ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:26 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe
Size

41KB
MD5

94c83283047dc391fc43fce305e43e54
SHA1

39a898bb56e2973689215c464d12667527c953c0
SHA256

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e
SHA512

cd845e3aa1303e747e604d3441afd4a65ef09977fae6e998c396a85fc45fd165f060ec51c29fbd365866e09fd0eb24d3607e6ace1d82b8e1ebdffefe5cb89c1a
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
2416	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023259-4.dat	upx
behavioral2/memory/2416-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4848-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2416-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4848-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2416-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4848-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2416-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000400000000070d-65.dat	upx
behavioral2/memory/4848-207-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2416-208-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4848-259-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2416-260-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2416-264-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe
File opened for modification	C:\Windows\java.exe	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe
File created	C:\Windows\java.exe	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2416	4848	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe	90
PID 4848 wrote to memory of 2416	4848	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe	90
PID 4848 wrote to memory of 2416	4848	ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe	90

C:\Users\Admin\AppData\Local\Temp\ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe
"C:\Users\Admin\AppData\Local\Temp\ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4196

Network

DNS

13.86.106.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.86.106.20.in-addr.arpa

IN PTR

Response
DNS

73.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.144.22.2.in-addr.arpa

IN PTR

Response

73.144.22.2.in-addr.arpa

IN PTR

a2-22-144-73deploystaticakamaitechnologiescom
DNS

67.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.31.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

164.189.21.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

164.189.21.2.in-addr.arpa

IN PTR

Response

164.189.21.2.in-addr.arpa

IN PTR

a2-21-189-164deploystaticakamaitechnologiescom
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

m-ou.se

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

m-ou.se

IN MX

Response

m-ou.se

IN MX

aspmxlgooglecom

m-ou.se

IN MX

alt1�'

m-ou.se

IN MX

alt2�'

m-ou.se

IN MX

aspmx2 googlemail�6

m-ou.se

IN MX

aspmx3�z

m-ou.se

IN MX

aspmx4�z

m-ou.se

IN MX

aspmx5�z
DNS

acm.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

acm.org

IN MX

Response

acm.org

IN MX

mail mailroutenet
DNS

aspmx.l.google.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

aspmx.l.google.com

IN A

Response

aspmx.l.google.com

IN A

142.250.102.26
DNS

mail.mailroute.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

mail.mailroute.net

IN A

Response

mail.mailroute.net

IN A

199.89.1.120

mail.mailroute.net

IN A

199.89.3.120
DNS

cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

cs.stanford.edu

IN MX

Response

cs.stanford.edu

IN MX

smtp2�

cs.stanford.edu

IN MX

�

cs.stanford.edu

IN MX

smtp1�
DNS

smtp2.cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

smtp2.cs.stanford.edu

IN A

Response

smtp2.cs.stanford.edu

IN A

171.64.64.26
DNS

burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

burtleburtle.net

IN MX

Response

burtleburtle.net

IN MX

mx�
DNS

mx.burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

mx.burtleburtle.net

IN A

Response

mx.burtleburtle.net

IN A

65.254.254.52

mx.burtleburtle.net

IN A

65.254.254.51

mx.burtleburtle.net

IN A

65.254.254.50
DNS

alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

alumni.caltech.edu

IN MX

Response

alumni.caltech.edu

IN MX

alumni-caltech-edumail protectionoutlookcom
DNS

alumni-caltech-edu.mail.protection.outlook.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

alumni-caltech-edu.mail.protection.outlook.com

IN A

Response

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.9.0

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.9.5

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.8.46

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.11.19
DNS

gzip.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN MX

Response

gzip.org

IN MX

�
DNS

gzip.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN A

Response

gzip.org

IN A

85.187.148.2
DNS

search.lycos.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

search.lycos.com

IN A

Response

search.lycos.com

IN CNAME

search-core2.bo3.lycos.com

search-core2.bo3.lycos.com

IN A

209.202.254.10
DNS

search.yahoo.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

search.yahoo.com

IN A

Response

search.yahoo.com

IN CNAME

ds-global3.l7.search.ystg1.b.yahoo.com

ds-global3.l7.search.ystg1.b.yahoo.com

IN A

212.82.100.137
DNS

www.google.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.187.196
GET

http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:20 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=e-mail+m-ou.se&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=e-mail+m-ou.se&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3De-mail%2Bm-ou.se%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjDIwVtK--ghaufHufnbq4bJrq8iRx8T0tUkFiB_OuYSTzbvzL4Q9CUJ1adcCPhkrE4yAXJaAUM
x-hallmonitor-challenge: CgwIxI-kswYQqvqeswMSBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-8Rcy3bz6OFuCjQhQHb-AVQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:20 GMT
Server: gws
Content-Length: 447
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HzAaUpGONgGPDjEWSSWe0vDys5fozwRBnL3OVuxCcTv08g8gEd_VQ4; expires=Mon, 09-Dec-2024 02:28:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=cs.stanford.edu+mail&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=cs.stanford.edu+mail&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjAcV0KMKqt3Yb-n-nGL5VdKVjGH_UO0EStyB0SuNo1OE8eTs3QvyIXBRMVc7VWa5boyAXJaAUM
x-hallmonitor-challenge: CgwIxY-kswYQrKD0oQESBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-9MBytoIuNHGlcnkemAoAFw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: gws
Content-Length: 453
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6Hzzj5lhakgIAGfYb1c9lWzYWIFozS00rbiJTZFDDkI1o3dxb5_UW1Y; expires=Mon, 09-Dec-2024 02:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjAcV0KMKqt3Yb-n-nGL5VdKVjGH_UO0EStyB0SuNo1OE8eTs3QvyIXBRMVc7VWa5boyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjAcV0KMKqt3Yb-n-nGL5VdKVjGH_UO0EStyB0SuNo1OE8eTs3QvyIXBRMVc7VWa5boyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:21 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3316
X-XSS-Protection: 0
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+email&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+email&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dm-ou.se%2Bemail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjB7OWJq8NfVk2FMvF1Ra9RxIZh0TrCay6AO-vWgXCSsAMjaIS_9LTQDkJMgKnmlCngyAXJaAUM
x-hallmonitor-challenge: CgsIxY-kswYQkpe6IRIEv2XRJw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-8-TdXLraaY2IGtg20rzKYQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: gws
Content-Length: 446
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HyWu-9E5F-7HZ3BF2L4Q5YJFR0EU0vsE1o4FbWQVfd5omFNvcLCT7U; expires=Mon, 09-Dec-2024 02:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3De-mail%2Bm-ou.se%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjDIwVtK--ghaufHufnbq4bJrq8iRx8T0tUkFiB_OuYSTzbvzL4Q9CUJ1adcCPhkrE4yAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3De-mail%2Bm-ou.se%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjDIwVtK--ghaufHufnbq4bJrq8iRx8T0tUkFiB_OuYSTzbvzL4Q9CUJ1adcCPhkrE4yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:21 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3298
X-XSS-Protection: 0
GET

http://search.yahoo.com/search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:20 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:20 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu
Content-Length: 312
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
DNS

www.altavista.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

www.altavista.com

IN A

Response

www.altavista.com

IN CNAME

us.yhs4.search.yahoo.com

us.yhs4.search.yahoo.com

IN CNAME

ds-global3.l7.search.ystg1.b.yahoo.com

ds-global3.l7.search.ystg1.b.yahoo.com

IN A

212.82.100.137
GET

http://www.altavista.com/web/results?q=burtleburtle.net+contact+e-mail&kgs=0&kls=0&nbq=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=burtleburtle.net+contact+e-mail&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:20 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 1
server: ATS
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=mailto+acm.org&kgs=0&kls=0&nbq=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mailto+acm.org&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:21 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 1
server: ATS
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=cs.stanford.edu+mail&kgs=0&kls=0&nbq=20

