a5b334714b39b7302e86d1d5be0fb20c8dff2ece1e6940304e5b955ca83dcbfe

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 23:15 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a053e7e5a94ce9983a525c755d16c113_JaffaCakes118.html
Size

17KB
MD5

a053e7e5a94ce9983a525c755d16c113
SHA1

111edf0a1ebd783248ca4d5dbe21073d8699c8ca
SHA256

a5b334714b39b7302e86d1d5be0fb20c8dff2ece1e6940304e5b955ca83dcbfe
SHA512

0ba8f3c36a567fbaf5defc7c73a30c98da27c91dc1166f2a5ae9aa80c53c05b1effc7002788aec5bd818aabb85b455cc3a6529e240d09775f595d99fa9cb1b51
SSDEEP

192:rty8CR7uzDlt437+mmGk8pafknZ5nYsdIUkBw8okn6RZblW5+lPL6QokwB:ER7uzDlS3LBpafknZ5nSUd8odgQo7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3792	msedge.exe
3792	msedge.exe
2620	identity_helper.exe
2620	identity_helper.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 412	3792	msedge.exe	84
PID 3792 wrote to memory of 412	3792	msedge.exe	84
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 4740	3792	msedge.exe	85
PID 3792 wrote to memory of 3772	3792	msedge.exe	86
PID 3792 wrote to memory of 3772	3792	msedge.exe	86
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87
PID 3792 wrote to memory of 612	3792	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a053e7e5a94ce9983a525c755d16c113_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff815d46f8,0x7fff815d4708,0x7fff815d4718
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14266457248402533010,6980814587566277373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

Network

DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

0catch.com

msedge.exe

Remote address:

8.8.8.8:53

Request

0catch.com

IN A

Response

0catch.com

IN A

18.245.143.36

0catch.com

IN A

18.245.143.108

0catch.com

IN A

18.245.143.68

0catch.com

IN A

18.245.143.24
DNS

redvase.bravenet.com

msedge.exe

Remote address:

8.8.8.8:53

Request

redvase.bravenet.com

IN A

Response

redvase.bravenet.com

IN A

65.39.176.53

redvase.bravenet.com

IN A

65.39.176.52

redvase.bravenet.com

IN A

65.39.176.51
DNS

redvase.bravenet.com

msedge.exe

Remote address:

8.8.8.8:53

Request

redvase.bravenet.com

IN A
GET

http://0catch.com/freewebsite.png

msedge.exe

Remote address:

18.245.143.36:80

Request

GET /freewebsite.png HTTP/1.1
Host: 0catch.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

Server: CloudFront
Date: Fri, 16 Aug 2024 23:16:03 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Location: https://0catch.com/freewebsite.png
X-Cache: Redirect from cloudfront
Via: 1.1 5e8927f6dbbe16e857124daf8548aeb2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR5-P1
X-Amz-Cf-Id: p8ao6N3Gne22p7Jt7aEAhzciYZRqKIZBFHKVsO_MSebRaWZFjrJC0A==
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
GET

https://0catch.com/freewebsite.png

msedge.exe

Remote address:

18.245.143.36:443

Request

GET /freewebsite.png HTTP/2.0
host: 0catch.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/html
date: Thu, 15 Aug 2024 23:31:32 GMT
last-modified: Tue, 01 Feb 2022 15:27:48 GMT
etag: W/"e55ff6aa559bbfcf9221034ffe8cee76"
x-amz-version-id: DSazxJJ5V_vaol37KSceIaI5SjMUlr7B
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Error from cloudfront
via: 1.1 56d50c15e83a778a8a2df6031ec29098.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR5-P1
x-amz-cf-id: G00ns7LC4Ppo4BNaVjEWBYmC7369IcYF7bz5g9yYB31WsRBbQ4SKUw==
age: 85473
DNS

22.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.160.190.20.in-addr.arpa

IN PTR

Response
DNS

36.143.245.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.143.245.18.in-addr.arpa

IN PTR

Response

36.143.245.18.in-addr.arpa

IN PTR

server-18-245-143-36lhr5r cloudfrontnet
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

