf2d37b9b5e0c992efd452fe95c04 set-cookie: obuid=36490854-adf6-418b-861f-16d10c4f0208; Max-Age=7776000; Expires=Sun, 13 Apr 2025 11:32:24 GMT; Path=/; Domain=.outbrain.com;SameSite=None;Secure strict-transport-security: max-age=31536000; includeSubDomains; preload connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	641	OUT	GET /mapuid?suid=32C420A0C511633031E535D3C44D6219&sid=16&gdpr=0&gdpr_consent= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:24 UTC	638	IN	HTTP/1.1 302 Found Date: Mon, 13 Jan 2025 11:32:24 GMT Content-Length: 0 Connection: close Location: /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=182452588984791667886; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Sun, 13 Apr 2025 11:32:24 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=182452588984791667886; Max-Age=7776000; Expires=Sun, 13 Apr 2025 11:32:24 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	653	OUT	GET /cksync.php?type=nms&cs=3&ovsid=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1 Host: hbx.media.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:24 UTC	948	IN	HTTP/1.1 200 OK Server: Apache Content-Length: 59 Content-Type: image/gif Set-Cookie: visitor-id=3797695446406130000V10; Expires=Tue, 13 Jan 2026 11:32:24 GMT; domain=.media.net; Path=/; sameSite=none; secure=true Set-Cookie: data-nms=32C420A0C511633031E535D3C44D6219~~3;Expires=Tue, 13 Jan 2026 11:32:24 GMT;path=/;domain=.media.net; sameSite=none; secure=true p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA Strict-Transport-Security: max-age=86400 ; includeSubDomains Strict-Transport-Security: max-age=604800 Timing-Allow-Origin: * Alt-Svc: h3=":443"; ma=93600 x-mnet-hl2: E Expires: Mon, 13 Jan 2025 11:32:24 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 13 Jan 2025 11:32:24 GMT Connection: close
2025-01-13 11:32:24 UTC	43	IN	Data Raw: 47 49 46 38 37 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 0a 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF87a!,L;
2025-01-13 11:32:24 UTC	16	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	604	OUT	GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:24 UTC	778	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 11:32:24 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBMj5hGcCEBeRyg1C_ipnPX4c-NYgpJYFEgEBAQFLhmeOZwAAAAAA_eMAAA&S=AQAAAk76nMAUWBG4OboBpAt_iw4; Expires=Tue, 13 Jan 2026 17:32:24 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2025-01-13 11:32:24 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:24 UTC	635	OUT	GET /cs/msn?id=32C420A0C511633031E535D3C44D6219&gdpr=0&gdpr_consent= HTTP/1.1 Host: trace.mediago.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:25 UTC	291	IN	HTTP/1.1 200 OK Set-Cookie: __mguid_=22210ca799c7886b13j2of00m5uysj0m; Path=/; Domain=mediago.io; Max-Age=31536000; Secure; SameSite=None Date: Mon, 13 Jan 2025 11:32:25 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:25 UTC	674	OUT	GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluidp=182452588984791667886; tluid=182452588984791667886
2025-01-13 11:32:25 UTC	610	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 11:32:25 GMT Content-Type: image/gif Content-Length: 37 Connection: close Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=182452588984791667886; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Sun, 13 Apr 2025 11:32:25 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=182452588984791667886; Max-Age=7776000; Expires=Sun, 13 Apr 2025 11:32:25 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None
2025-01-13 11:32:25 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:25 UTC	711	OUT	GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=32C420A0C511633031E535D3C44D6219&external=true&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:25 UTC	466	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=48a6a58ce5dc63f3451ab1c6ef889551; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Mon, 13 Jan 2025 11:32:25 GMT content-length: 49 x-envoy-upstream-service-time: 23 server: ayl-lb-fra02 connection: close
2025-01-13 11:32:25 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:25 UTC	854	OUT	GET /mapuid?member=280&user=32C420A0C511633031E535D3C44D6219;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32C420A0C511633031E535D3C44D6219%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:25 UTC	1678	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Mon, 13 Jan 2025 11:32:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D32C420A0C511633031E535D3C44D6219%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32C420A0C511633031E535D3C44D6219%252526gdpr%25253D0%252526gdpr_consent%25253D AN-X-Request-Uuid: 8d614972-886e-40d9-bd58-f5b9baa99bb0 Set-Cookie: XANDR_PANID=5DaOPJnNht9gEOecwbUWAi06rhQrmolk7QG7OXHm8JvmDW3PA91HwKLm6ShPQ5WcKuRmDE-SvqfiVejMAf8H4qjvh4o3vlvrzWg-RGdrjy0.; SameSite=None; Path=/; Max-Age=7776000; Expires=Sun, 13-Apr-2025 11:32:25 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Mon, 01-Jan-2035 11:32:25 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=2360702378154250717; SameSite=None; Path=/; Max-Age=7776000; Expires=Sun, 13-Apr-2025 11:32:25 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 8.46.123.189; 8.46.123.189; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com

Timestamp	Bytes transferred	Direction	Data
2025-01-13 11:32:25 UTC	646	OUT	GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.bing.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 11:32:25 UTC	1508	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Mon, 13 Jan 2025 11:32:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 1f27cb3b-5c20-4b35-a3be-ab1cbf19cfa6 Set-Cookie: XANDR_PANID=WCeOLaDmnmC5H0M1cpV5Trj4gvUG_BS3sqF_kGGSlRGSm3Fv4BKwH1N5NFV8pwtpPOpma_ETYgyai2b0FqlkEvcBCaJ-42OKGoNPXALpRJg.; SameSite=None; Path=/; Max-Age=7776000; Expires=Sun, 13-Apr-2025 11:32:25 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Mon, 01-Jan-2035 11:32:25 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=5888861485422858828; SameSite=None; Path=/; Max-Age=7776000; Expires=Sun, 13-Apr-2025 11:32:25 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 8.46.123.189; 8.46.123.189; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com