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=cs.stanford.edu+mail&kgs=0&kls=0&nbq=20 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:21 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 2
server: ATS
Content-Encoding: gzip
Content-Length: 1519
Age: 0
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-SSh62SZVZt+ptpJGKxPw2Q==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:21 GMT
x-envoy-upstream-service-time: 14
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
GET

https://search.yahoo.com/search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-iPSA7hQ/MwjSjzsdwQlzgg==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:21 GMT
x-envoy-upstream-service-time: 14
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
GET

https://search.yahoo.com/?fr=altavista

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /?fr=altavista HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

date: Wed, 12 Jun 2024 02:28:21 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
set-cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159301&ltv_c=1; expires=Thu, 12-Jun-2025 02:28:21 GMT; Max-Age=31535999; path=/; domain=.search.yahoo.com
secure_search_bypass: true
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-+EfizciTrV/MoXgHNG1E3w==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com *.yahooapis.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; img-src 'self' data: blob: https://*.aol.com https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://fun.games.com/ https://interactives.ap.org; media-src * blob:; object-src *; connect-src * blob:; font-src * data:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
cache-control: private
content-type: text/html; charset=UTF-8
x-envoy-upstream-service-time: 113
server: ATS
Age: 2
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/?fr=altavista

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /?fr=altavista HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
set-cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159302&ltv_sts=1718159302&ltv_c=1; expires=Thu, 12-Jun-2025 02:28:22 GMT; Max-Age=31536000; path=/; domain=.search.yahoo.com
secure_search_bypass: true
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-BAwo9GRfTlm2qkWNN32k2g==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com *.yahooapis.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; img-src 'self' data: blob: https://*.aol.com https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://fun.games.com/ https://interactives.ap.org; media-src * blob:; object-src *; connect-src * blob:; font-src * data:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
cache-control: private
content-type: text/html; charset=UTF-8
x-envoy-upstream-service-time: 197
server: ATS
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/?fr=altavista

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /?fr=altavista HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
set-cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159302&ltv_sts=1718159302&ltv_c=1; expires=Thu, 12-Jun-2025 02:28:22 GMT; Max-Age=31536000; path=/; domain=.search.yahoo.com
secure_search_bypass: true
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-ibWlv4nF4GZj6X7T1Ags2w==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com *.yahooapis.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; img-src 'self' data: blob: https://*.aol.com https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://fun.games.com/ https://interactives.ap.org; media-src * blob:; object-src *; connect-src * blob:; font-src * data:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
cache-control: private
content-type: text/html; charset=UTF-8
x-envoy-upstream-service-time: 71
server: ATS
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-UZU+W4GiNEOz0O1QiUxcSQ==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:22 GMT
x-envoy-upstream-service-time: 14
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 2
Transfer-Encoding: chunked
Connection: keep-alive
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:20 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net
Content-Length: 311
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
DNS

137.100.82.212.in-addr.arpa

Remote address:

8.8.8.8:53

Request

137.100.82.212.in-addr.arpa

IN PTR

Response

137.100.82.212.in-addr.arpa

IN PTR

ats1l7searchvipir2yahoocom
DNS

196.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.187.250.142.in-addr.arpa

IN PTR

Response

196.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f41e100net
DNS

10.254.202.209.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.254.202.209.in-addr.arpa

IN PTR

Response

10.254.202.209.in-addr.arpa

IN PTR

search-core2bo3lycoscom
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dm-ou.se%2Bemail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjB7OWJq8NfVk2FMvF1Ra9RxIZh0TrCay6AO-vWgXCSsAMjaIS_9LTQDkJMgKnmlCngyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dm-ou.se%2Bemail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjB7OWJq8NfVk2FMvF1Ra9RxIZh0TrCay6AO-vWgXCSsAMjaIS_9LTQDkJMgKnmlCngyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:21 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3295
X-XSS-Protection: 0
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+gzip.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+gzip.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org&hl=en&q=EgS_ZdEnGMWPpLMGIjA_SEjO7-JnAdLkItxIfmLAmREjFTGc70OqHJ66kAbWRDv9GpsTvfoRKV1e54ZxGFwyAXJaAUM
x-hallmonitor-challenge: CgwIxY-kswYQ8oqJsgISBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-R3zALJNmYiqtndxAft27mA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: gws
Content-Length: 436
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HwbyehpsouWVDxRHfEspGg36XZojBMw9UoECsnnhbO0x75SYGm6Ltg; expires=Mon, 09-Dec-2024 02:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org&hl=en&q=EgS_ZdEnGMWPpLMGIjA_SEjO7-JnAdLkItxIfmLAmREjFTGc70OqHJ66kAbWRDv9GpsTvfoRKV1e54ZxGFwyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org&hl=en&q=EgS_ZdEnGMWPpLMGIjA_SEjO7-JnAdLkItxIfmLAmREjFTGc70OqHJ66kAbWRDv9GpsTvfoRKV1e54ZxGFwyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:21 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3265
X-XSS-Protection: 0
GET

http://www.altavista.com/web/results?q=acm.org+mailto&kgs=0&kls=0

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=acm.org+mailto&kgs=0&kls=0 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:21 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 2
server: ATS
Content-Encoding: gzip
Content-Length: 1519
Age: 0
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=mailto+m-ou.se&kgs=0&kls=0&nbq=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mailto+m-ou.se&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:21 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 2
server: ATS
Content-Encoding: gzip
Content-Length: 1519
Age: 0
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=gzip.org+mailto&kgs=0&kls=0&nbq=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=gzip.org+mailto&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 1
server: ATS
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=mailto+alumni.caltech.edu&kgs=0&kls=0&nbq=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mailto+alumni.caltech.edu&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 1
server: ATS
Content-Encoding: gzip
Content-Length: 1519
Age: 0
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=mail+cs.stanford.edu&kgs=0&kls=0&nbq=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mail+cs.stanford.edu&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 2
server: ATS
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=cs.stanford.edu+e-mail&kgs=0&kls=0&nbq=20

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=cs.stanford.edu+e-mail&kgs=0&kls=0&nbq=20 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:23 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 1
server: ATS
Content-Encoding: gzip
Content-Length: 1519
Age: 0
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=acm.org+email&kgs=0&kls=0&nbq=20

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=acm.org+email&kgs=0&kls=0&nbq=20 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

date: Wed, 12 Jun 2024 02:28:26 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://search.yahoo.com/?fr=altavista
cache-control: private
content-type: text/html
x-envoy-upstream-service-time: 1
server: ATS
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:21 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu
Content-Length: 315
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=cs.stanford.edu+mailto&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=cs.stanford.edu+mailto&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmailto%26num%3D100&hl=en&q=EgS_ZdEnGMWPpLMGIjD3IZmT8c3uOfN9LrHd6odYMOPnawCTgaYjjogWlLMhnAHPvTKu0JowZDQw1u2bts8yAXJaAUM
x-hallmonitor-challenge: CgsIxo-kswYQifuvLhIEv2XRJw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-T9rOHyecnPE1ksKN-w-fIQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: gws
Content-Length: 455
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HxrLekF38a8kdwoD9MJL4_61Z7dNGrTNDj6NI7X7rFyTf18xcOuQoc; expires=Mon, 09-Dec-2024 02:28:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmailto%26num%3D100&hl=en&q=EgS_ZdEnGMWPpLMGIjD3IZmT8c3uOfN9LrHd6odYMOPnawCTgaYjjogWlLMhnAHPvTKu0JowZDQw1u2bts8yAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmailto%26num%3D100&hl=en&q=EgS_ZdEnGMWPpLMGIjD3IZmT8c3uOfN9LrHd6odYMOPnawCTgaYjjogWlLMhnAHPvTKu0JowZDQw1u2bts8yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:22 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3322
X-XSS-Protection: 0
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
DNS

11.97.55.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.97.55.23.in-addr.arpa

IN PTR

Response

11.97.55.23.in-addr.arpa

IN PTR

a23-55-97-11deploystaticakamaitechnologiescom
DNS

177.101.63.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

177.101.63.23.in-addr.arpa

IN PTR

Response

177.101.63.23.in-addr.arpa

IN PTR

a23-63-101-177deploystaticakamaitechnologiescom
GET

http://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:21 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

https://search.yahoo.com/?fr=altavista

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /?fr=altavista HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
set-cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159302&ltv_sts=1718159302&ltv_c=1; expires=Thu, 12-Jun-2025 02:28:22 GMT; Max-Age=31536000; path=/; domain=.search.yahoo.com
secure_search_bypass: true
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-DCVrkmxSZyrg7molCt+3Xg==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com *.yahooapis.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; img-src 'self' data: blob: https://*.aol.com https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://fun.games.com/ https://interactives.ap.org; media-src * blob:; object-src *; connect-src * blob:; font-src * data:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
cache-control: private
content-type: text/html; charset=UTF-8
x-envoy-upstream-service-time: 53
server: ATS
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=burtleburtle.net+mail&num=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=burtleburtle.net+mail&num=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjAZIMTPmcRjH3hnKQzT6tRkbnKogbH56LuLHWcLFPgdXU3seZkSdKHchypkQuc9bYgyAXJaAUM
x-hallmonitor-challenge: CgwIxo-kswYQmoyV7wESBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gYVs_Nxidognguuw0LcZTg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: gws
Content-Length: 453
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HyQwSktqxB0dUXDhVG1EVg2dVBeetFNOXePdjVxKtmiWtWKPy1JZmE; expires=Mon, 09-Dec-2024 02:28:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu&hl=en&q=EgS_ZdEnGMaPpLMGIjD-cfKHou23acARRzTL00eGHO3jVgsaDnqYl7ZGH8bEOaHVyF8n1a9nHH3YpVoyIDYyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu&hl=en&q=EgS_ZdEnGMaPpLMGIjD-cfKHou23acARRzTL00eGHO3jVgsaDnqYl7ZGH8bEOaHVyF8n1a9nHH3YpVoyIDYyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:22 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3280
X-XSS-Protection: 0
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu
Content-Length: 315
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email
Content-Length: 303
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu&hl=en&q=EgS_ZdEnGMaPpLMGIjD-cfKHou23acARRzTL00eGHO3jVgsaDnqYl7ZGH8bEOaHVyF8n1a9nHH3YpVoyIDYyAXJaAUM
x-hallmonitor-challenge: CgwIxo-kswYQ2fjS6wESBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-rPZGQMDX1sCyZg_dFoLv3Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: gws
Content-Length: 441
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HyGWybup1cvtDWAnP2rckq3i4c4xDBdsDmBLvLHon4gvFEvvJRg1Q; expires=Mon, 09-Dec-2024 02:28:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mail&num=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mail&num=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjBZZr0isKzoBqKKbWcYRSwlM5JBoUYiUWlQU2WmpGIIhMr3bn7pknSLP8i3W83Um3kyAXJaAUM
x-hallmonitor-challenge: CgwIxo-kswYQg7bomwMSBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UKzsKLNvUhyUlyu14YIWMQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: gws
Content-Length: 444
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HyQt9EsiI4suOcDjwtScLKRzjimrJedPjbRK8PFKQvkjYXIJ9ih8Q; expires=Mon, 09-Dec-2024 02:28:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjBZZr0isKzoBqKKbWcYRSwlM5JBoUYiUWlQU2WmpGIIhMr3bn7pknSLP8i3W83Um3kyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjBZZr0isKzoBqKKbWcYRSwlM5JBoUYiUWlQU2WmpGIIhMr3bn7pknSLP8i3W83Um3kyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:22 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3289
X-XSS-Protection: 0
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:22 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:22 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=
Content-Length: 25
Content-Type: text/html
GET

https://search.yahoo.com/?fr=altavista

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /?fr=altavista HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 200 OK

date: Wed, 12 Jun 2024 02:28:22 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
set-cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159302&ltv_sts=1718159302&ltv_c=1; expires=Thu, 12-Jun-2025 02:28:22 GMT; Max-Age=31536000; path=/; domain=.search.yahoo.com
secure_search_bypass: true
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-Ja3LxhZNZeV4n9500H8KAw==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com *.yahooapis.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; img-src 'self' data: blob: https://*.aol.com https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://fun.games.com/ https://interactives.ap.org; media-src * blob:; object-src *; connect-src * blob:; font-src * data:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
cache-control: private
content-type: text/html; charset=UTF-8
x-envoy-upstream-service-time: 54
server: ATS
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/?fr=altavista

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /?fr=altavista HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159301&ltv_c=1

Response

HTTP/1.1 200 OK

date: Wed, 12 Jun 2024 02:28:23 GMT
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
set-cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2; expires=Thu, 12-Jun-2025 02:28:23 GMT; Max-Age=31536000; path=/; domain=.search.yahoo.com
secure_search_bypass: true
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-VPkhLJ8jzlLK2/7zU/UGvA==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com *.yahooapis.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; img-src 'self' data: blob: https://*.aol.com https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://fun.games.com/ https://interactives.ap.org; media-src * blob:; object-src *; connect-src * blob:; font-src * data:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
cache-control: private
content-type: text/html; charset=UTF-8
x-envoy-upstream-service-time: 53
server: ATS
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159302&ltv_sts=1718159302&ltv_c=1

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-fNFs6vVB4U9RqYQf9jBEWQ==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:23 GMT
x-envoy-upstream-service-time: 78
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
GET

https://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-8pZqa6Xik/XE+HjGekBAZQ==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:24 GMT
x-envoy-upstream-service-time: 52
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
GET

https://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-moHtDw7xPw6ffQuftscl1g==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:25 GMT
x-envoy-upstream-service-time: 12
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjAZIMTPmcRjH3hnKQzT6tRkbnKogbH56LuLHWcLFPgdXU3seZkSdKHchypkQuc9bYgyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjAZIMTPmcRjH3hnKQzT6tRkbnKogbH56LuLHWcLFPgdXU3seZkSdKHchypkQuc9bYgyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:22 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3316
X-XSS-Protection: 0
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: Apache
X-Powered-By: PHP/7.2.14
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: Apache
X-Powered-By: PHP/7.2.14
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=gzip.org+contact+e-mail&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=gzip.org+contact+e-mail&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgzip.org%2Bcontact%2Be-mail%26num%3D100&hl=en&q=EgS_ZdEnGMaPpLMGIjBg9Ud2BWpBUWcZt2A9Q3E7yCgelNK1Ck4DQcUE1nQ7X25rpQQiaCmpRiSIgnhJgtAyAXJaAUM
x-hallmonitor-challenge: CgwIx4-kswYQtKvj1AESBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-NF8YjojE3e2JTzkF80S0rQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: gws
Content-Length: 458
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HyqHGoXb9DWuszSxHKaOJePJin7VGTn2NSabcbMHU7O8pat0IpHDVk; expires=Mon, 09-Dec-2024 02:28:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+gzip.org&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+gzip.org&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjAI1KghoGnzrnX7IZRo3O6eKVcZ8VgxWIu-Fj6iN7AqMQc8FnjZyA0YaLK26d1qxH0yAXJaAUM
x-hallmonitor-challenge: CgwIx4-kswYQjIz6qQMSBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-jk4v0YHgu-OeA_hw472ifw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: gws
Content-Length: 448
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HxQNxMJJp6ByiYK5XL9-Kj_OLp4L4pt0aoYa_Y1nqTac6XU8jRepw; expires=Mon, 09-Dec-2024 02:28:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgzip.org%2Bcontact%2Be-mail%26num%3D100&hl=en&q=EgS_ZdEnGMaPpLMGIjBg9Ud2BWpBUWcZt2A9Q3E7yCgelNK1Ck4DQcUE1nQ7X25rpQQiaCmpRiSIgnhJgtAyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgzip.org%2Bcontact%2Be-mail%26num%3D100&hl=en&q=EgS_ZdEnGMaPpLMGIjBg9Ud2BWpBUWcZt2A9Q3E7yCgelNK1Ck4DQcUE1nQ7X25rpQQiaCmpRiSIgnhJgtAyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:23 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3325
X-XSS-Protection: 0
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net
Content-Length: 313
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+alumni.caltech.edu&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+alumni.caltech.edu&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjBSbi2q9wiJqt5fG51ppUwwhcihnjShm9Qa5I0VwCcAP1PPH3ODKiQpC-I3Ns98bi0yAXJaAUM
x-hallmonitor-challenge: CgwIx4-kswYQgdjrlQISBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-8rrzZmdr3BcMSVww0tDvSQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: gws
Content-Length: 458
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HzcW4gXslpGy1VDkpi1OoR0yv7bQ3LV7UbwZXtIE29HC7GjM8V-zw; expires=Mon, 09-Dec-2024 02:28:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjD9mXRYj0GyvFkj7a56Y4oIbh_XWskrhqOwko0C1yo4dzjLgNq6nIlmFNRjTG5DgsoyAXJaAUM
x-hallmonitor-challenge: CgwIx4-kswYQ-LzG2QMSBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-T6m7wbKm55S_dAH1cuuUlA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:24 GMT
Server: gws
Content-Length: 455
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HxTq6q-gfc21nSBD4Phb9X3_sKVXIuv2VkCPD4IyhF2wcGKdYejH_g; expires=Mon, 09-Dec-2024 02:28:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjAI1KghoGnzrnX7IZRo3O6eKVcZ8VgxWIu-Fj6iN7AqMQc8FnjZyA0YaLK26d1qxH0yAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjAI1KghoGnzrnX7IZRo3O6eKVcZ8VgxWIu-Fj6iN7AqMQc8FnjZyA0YaLK26d1qxH0yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:24 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3301
X-XSS-Protection: 0
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:23 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159302&ltv_sts=1718159302&ltv_c=1

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:23 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:24 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:24 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:23 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
DNS

enigma.uk

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

enigma.uk

IN MX

Response
GET

https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-DTW5dYPAQS6hjWwMx81XjQ==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:24 GMT
x-envoy-upstream-service-time: 11
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 1
Transfer-Encoding: chunked
Connection: keep-alive
DNS

enigma.uk

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

enigma.uk

IN MX

Response
DNS

enigma.uk

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

enigma.uk

IN MX

Response
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjBSbi2q9wiJqt5fG51ppUwwhcihnjShm9Qa5I0VwCcAP1PPH3ODKiQpC-I3Ns98bi0yAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjBSbi2q9wiJqt5fG51ppUwwhcihnjShm9Qa5I0VwCcAP1PPH3ODKiQpC-I3Ns98bi0yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:24 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3331
X-XSS-Protection: 0
DNS

enigma.uk

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

enigma.uk

IN MX

Response
DNS

enigma.uk

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

enigma.uk

IN MX

Response
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjD9mXRYj0GyvFkj7a56Y4oIbh_XWskrhqOwko0C1yo4dzjLgNq6nIlmFNRjTG5DgsoyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjD9mXRYj0GyvFkj7a56Y4oIbh_XWskrhqOwko0C1yo4dzjLgNq6nIlmFNRjTG5DgsoyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:24 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3322
X-XSS-Protection: 0
GET

http://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:25 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:25 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:26 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu
Content-Length: 0
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:26 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:25 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=
Content-Length: 25
Content-Type: text/html
GET

https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-YwkYJyViD3u/yxQPzNyWFQ==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:26 GMT
x-envoy-upstream-service-time: 11
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 1
Transfer-Encoding: chunked
Connection: keep-alive
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=burtleburtle.net+reply&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=burtleburtle.net+reply&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Breply%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjDgO5z5uQ-P3qy3WR8WJpiLuUzYGT4sWG0xmmj9wiYJnAFY5vZ7eKd9Ci1cCchwzd8yAXJaAUM
x-hallmonitor-challenge: CgwIyo-kswYQod_Z7gESBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-zz-68MpLky3LkLPqUQCdig' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:26 GMT
Server: gws
Content-Length: 455
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HwnwFSXUO4whtUc8nD0EfmXVr6AVZPEuu_MXHG92cddVKkywwMokos; expires=Mon, 09-Dec-2024 02:28:26 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Breply%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjDgO5z5uQ-P3qy3WR8WJpiLuUzYGT4sWG0xmmj9wiYJnAFY5vZ7eKd9Ci1cCchwzd8yAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Breply%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjDgO5z5uQ-P3qy3WR8WJpiLuUzYGT4sWG0xmmj9wiYJnAFY5vZ7eKd9Ci1cCchwzd8yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:26 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3322
X-XSS-Protection: 0
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:26 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:26 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjBo_3CCCWzIZDRHK1raaqe5ZgiH0mulFfm0hN7GZ056Bsd6fR-bO-QGjpJZ_mqXWJwyAXJaAUM
x-hallmonitor-challenge: CgwIyo-kswYQ1IvggwMSBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UZXRCI0coEELhGgnGS6MIg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:26 GMT
Server: gws
Content-Length: 455
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6Hz8Qs9SZIrgrfkURejBoSIt6N4LDTag5u4jPJykHRYUZl_nTvojK8k; expires=Mon, 09-Dec-2024 02:28:26 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjBo_3CCCWzIZDRHK1raaqe5ZgiH0mulFfm0hN7GZ056Bsd6fR-bO-QGjpJZ_mqXWJwyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjBo_3CCCWzIZDRHK1raaqe5ZgiH0mulFfm0hN7GZ056Bsd6fR-bO-QGjpJZ_mqXWJwyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:26 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3322
X-XSS-Protection: 0
GET

https://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-euH/Tu1lZQhoreqEYNr4Vg==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:26 GMT
x-envoy-upstream-service-time: 15
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
DNS

groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

groups.io

IN MX

Response

groups.io

IN MX

lb01�

groups.io

IN MX

lb02�
DNS

lb01.groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

lb01.groups.io

IN A

Response

lb01.groups.io

IN A

45.79.81.153
GET

http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:26 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

http://search.yahoo.com/search?p=mail+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mail+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:28 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mail+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjBIugs-SW2LeoLZNhfByvaPqGEuDzBXCZXlljVqurAL2KlJiplYs994Y0XEnagr6ZUyAXJaAUM
x-hallmonitor-challenge: CgwIzI-kswYQr7i1xQISBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-d5kTuaROtBz16HwoeEu5bA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:28 GMT
Server: gws
Content-Length: 455
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HyfXnQKxREBF2gC_UNXE-np0aH_DAH97TVgaVXgl9kPRRxck43ut2Y; expires=Mon, 09-Dec-2024 02:28:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjBIugs-SW2LeoLZNhfByvaPqGEuDzBXCZXlljVqurAL2KlJiplYs994Y0XEnagr6ZUyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjBIugs-SW2LeoLZNhfByvaPqGEuDzBXCZXlljVqurAL2KlJiplYs994Y0XEnagr6ZUyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:28 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3322
X-XSS-Protection: 0
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=groups.io+mail&num=100

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=groups.io+mail&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgroups.io%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjCbe-awPF5F-cDiFvX84JM7DrrhEPFnJIpFZYbHGRTaKCZldbDHE45g0bLECvHLJFQyAXJaAUM
x-hallmonitor-challenge: CgwIzI-kswYQqpneygMSBL9l0Sc
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-yrHJ3ft8-yMCrBpqSWi8_g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 12 Jun 2024 02:28:28 GMT
Server: gws
Content-Length: 447
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AQTF6HxqS6GM_NUIK4_BpS2i4c1HyTF2bddut1-Nt40G5iOP7OgQHmeTpA; expires=Mon, 09-Dec-2024 02:28:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgroups.io%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjCbe-awPF5F-cDiFvX84JM7DrrhEPFnJIpFZYbHGRTaKCZldbDHE45g0bLECvHLJFQyAXJaAUM

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

142.250.187.196:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgroups.io%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjCbe-awPF5F-cDiFvX84JM7DrrhEPFnJIpFZYbHGRTaKCZldbDHE45g0bLECvHLJFQyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 12 Jun 2024 02:28:29 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3298
X-XSS-Protection: 0
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:28 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto
Content-Length: 305
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:28 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io
Content-Length: 314
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto
Content-Length: 313
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto
Content-Length: 0
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Jun 2024 02:28:28 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com
Cookie: PROMO=ltv_pid=altavista&ltv_new=1&ltv_ts=1718159301&ltv_sts=1718159303&ltv_c=2

Response

HTTP/1.1 200 OK

expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8
secure_search_bypass: true
content-security-policy: frame-ancestors 'none'; base-uri 'self'; default-src 'self' https://*.yahoo.com https://*.yimg.com; script-src 'self' 'unsafe-inline' 'nonce-Dw4ztjWds60PqHISVVReiA==' 'unsafe-eval' https://*.yahoo.net https://*.yahoo.com https://*.yimg.com https://*.uservoice.com *.oath.com https://*.hereapi.com https://*.youtube.com blob:; style-src 'self' 'unsafe-inline' https://assets.video.yahoo.net https://*.yimg.com; frame-src 'self' https://*.yahoo.net https://*.youtube.com https://s.yimg.com https://*.yahoo.com https://yahoo.uservoice.com https://*.vidible.tv https://*.advertising.com https://interactives.ap.org; img-src 'self' data: blob: https://s.aolcdn.com https://*.bing.net https://*.yimg.com https://s.ytimg.com yahoo.com https://*.yahoo.com https://*.bing.com *.here.com *.wc.yahoodns.net https://*.doubleclick.net https://sb.scorecardresearch.com https://*.adaptv.advertising.com https://*.vidible.tv https://*.yahoo.net https://*.footprint.net https://*.akamaized.net https://*.cloudfront.net https://*.llnwd.net; media-src * blob:; object-src 'self' https://*.yimg.com; connect-src * blob:; font-src * font:; child-src blob:;
vary: Accept-Encoding
content-encoding: gzip
date: Wed, 12 Jun 2024 02:28:29 GMT
x-envoy-upstream-service-time: 12
server: ATS
x-envoy-decorator-operation: sfe-k8s--syc-production-bf1.search--web-syc-k8s.svc.yahoo.local:4080/*
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Jun 2024 02:28:29 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
DNS

alt1.aspmx.l.google.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

alt1.aspmx.l.google.com

IN A

Response

alt1.aspmx.l.google.com

IN A

142.251.9.27
DNS

acm.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

acm.org

IN A

Response

acm.org

IN A

104.17.78.30

acm.org

IN A

104.17.79.30
DNS

cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

cs.stanford.edu

IN A

Response

cs.stanford.edu

IN A

171.64.64.64
DNS

burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

burtleburtle.net

IN A

Response

burtleburtle.net

IN A

65.254.227.224
DNS

alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

alumni.caltech.edu

IN A

Response

alumni.caltech.edu

IN A

75.2.70.75

alumni.caltech.edu

IN A

99.83.190.102
DNS

4.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.173.189.20.in-addr.arpa

IN PTR

Response
DNS

lb02.groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

Remote address:

8.8.8.8:53

Request

lb02.groups.io

IN A

Response

lb02.groups.io

IN A

173.255.221.194

10.0.2.15:1034

services.exe

260 B
5
23.44.234.16:80

260 B
5
192.168.2.103:1034

services.exe

260 B
5
13.107.253.64:443

46 B
40 B
1
1
192.168.2.102:1034

services.exe

260 B
5
192.168.2.16:1034

services.exe

260 B
5
52.142.223.178:80

322 B
7
192.168.2.15:1034

services.exe

260 B
5
192.168.2.102:1034

services.exe

260 B
5
142.250.102.26:25

aspmx.l.google.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
199.89.1.120:25

mail.mailroute.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
171.64.64.26:25

smtp2.cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
171.64.64.26:25

smtp2.cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
65.254.254.52:25

mx.burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
52.101.9.0:25

alumni-caltech-edu.mail.protection.outlook.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
85.187.148.2:25

gzip.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

573 B
648 B
5
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjAcV0KMKqt3Yb-n-nGL5VdKVjGH_UO0EStyB0SuNo1OE8eTs3QvyIXBRMVc7VWa5boyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.7kB
6.7kB
12
9

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=e-mail+m-ou.se&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=cs.stanford.edu+mail&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjAcV0KMKqt3Yb-n-nGL5VdKVjGH_UO0EStyB0SuNo1OE8eTs3QvyIXBRMVc7VWa5boyAXJaAUM

HTTP Response

429
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3De-mail%2Bm-ou.se%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjDIwVtK--ghaufHufnbq4bJrq8iRx8T0tUkFiB_OuYSTzbvzL4Q9CUJ1adcCPhkrE4yAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.2kB
10
7

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+email&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3De-mail%2Bm-ou.se%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjDIwVtK--ghaufHufnbq4bJrq8iRx8T0tUkFiB_OuYSTzbvzL4Q9CUJ1adcCPhkrE4yAXJaAUM

HTTP Response

429
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

626 B
655 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

618 B
790 B
6
4

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

HTTP Response

301
212.82.100.137:80

http://www.altavista.com/web/results?q=cs.stanford.edu+mail&kgs=0&kls=0&nbq=20

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.6kB
7.3kB
13
12

HTTP Request

GET http://www.altavista.com/web/results?q=burtleburtle.net+contact+e-mail&kgs=0&kls=0&nbq=50

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=mailto+acm.org&kgs=0&kls=0&nbq=50

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=cs.stanford.edu+mail&kgs=0&kls=0&nbq=20

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.3kB
63.5kB
57
54

HTTP Request

GET https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

200
212.82.100.137:443

https://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

11.6kB
258.6kB
209
206

HTTP Request

GET https://search.yahoo.com/search?p=mailto+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/?fr=altavista

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/?fr=altavista

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/?fr=altavista

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

200
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

617 B
788 B
6
4

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.2kB
18.7kB
26
20

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

HTTP Response

404
209.202.254.10:443

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.4kB
14
10

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

HTTP Response

302
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dm-ou.se%2Bemail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjB7OWJq8NfVk2FMvF1Ra9RxIZh0TrCay6AO-vWgXCSsAMjaIS_9LTQDkJMgKnmlCngyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

906 B
3.8kB
9
6

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dm-ou.se%2Bemail%26num%3D100&hl=en&q=EgS_ZdEnGMSPpLMGIjB7OWJq8NfVk2FMvF1Ra9RxIZh0TrCay6AO-vWgXCSsAMjaIS_9LTQDkJMgKnmlCngyAXJaAUM

HTTP Response

429
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org&hl=en&q=EgS_ZdEnGMWPpLMGIjA_SEjO7-JnAdLkItxIfmLAmREjFTGc70OqHJ66kAbWRDv9GpsTvfoRKV1e54ZxGFwyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.2kB
11
8

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+gzip.org

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org&hl=en&q=EgS_ZdEnGMWPpLMGIjA_SEjO7-JnAdLkItxIfmLAmREjFTGc70OqHJ66kAbWRDv9GpsTvfoRKV1e54ZxGFwyAXJaAUM

HTTP Response

429
212.82.100.137:80

http://www.altavista.com/web/results?q=acm.org+email&kgs=0&kls=0&nbq=20

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.3kB
16.7kB
24
23

HTTP Request

GET http://www.altavista.com/web/results?q=acm.org+mailto&kgs=0&kls=0

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=mailto+m-ou.se&kgs=0&kls=0&nbq=50

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=gzip.org+mailto&kgs=0&kls=0&nbq=50

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=mailto+alumni.caltech.edu&kgs=0&kls=0&nbq=50

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=mail+cs.stanford.edu&kgs=0&kls=0&nbq=50

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=cs.stanford.edu+e-mail&kgs=0&kls=0&nbq=20

HTTP Response

301

HTTP Request

GET http://www.altavista.com/web/results?q=acm.org+email&kgs=0&kls=0&nbq=20

HTTP Response

301
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

621 B
796 B
6
4

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

301
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmailto%26num%3D100&hl=en&q=EgS_ZdEnGMWPpLMGIjD3IZmT8c3uOfN9LrHd6odYMOPnawCTgaYjjogWlLMhnAHPvTKu0JowZDQw1u2bts8yAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.4kB
5.3kB
12
9

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=cs.stanford.edu+mailto&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcs.stanford.edu%2Bmailto%26num%3D100&hl=en&q=EgS_ZdEnGMWPpLMGIjD3IZmT8c3uOfN9LrHd6odYMOPnawCTgaYjjogWlLMhnAHPvTKu0JowZDQw1u2bts8yAXJaAUM

HTTP Response

429
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.8kB
18.3kB
24
19

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mail+burtleburtle.net

HTTP Response

404
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.2kB
18.7kB
26
20

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

625 B
654 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=reply+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/?fr=altavista

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.2kB
59.2kB
53
50

HTTP Request

GET https://search.yahoo.com/?fr=altavista

HTTP Response

200
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu&hl=en&q=EgS_ZdEnGMaPpLMGIjD-cfKHou23acARRzTL00eGHO3jVgsaDnqYl7ZGH8bEOaHVyF8n1a9nHH3YpVoyIDYyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.2kB
10
7

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=burtleburtle.net+mail&num=50

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu&hl=en&q=EgS_ZdEnGMaPpLMGIjD-cfKHou23acARRzTL00eGHO3jVgsaDnqYl7ZGH8bEOaHVyF8n1a9nHH3YpVoyIDYyAXJaAUM

HTTP Response

429
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.0kB
1.4kB
8
5

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

HTTP Response

301

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

HTTP Response

301
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjBZZr0isKzoBqKKbWcYRSwlM5JBoUYiUWlQU2WmpGIIhMr3bn7pknSLP8i3W83Um3kyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.7kB
6.6kB
13
10

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+cs.stanford.edu

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mail&num=50

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjBZZr0isKzoBqKKbWcYRSwlM5JBoUYiUWlQU2WmpGIIhMr3bn7pknSLP8i3W83Um3kyAXJaAUM

HTTP Response

429
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.2kB
18.7kB
26
20

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+alumni.caltech.edu

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

618 B
647 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

11.4kB
235.8kB
192
189

HTTP Request

GET https://search.yahoo.com/?fr=altavista

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/?fr=altavista

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

200

HTTP Request

GET https://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

200
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjAZIMTPmcRjH3hnKQzT6tRkbnKogbH56LuLHWcLFPgdXU3seZkSdKHchypkQuc9bYgyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

867 B
3.8kB
8
5

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Bmail%26num%3D50&hl=en&q=EgS_ZdEnGMaPpLMGIjAZIMTPmcRjH3hnKQzT6tRkbnKogbH56LuLHWcLFPgdXU3seZkSdKHchypkQuc9bYgyAXJaAUM

HTTP Response

429
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.2kB
18.7kB
26
20

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=m-ou.se+email

HTTP Response

404
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgzip.org%2Bcontact%2Be-mail%26num%3D100&hl=en&q=EgS_ZdEnGMaPpLMGIjBg9Ud2BWpBUWcZt2A9Q3E7yCgelNK1Ck4DQcUE1nQ7X25rpQQiaCmpRiSIgnhJgtAyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.8kB
6.7kB
13
10

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=gzip.org+contact+e-mail&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+gzip.org&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgzip.org%2Bcontact%2Be-mail%26num%3D100&hl=en&q=EgS_ZdEnGMaPpLMGIjBg9Ud2BWpBUWcZt2A9Q3E7yCgelNK1Ck4DQcUE1nQ7X25rpQQiaCmpRiSIgnhJgtAyAXJaAUM

HTTP Response

429
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

619 B
792 B
6
4

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

HTTP Response

301
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjAI1KghoGnzrnX7IZRo3O6eKVcZ8VgxWIu-Fj6iN7AqMQc8FnjZyA0YaLK26d1qxH0yAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.8kB
6.8kB
15
12

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+alumni.caltech.edu&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bgzip.org%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjAI1KghoGnzrnX7IZRo3O6eKVcZ8VgxWIu-Fj6iN7AqMQc8FnjZyA0YaLK26d1qxH0yAXJaAUM

HTTP Response

429
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.2kB
18.7kB
26
20

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+burtleburtle.net

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

706 B
647 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.3kB
18.8kB
27
21

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

712 B
653 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mail+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.3kB
55.7kB
52
49

HTTP Request

GET https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

200
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjBSbi2q9wiJqt5fG51ppUwwhcihnjShm9Qa5I0VwCcAP1PPH3ODKiQpC-I3Ns98bi0yAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

872 B
3.8kB
8
5

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjBSbi2q9wiJqt5fG51ppUwwhcihnjShm9Qa5I0VwCcAP1PPH3ODKiQpC-I3Ns98bi0yAXJaAUM

HTTP Response

429
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjD9mXRYj0GyvFkj7a56Y4oIbh_XWskrhqOwko0C1yo4dzjLgNq6nIlmFNRjTG5DgsoyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

915 B
3.9kB
9
6

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMePpLMGIjD9mXRYj0GyvFkj7a56Y4oIbh_XWskrhqOwko0C1yo4dzjLgNq6nIlmFNRjTG5DgsoyAXJaAUM

HTTP Response

429
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

708 B
649 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+enigma.uk&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.7kB
19.1kB
29
22

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+alumni.caltech.edu

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

708 B
649 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.0kB
49.8kB
46
43

HTTP Request

GET https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

HTTP Response

200
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Breply%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjDgO5z5uQ-P3qy3WR8WJpiLuUzYGT4sWG0xmmj9wiYJnAFY5vZ7eKd9Ci1cCchwzd8yAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.3kB
11
8

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=burtleburtle.net+reply&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dburtleburtle.net%2Breply%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjDgO5z5uQ-P3qy3WR8WJpiLuUzYGT4sWG0xmmj9wiYJnAFY5vZ7eKd9Ci1cCchwzd8yAXJaAUM

HTTP Response

429
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.8kB
18.3kB
24
19

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+cs.stanford.edu

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

713 B
654 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjBo_3CCCWzIZDRHK1raaqe5ZgiH0mulFfm0hN7GZ056Bsd6fR-bO-QGjpJZ_mqXWJwyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.4kB
5.3kB
12
9

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMqPpLMGIjBo_3CCCWzIZDRHK1raaqe5ZgiH0mulFfm0hN7GZ056Bsd6fR-bO-QGjpJZ_mqXWJwyAXJaAUM

HTTP Response

429
212.82.100.137:443

https://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.1kB
49.0kB
46
43

HTTP Request

GET https://search.yahoo.com/search?p=email+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

200
45.79.81.153:25

lb01.groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

260 B
5
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

713 B
654 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
212.82.100.137:443

search.yahoo.com

tls

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

4.8kB
86.2kB
74
72
212.82.100.137:80

http://search.yahoo.com/search?p=mail+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

703 B
644 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mail+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjBIugs-SW2LeoLZNhfByvaPqGEuDzBXCZXlljVqurAL2KlJiplYs994Y0XEnagr6ZUyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.3kB
11
8

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+cs.stanford.edu&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bcs.stanford.edu%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjBIugs-SW2LeoLZNhfByvaPqGEuDzBXCZXlljVqurAL2KlJiplYs994Y0XEnagr6ZUyAXJaAUM

HTTP Response

429
142.250.187.196:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgroups.io%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjCbe-awPF5F-cDiFvX84JM7DrrhEPFnJIpFZYbHGRTaKCZldbDHE45g0bLECvHLJFQyAXJaAUM

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.3kB
5.3kB
11
8

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=groups.io+mail&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dgroups.io%2Bmail%26num%3D100&hl=en&q=EgS_ZdEnGMyPpLMGIjCbe-awPF5F-cDiFvX84JM7DrrhEPFnJIpFZYbHGRTaKCZldbDHE45g0bLECvHLJFQyAXJaAUM

HTTP Response

429
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.5kB
2.1kB
10
6

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

HTTP Response

301

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

HTTP Response

301

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.7kB
19.1kB
29
22

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=gzip.org+mailto

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

705 B
646 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

3.2kB
55.5kB
49
47

HTTP Request

GET https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

200
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

2.2kB
18.7kB
26
20

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=contact+e-mail+groups.io

HTTP Response

404
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

tls, http

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

1.8kB
18.3kB
24
19

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=burtleburtle.net+mailto

HTTP Response

404
192.168.2.10:1034

services.exe

260 B
5
142.251.9.27:25

alt1.aspmx.l.google.com

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
104.17.78.30:25

acm.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
171.64.64.64:25

cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
171.64.64.64:25

cs.stanford.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
65.254.227.224:25

burtleburtle.net

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
75.2.70.75:25

alumni.caltech.edu

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
85.187.148.2:25

gzip.org

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

208 B
4
173.255.221.194:25

lb02.groups.io

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

156 B
3

8.8.8.8:53

13.86.106.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

13.86.106.20.in-addr.arpa
8.8.8.8:53

73.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.144.22.2.in-addr.arpa
8.8.8.8:53

67.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

67.31.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

164.189.21.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

164.189.21.2.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

m-ou.se

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

53 B
232 B
1
1

DNS Request

m-ou.se
8.8.8.8:53

acm.org

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

53 B
87 B
1
1

DNS Request

acm.org
8.8.8.8:53

aspmx.l.google.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

64 B
80 B
1
1

DNS Request

aspmx.l.google.com

DNS Response

142.250.102.26
8.8.8.8:53

mail.mailroute.net

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

64 B
96 B
1
1

DNS Request

mail.mailroute.net

DNS Response

199.89.1.120

199.89.3.120
8.8.8.8:53

cs.stanford.edu

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

61 B
121 B
1
1

DNS Request

cs.stanford.edu
8.8.8.8:53

smtp2.cs.stanford.edu

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

67 B
83 B
1
1

DNS Request

smtp2.cs.stanford.edu

DNS Response

171.64.64.26
8.8.8.8:53

burtleburtle.net

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

62 B
81 B
1
1

DNS Request

burtleburtle.net
8.8.8.8:53

mx.burtleburtle.net

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

65 B
113 B
1
1

DNS Request

mx.burtleburtle.net

DNS Response

65.254.254.52

65.254.254.51

65.254.254.50
8.8.8.8:53

alumni.caltech.edu

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

64 B
126 B
1
1

DNS Request

alumni.caltech.edu
8.8.8.8:53

alumni-caltech-edu.mail.protection.outlook.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

92 B
156 B
1
1

DNS Request

alumni-caltech-edu.mail.protection.outlook.com

DNS Response

52.101.9.0

52.101.9.5

52.101.8.46

52.101.11.19
8.8.8.8:53

gzip.org

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

54 B
70 B
1
1

DNS Request

gzip.org
8.8.8.8:53

gzip.org

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

54 B
70 B
1
1

DNS Request

gzip.org

DNS Response

85.187.148.2
8.8.8.8:53

search.yahoo.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

62 B
121 B
1
1

DNS Request

search.yahoo.com

DNS Response

212.82.100.137
8.8.8.8:53

search.lycos.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

62 B
109 B
1
1

DNS Request

search.lycos.com

DNS Response

209.202.254.10
8.8.8.8:53

www.google.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.187.196
8.8.8.8:53

www.altavista.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

63 B
157 B
1
1

DNS Request

www.altavista.com

DNS Response

212.82.100.137
8.8.8.8:53

137.100.82.212.in-addr.arpa

dns

73 B
119 B
1
1

DNS Request

137.100.82.212.in-addr.arpa
8.8.8.8:53

196.187.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

196.187.250.142.in-addr.arpa
8.8.8.8:53

10.254.202.209.in-addr.arpa

dns

73 B
113 B
1
1

DNS Request

10.254.202.209.in-addr.arpa
8.8.8.8:53

11.97.55.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

11.97.55.23.in-addr.arpa
8.8.8.8:53

177.101.63.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

177.101.63.23.in-addr.arpa
8.8.8.8:53

enigma.uk

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

55 B
118 B
1
1

DNS Request

enigma.uk
8.8.8.8:53

enigma.uk

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

110 B
236 B
2
2

DNS Request

enigma.uk

DNS Request

enigma.uk
8.8.8.8:53

enigma.uk

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

110 B
236 B
2
2

DNS Request

enigma.uk

DNS Request

enigma.uk
8.8.8.8:53

groups.io

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

55 B
97 B
1
1

DNS Request

groups.io
8.8.8.8:53

lb01.groups.io

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

60 B
76 B
1
1

DNS Request

lb01.groups.io

DNS Response

45.79.81.153
8.8.8.8:53

alt1.aspmx.l.google.com

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

69 B
85 B
1
1

DNS Request

alt1.aspmx.l.google.com

DNS Response

142.251.9.27
8.8.8.8:53

acm.org

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

53 B
85 B
1
1

DNS Request

acm.org

DNS Response

104.17.78.30

104.17.79.30
8.8.8.8:53

cs.stanford.edu

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

61 B
77 B
1
1

DNS Request

cs.stanford.edu

DNS Response

171.64.64.64
8.8.8.8:53

burtleburtle.net

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

62 B
78 B
1
1

DNS Request

burtleburtle.net

DNS Response

65.254.227.224
8.8.8.8:53

alumni.caltech.edu

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

64 B
96 B
1
1

DNS Request

alumni.caltech.edu

DNS Response

75.2.70.75

99.83.190.102
8.8.8.8:53

4.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

4.173.189.20.in-addr.arpa
8.8.8.8:53

lb02.groups.io

dns

ac10894b31f7b4e0a510cf7600d1adb68d0d5d71320d6a204dd3d4f9aec39e8e.exe

60 B
76 B
1
1

DNS Request

lb02.groups.io

DNS Response

173.255.221.194

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\Y2S541CL.htm

Filesize
185KB

MD5
7bb4534e3b8aaf27b0d11c261835af94

SHA1
d83f7f6faf27e34239fc87c012ff18586e3e0e82

SHA256
6eab3b67cee8a9adc9162d8309683b84b83456bd10a1ada5bc40ab8e851642e1

SHA512
d6744f76233e0641ccc51f22764d09ba83fbae0bd2dee342ffa2de1c58abea06851b1f75e9386f8c4fd277c64b7d996cc802c3d8d757804696e6a8f4515c69fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\1W92FRPY.htm

Filesize
185KB

MD5
98f1a48c0460ef2f036888b170f8b487

SHA1
03d57ec3afe33c46eafef3d1f1df7315cfe35546

SHA256
a03c486b1adb04f4f9761c1f0f8436128af6d1da159d2e0301e995944c144a47

SHA512
49640abd8551a2b02ad3d5c04c0370310dcd4f60084eff4109bdd1a2450bdf333caa85b21a3b2e893ce7cd70d09e768ee09e836ff9d4a5cfcf66ab3f092e4cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\MBUND6E3.htm

Filesize
185KB

MD5
c3bdb63a3a82e7059910261653b5c64f

SHA1
69c69ef0bc7c0f876be03428c8e65e3018432a2a

SHA256
6c7058b43a6d7f4ac22756a9e63c52246e1489af206d5c8f079074fcf77c825f

SHA512
66562b870646342036932e272f4af9564d959d275ac7421d2f44f79daf2aa334294c0a652b3ae1166c13ebb1c22ee8102f057e45f2cb1cc232d0dc2b099fd6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\results[3].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[2].htm

Filesize
165KB

MD5
712e18d2581aa2ba5761e6809bce27e6

SHA1
da2ebeb7baa6f2cd13ce48e7e0788d338365b372

SHA256
b0d0a57aed6fe4415174e7161980a2ffcf8586ff99401254d4eb50a7ea762a67

SHA512
5b2b881f2d5ad5a60ea0abff9caaae49c7819c44a65fa97b9555ba9e55149257a7f8ea23f549d46ba7ab25040dd40913b63bc392f72aab0bb25b4dbb48090f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[3].htm

Filesize
139KB

MD5
370900a19c6c06c2d37af52fdc030ed4

SHA1
6cf4fac940fe60fe8d5bce67c579736648bb567c

SHA256
c4c16d745bb5614ec729683a39cc13096a7053bf9919068c59a2ff71356616ed

SHA512
81844fc109649bb546816b8b2d51d8fe3b26e6a14cbe7f9bb03fb23c6cb656bdddc4d913f1d50f03f1a3f593e5f7b30170a9257f347c1a95810c184b4f3b56ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[5].htm

Filesize
129KB

MD5
132ab940bf53aae2a88d9f16b7e2b8bb

SHA1
87cbd5d365dd1489d29947a7b257375668665f74

SHA256
0602d4ac40f53b0296d06cb22528803ba6e09575f4a796624b4d215ace2cc659

SHA512
d0f7935cfe3f0f1419876dc2ca1aa1135aeed750aac399986d3327b4766d636e25ff1d94ebbf591ebc9b1cf3dea8ec7048157f06ef1aacd343b59bc8a4c9404d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAF14.tmp

Filesize
41KB

MD5
0295343611786fd6b14729bd647f37ee

SHA1
f9cc2e8fbff7bcf2cefcd2e6ecc29af4b8eff8ac

SHA256
3eebcedb62705a38ca843db5def606b56be41778264581ae501b9778a0d1768a

SHA512
f0d700551b65e70f2615d8e1e480e0a1d366ea0e0491d9d31cc6acc42095f5d8819453a77a1e71b3cc3990b3e51316751bff916c4b10c3cebb1db87d80868de9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
28fa44a393c2953e8071ae778faa7e17

SHA1
58a27de7f1e53475afc0439b09477a8f14912673

SHA256
a697d40734b5b6d087c39e0390abc1fa3c080256d03dad053ad8f4a87b520ffb

SHA512
c81ca0a53daf19385ed57c0508fe4273625b775eee3c7b662f6eb500e2327f35a38b02fb78eb11226f182f3cea509a781d145d177116bf4fed11a285e76f367f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
6c050b368572d220a46aca6532a70a91

SHA1
4dd12cfdb98ac1d9e26142d12c337f85c7256c6c

SHA256
713f90d39b8e0b80fffac52b4a6d017823955e0b0a5542c6049efd26a6f09cff

SHA512
fec36cfdb7ba8c071dd0b67d37b6506ce2ffecf23aa82336799ba20dc8a4592c4e2426e817f02b0c4d28faee4740f27728ada3894061cf1a5241b7447ff79fd8

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2416-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-264-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-260-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-208-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4848-207-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4848-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4848-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4848-259-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4848-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4848-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request