107.39.156.108.in-addr.arpa

Remote address:

8.8.8.8:53

Request

107.39.156.108.in-addr.arpa

IN PTR

Response

107.39.156.108.in-addr.arpa

IN PTR

server-108-156-39-107lhr50r cloudfrontnet
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

adunit.adrevmedia.com

msedge.exe

Remote address:

8.8.8.8:53

Request

adunit.adrevmedia.com

IN A

Response
DNS

exotic-live.com

msedge.exe

Remote address:

8.8.8.8:53

Request

exotic-live.com

IN A

Response

exotic-live.com

IN A

77.247.183.155
GET

http://exotic-live.com/go.php?sid=14

msedge.exe

Remote address:

77.247.183.155:80

Request

GET /go.php?sid=14 HTTP/1.1
Host: exotic-live.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 482
content-type: text/html; charset=utf-8
date: Fri, 16 Aug 2024 23:17:07 GMT
server: nginx
set-cookie: sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b; path=/; domain=.exotic-live.com; expires=Thu, 04 Sep 2092 02:31:14 GMT; max-age=2147483647; HttpOnly
GET

http://exotic-live.com/go.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTcyMzg1NzQyNywiaWF0IjoxNzIzODUwMjI3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydm01aDloNWM4YXFjMDZqMnMwNGVrYzciLCJuYmYiOjE3MjM4NTAyMjcsInRzIjoxNzIzODUwMjI3OTkwOTg1fQ.tuIXWQwi1lO2tlLozjBEXsPy_as3HA7NDmT_1wh4-G8&sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b

msedge.exe

Remote address:

77.247.183.155:80

Request

GET /go.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTcyMzg1NzQyNywiaWF0IjoxNzIzODUwMjI3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydm01aDloNWM4YXFjMDZqMnMwNGVrYzciLCJuYmYiOjE3MjM4NTAyMjcsInRzIjoxNzIzODUwMjI3OTkwOTg1fQ.tuIXWQwi1lO2tlLozjBEXsPy_as3HA7NDmT_1wh4-G8&sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b HTTP/1.1
Host: exotic-live.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://exotic-live.com/go.php?sid=14
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b

Response

HTTP/1.1 302 Found

cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Fri, 16 Aug 2024 23:17:08 GMT
location: http://ww1.exotic-live.com
server: nginx
set-cookie: sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b; path=/; domain=.exotic-live.com; expires=Thu, 04 Sep 2092 02:31:15 GMT; max-age=2147483647; HttpOnly
DNS

155.183.247.77.in-addr.arpa

Remote address:

8.8.8.8:53

Request

155.183.247.77.in-addr.arpa

IN PTR

Response
DNS

ww1.exotic-live.com

msedge.exe

Remote address:

8.8.8.8:53

Request

ww1.exotic-live.com

IN A

Response

ww1.exotic-live.com

IN CNAME

www10.smartname.com

www10.smartname.com

IN A

3.33.243.145

www10.smartname.com

IN A

15.197.204.56
GET

http://ww1.exotic-live.com/

msedge.exe

Remote address:

3.33.243.145:80

Request

GET / HTTP/1.1
Host: ww1.exotic-live.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://exotic-live.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b

Response

HTTP/1.1 200 OK

Server: openresty
Date: Fri, 16 Aug 2024 23:17:08 GMT
Content-Type: text/html
Content-Length: 114
Connection: keep-alive
GET

http://ww1.exotic-live.com/lander

msedge.exe

Remote address:

3.33.243.145:80

Request

GET /lander HTTP/1.1
Host: ww1.exotic-live.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://ww1.exotic-live.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b

Response

HTTP/1.1 200 OK

Server: openresty
Date: Fri, 16 Aug 2024 23:17:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private, max-age=86400
Set-Cookie: expiry_partner=; Path=/; Max-Age=86400
Set-Cookie: caf_ipaddr=194.110.13.70; Path=/; Max-Age=86400
Set-Cookie: country=GB; Path=/; Max-Age=86400
Set-Cookie: city=London; Path=/; Max-Age=86400
Set-Cookie: lander_type=parking; Path=/; Max-Age=86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_PovpBRwbfSmBGAfYFCwcwTnk0PgYgurBQy5szVNJ0MurhPJRgLkhgaSViHsH1t4B4aoOVpRuW/EoINd07aTD8w
X-Content-Type-Options: nosniff
DNS

www.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

172.217.20.196
DNS

www.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A
DNS

btloader.com

msedge.exe

Remote address:

8.8.8.8:53

Request

btloader.com

IN A

Response

btloader.com

IN A

104.22.74.216

btloader.com

IN A

172.67.41.60

btloader.com

IN A

104.22.75.216
DNS

img1.wsimg.com

msedge.exe

Remote address:

8.8.8.8:53

Request

img1.wsimg.com

IN A

Response

img1.wsimg.com

IN CNAME

global-wildcard.wsimg.com.sni-only.edgekey.net

global-wildcard.wsimg.com.sni-only.edgekey.net

IN CNAME

e40258.g.akamaiedge.net

e40258.g.akamaiedge.net

IN A

88.221.135.162

e40258.g.akamaiedge.net

IN A

88.221.135.179
GET

https://img1.wsimg.com/parking-lander/static/css/main.b04c2b5f.css

msedge.exe

Remote address:

88.221.135.162:443

Request

GET /parking-lander/static/css/main.b04c2b5f.css HTTP/2.0
host: img1.wsimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-amz-id-2: QOMABTNkUXrncFzQRA2OmvEw/BVKd3XkW1sfgYZR8LjRQcjPBVBnZD3f7f4OjW1bptatZSYGU7bbxRs5fYRMsw==
x-amz-request-id: RF56D3F00JETZ3WN
last-modified: Mon, 12 Aug 2024 21:32:59 GMT
etag: "5d48da9587ed5173cf3b747bc119b22d"
x-amz-server-side-encryption: AES256
x-amz-version-id: RzXeenZTvJi.dxYORPdUng46OnM.KgPP
accept-ranges: bytes
content-type: text/css
vary: Accept-Encoding
content-encoding: gzip
content-length: 1003
cache-control: max-age=31536000
expires: Sat, 16 Aug 2025 23:17:09 GMT
date: Fri, 16 Aug 2024 23:17:09 GMT
timing-allow-origin: *
access-control-allow-origin: *
GET

https://img1.wsimg.com/parking-lander/static/js/main.44e3ce99.js

msedge.exe

Remote address:

88.221.135.162:443

Request

GET /parking-lander/static/js/main.44e3ce99.js HTTP/2.0
host: img1.wsimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-amz-id-2: kFNhPgoAiMYulFnOk/188fr6vENs+u2h/ALDPC3hvrTtFhoxzkwz2qcUNhRH/oDPMxyrs4rQAO6YYl0aUlkGUg==
x-amz-request-id: RF5D4V186RPANJTW
last-modified: Mon, 12 Aug 2024 21:32:55 GMT
etag: "dc17f34b710dca1e7c9a19df357e6e9e"
x-amz-server-side-encryption: AES256
x-amz-version-id: Ud8b43sjPjhANm.r_9yFiUaf3gvo_hjw
accept-ranges: bytes
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
content-length: 176557
cache-control: max-age=31536000
expires: Sat, 16 Aug 2025 23:17:09 GMT
date: Fri, 16 Aug 2024 23:17:09 GMT
timing-allow-origin: *
access-control-allow-origin: *
GET

https://btloader.com/tag?o=5097926782615552&upapi=true

msedge.exe

Remote address:

104.22.74.216:443

Request

GET /tag?o=5097926782615552&upapi=true HTTP/2.0
host: btloader.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Fri, 16 Aug 2024 23:17:09 GMT
content-type: application/javascript
content-length: 19032
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
etag: "34b09e3279a427c15be09cd8874f379f"
last-modified: Fri, 16 Aug 2024 22:22:27 GMT
vary: Origin, Accept-Encoding
via: 1.1 google
cf-cache-status: HIT
age: 3058
accept-ranges: bytes
server: cloudflare
cf-ray: 8b4522dcdc086543-LHR
GET

https://btloader.com/tag?o=5097926782615552&upapi=true

msedge.exe

Remote address:

104.22.74.216:443

Request

GET /tag?o=5097926782615552&upapi=true HTTP/2.0
host: btloader.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
if-none-match: "34b09e3279a427c15be09cd8874f379f"
if-modified-since: Fri, 16 Aug 2024 22:22:27 GMT

Response

HTTP/2.0 304

date: Fri, 16 Aug 2024 23:17:10 GMT
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
etag: "34b09e3279a427c15be09cd8874f379f"
last-modified: Fri, 16 Aug 2024 22:22:27 GMT
vary: Origin, Accept-Encoding
via: 1.1 google
cf-cache-status: HIT
age: 3059
server: cloudflare
cf-ray: 8b4522e4aa5a6543-LHR
DNS

216.74.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

216.74.22.104.in-addr.arpa

IN PTR

Response
DNS

216.74.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

216.74.22.104.in-addr.arpa

IN PTR
DNS

162.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

162.135.221.88.in-addr.arpa

IN PTR

Response

162.135.221.88.in-addr.arpa

IN PTR

a88-221-135-162deploystaticakamaitechnologiescom
DNS

162.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

162.135.221.88.in-addr.arpa

IN PTR
DNS

145.243.33.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.243.33.3.in-addr.arpa

IN PTR

Response

145.243.33.3.in-addr.arpa

IN PTR

a3edc0dabdef92d6dawsglobalacceleratorcom
DNS

145.243.33.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.243.33.3.in-addr.arpa

IN PTR
GET

https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true

msedge.exe

Remote address:

172.217.20.196:443

Request

GET /adsense/domains/caf.js?abp=1&gdabp=true HTTP/2.0
host: www.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

syndicatedsearch.goog

msedge.exe

Remote address:

8.8.8.8:53

Request

syndicatedsearch.goog

IN A

Response

syndicatedsearch.goog

IN A

142.250.74.238
GET

https://img1.wsimg.com/parking-lander/px.js?ch=1&abp=1&gdabp=true

msedge.exe

Remote address:

88.221.135.162:443

Request

GET /parking-lander/px.js?ch=1&abp=1&gdabp=true HTTP/2.0
host: img1.wsimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: http://ww1.exotic-live.com
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-amz-id-2: HDoIse5Az8bxOG46GCYTu8LbGX/cTKRgwdKx7mCXQ0ycTGitUKkBSerKPNoj4TsFlPwCFh07LJL8hxp7u6Vkkg==
x-amz-request-id: AQ8NNKZ1Q37WSQN1
last-modified: Mon, 05 Aug 2024 16:19:34 GMT
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-server-side-encryption: AES256
x-amz-version-id: VpOp5kH7xlZ8sBobCxe1ryeMkfP8S_g6
accept-ranges: bytes
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=31536000
expires: Sat, 16 Aug 2025 23:17:10 GMT
date: Fri, 16 Aug 2024 23:17:10 GMT
content-length: 20
timing-allow-origin: *
access-control-allow-origin: *
GET

https://img1.wsimg.com/parking-lander/px.js?ch=2&abp=2&gdabp=true

msedge.exe

Remote address:

88.221.135.162:443

Request

GET /parking-lander/px.js?ch=2&abp=2&gdabp=true HTTP/2.0
host: img1.wsimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: http://ww1.exotic-live.com
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-amz-id-2: nPNjPDSUp4BsH8dRSBIs/nMJH9Dxv2Bqu6CxHdv8IpMeWKMEf6upLJm4ThD2zRaUdrKyl7e+m/0=
x-amz-request-id: 442CMVXXV9PRNZ6G
last-modified: Mon, 12 Aug 2024 21:33:01 GMT
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-server-side-encryption: AES256
x-amz-version-id: e0VKuYHuvFVwTSEshrtSpW54NV2lY1g5
accept-ranges: bytes
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=31536000
expires: Sat, 16 Aug 2025 23:17:10 GMT
date: Fri, 16 Aug 2024 23:17:10 GMT
content-length: 20
timing-allow-origin: *
access-control-allow-origin: *
DNS

ad-delivery.net

msedge.exe

Remote address:

8.8.8.8:53

Request

ad-delivery.net

IN A

Response

ad-delivery.net

IN A

172.67.69.19

ad-delivery.net

IN A

104.26.2.70

ad-delivery.net

IN A

104.26.3.70
DNS

api.aws.parking.godaddy.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.aws.parking.godaddy.com

IN A

Response

api.aws.parking.godaddy.com

IN CNAME

gddomainparking.com

gddomainparking.com

IN A

50.17.135.148

gddomainparking.com

IN A

18.214.32.149
DNS

196.20.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.20.217.172.in-addr.arpa

IN PTR

Response

196.20.217.172.in-addr.arpa

IN PTR

par10s50-in-f41e100net

196.20.217.172.in-addr.arpa

IN PTR

waw02s08-in-f196�H

196.20.217.172.in-addr.arpa

IN PTR

waw02s08-in-f4�H
DNS

238.74.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.74.250.142.in-addr.arpa

IN PTR

Response

238.74.250.142.in-addr.arpa

IN PTR

par10s40-in-f141e100net
GET

https://ad-delivery.net/px.gif?ch=2

msedge.exe

Remote address:

172.67.69.19:443

Request

GET /px.gif?ch=2 HTTP/2.0
host: ad-delivery.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Fri, 16 Aug 2024 23:17:10 GMT
content-type: image/gif
content-length: 43
x-guploader-uploadid: ABPtcPpF3CcOnTRiRgI4urS9c4v_8yDKLNd69bQoz_ViyfYzsV6ewFNsiyb6BmeIMRtdN6L2Meyt6NXt1w
x-goog-generation: 1620242732037093
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
x-goog-hash: crc32c=cpEfJQ==
x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow==
x-goog-storage-class: MULTI_REGIONAL
access-control-allow-origin: *
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
expires: Sat, 17 Aug 2024 23:17:10 GMT
cache-control: public, max-age=86400
age: 310094
last-modified: Wed, 05 May 2021 19:25:32 GMT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W5iw%2FJxDGkdNGvBzdpn74cHtUMfZqau617rPk20b16Li6a%2BaH5fWzpBghzXZCGAtg%2FMIACSJqba3XEHzPqjZlozEo055TxzcuT%2FfmFkQd3KQVzHEmM2n80%2BE54YUMHVMkA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8b4522e5bec19473-LHR
GET

https://ad-delivery.net/px.gif?ch=1&e=0.9824614551279742

msedge.exe

Remote address:

172.67.69.19:443

Request

GET /px.gif?ch=1&e=0.9824614551279742 HTTP/2.0
host: ad-delivery.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Fri, 16 Aug 2024 23:17:10 GMT
content-type: image/gif
content-length: 43
x-guploader-uploadid: ABPtcPpF3CcOnTRiRgI4urS9c4v_8yDKLNd69bQoz_ViyfYzsV6ewFNsiyb6BmeIMRtdN6L2Meyt6NXt1w
x-goog-generation: 1620242732037093
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
x-goog-hash: crc32c=cpEfJQ==
x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow==
x-goog-storage-class: MULTI_REGIONAL
access-control-allow-origin: *
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
expires: Sat, 17 Aug 2024 23:17:10 GMT
cache-control: public, max-age=86400
age: 310094
last-modified: Wed, 05 May 2021 19:25:32 GMT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oy%2F5PrFm%2B3Kj%2Ffb3P7HWEstz8IU3%2BJ6lSRTuAu8IYXA2Gp7hr8OxFOkyzPGQi1%2FoagUxbGtq%2FdTTjQm2qvJiUKais%2BC71%2FRTt%2BkoqVcMbxKXIlfVs0b%2BG2arusG5HI%2BS1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8b4522e5bec69473-LHR
OPTIONS

https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true

msedge.exe

Remote address:

50.17.135.148:443

Request

OPTIONS /v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true HTTP/2.0
host: api.aws.parking.godaddy.com
accept: */*
access-control-request-method: GET
access-control-request-headers: x-request-id
origin: http://ww1.exotic-live.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Fri, 16 Aug 2024 23:17:10 GMT
content-length: 0
set-cookie: AWSALB=nfJyUvN7WnCuS5O56dTcopyiUzID/3Aex5N9F1lCQhiPtAsiPyaQis47pMdrY1jw3+AuJOM8OUw2HvOGtbadZz1rhRP1Am82fXwjDgJkKNTpWmy34Y4o36rvgGc0; Expires=Fri, 23 Aug 2024 23:17:10 GMT; Path=/
set-cookie: AWSALBCORS=nfJyUvN7WnCuS5O56dTcopyiUzID/3Aex5N9F1lCQhiPtAsiPyaQis47pMdrY1jw3+AuJOM8OUw2HvOGtbadZz1rhRP1Am82fXwjDgJkKNTpWmy34Y4o36rvgGc0; Expires=Fri, 23 Aug 2024 23:17:10 GMT; Path=/; SameSite=None; Secure
access-control-allow-credentials: true
access-control-allow-headers: X-Request-Id
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-origin: http://ww1.exotic-live.com
access-control-max-age: 600
x-request-id: svSmK9YC
GET

https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true

msedge.exe

Remote address:

50.17.135.148:443

Request

GET /v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true HTTP/2.0
host: api.aws.parking.godaddy.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
x-request-id: 71b2562a-5370-41b4-8568-897a4667c320
accept: */*
origin: http://ww1.exotic-live.com
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Fri, 16 Aug 2024 23:17:10 GMT
content-type: application/json
content-length: 1027
set-cookie: AWSALB=2zRwPAhE8Dt8KiTTi3A8MUT9Y6XJ/98b/MZ3d30yjvlfPaHRgMdDPprVwaH7ekcYkIIEnzPy/fs5g2mArILZtcuA4j6Z8LILzb4DbmaWMzyqleh171rJkG31xsA9; Expires=Fri, 23 Aug 2024 23:17:10 GMT; Path=/
set-cookie: AWSALBCORS=2zRwPAhE8Dt8KiTTi3A8MUT9Y6XJ/98b/MZ3d30yjvlfPaHRgMdDPprVwaH7ekcYkIIEnzPy/fs5g2mArILZtcuA4j6Z8LILzb4DbmaWMzyqleh171rJkG31xsA9; Expires=Fri, 23 Aug 2024 23:17:10 GMT; Path=/; SameSite=None; Secure
access-control-allow-credentials: true
access-control-allow-origin: http://ww1.exotic-live.com
access-control-max-age: 600
cache-control: Private,max-age=86400
set-cookie: cpvisitor=fa4d45b3-9770-43b0-90b8-1bf48f465842; Path=/; Expires=Sun, 15 Sep 2024 23:17:10 GMT; Secure; SameSite=None
x-request-id: 71b2562a-5370-41b4-8568-897a4667c320
DNS

consent.truste.com

msedge.exe

Remote address:

8.8.8.8:53

Request

consent.truste.com

IN A

Response

consent.truste.com

IN A

18.244.155.128

consent.truste.com

IN A

18.244.155.92

consent.truste.com

IN A

18.244.155.107

consent.truste.com

IN A

18.244.155.55
GET

http://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1

msedge.exe

Remote address:

18.244.155.128:80

Request

GET /notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1 HTTP/1.1
Host: consent.truste.com
Connection: keep-alive
Origin: http://ww1.exotic-live.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Referer: http://ww1.exotic-live.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

Server: CloudFront
Date: Fri, 16 Aug 2024 23:17:11 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Location: https://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1
X-Cache: Redirect from cloudfront
Via: 1.1 bf3844a119fafd26895a288a42b50a42.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P8
X-Amz-Cf-Id: ZoZVk2XgdMiGqQJHrF4dJ9aDR-AjHZt1pWy0rLBjwZTSjYRPw6nd8A==
Cache-Control: max-age=3600
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
GET

https://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1

msedge.exe

Remote address:

18.244.155.128:443

Request

GET /notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1 HTTP/2.0
host: consent.truste.com
origin: null
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript; charset=UTF-8
date: Fri, 16 Aug 2024 23:17:11 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 fee1af928fb542120a907076855ee8f0.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P8
x-amz-cf-id: AbkhRhw4tDKixSPqu5cYFpd7Jntd6EG8LuII2pUwk3oNMB-v0nmQWQ==
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: *
DNS

consent.trustarc.com

msedge.exe

Remote address:

8.8.8.8:53

Request

consent.trustarc.com

IN A

Response

consent.trustarc.com

IN A

18.165.242.33

consent.trustarc.com

IN A

18.165.242.40

consent.trustarc.com

IN A

18.165.242.12

consent.trustarc.com

IN A

18.165.242.59
DNS

19.69.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.69.67.172.in-addr.arpa

IN PTR

Response
DNS

70.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

70.214.58.216.in-addr.arpa

IN PTR

Response

70.214.58.216.in-addr.arpa

IN PTR

par10s39-in-f61e100net

70.214.58.216.in-addr.arpa

IN PTR

fra15s10-in-f6�G

70.214.58.216.in-addr.arpa

IN PTR

fra15s10-in-f70�G
DNS

148.135.17.50.in-addr.arpa

Remote address:

8.8.8.8:53

Request

148.135.17.50.in-addr.arpa

IN PTR

Response

148.135.17.50.in-addr.arpa

IN PTR

ec2-50-17-135-148 compute-1 amazonawscom
DNS

128.155.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

128.155.244.18.in-addr.arpa

IN PTR

Response

128.155.244.18.in-addr.arpa

IN PTR

server-18-244-155-128lhr50r cloudfrontnet
GET

https://consent.trustarc.com/asset/tcfapi2.2.js

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /asset/tcfapi2.2.js HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: http://ww1.exotic-live.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript
last-modified: Mon, 29 Jul 2024 03:05:22 GMT
pragma: public
content-encoding: gzip
date: Fri, 16 Aug 2024 22:45:27 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c0d3087d57a8a55d4c0bfa30ec3ed778.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: _vv7X-yhfv01XdpjGQ-gHJnXEav0exG2PChuf_jOL6IxZAQwgmq9ZA==
age: 1904
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://consent.trustarc.com/asset/notice.js/v/v1.7-38

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /asset/notice.js/v/v1.7-38 HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: http://ww1.exotic-live.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript
date: Fri, 16 Aug 2024 22:55:48 GMT
last-modified: Mon, 5 Aug 2024 02:19:53 GMT
pragma: public
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c0d3087d57a8a55d4c0bfa30ec3ed778.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: ZsY0YRuuMMVyolWR5DxL-dMXyEKZGhbqaPEWh1XBcndNMMOYopeX7Q==
age: 1283
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://consent.trustarc.com/iab/v2?domain=godaddy_parking_iab.com&locale=en&iab22=true

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /iab/v2?domain=godaddy_parking_iab.com&locale=en&iab22=true HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: http://ww1.exotic-live.com
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json;charset=utf-8
date: Fri, 16 Aug 2024 23:09:08 GMT
cache-control: max-age=604800
x-cache: Hit from cloudfront
via: 1.1 c0d3087d57a8a55d4c0bfa30ec3ed778.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: YzWlOYf50XseOId_cRxLOZnRd6e0eZWM5VdzJfgTtXW6FG4vmuKvhw==
age: 483
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://consent.trustarc.com/get?name=MuseoSans_500.otf

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /get?name=MuseoSans_500.otf HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: http://ww1.exotic-live.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: font
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/octet-stream
content-length: 62504
date: Fri, 16 Aug 2024 23:07:03 GMT
pragma: public
x-cache: Hit from cloudfront
via: 1.1 c0d3087d57a8a55d4c0bfa30ec3ed778.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: xNFBMX3hUQvbg6QVyB2nsafZ622-o0OJ2qXsM9E_3lsRthCViXkFsw==
age: 608
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://consent.trustarc.com/get?name=MuseoSans-300.otf

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /get?name=MuseoSans-300.otf HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: http://ww1.exotic-live.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: font
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/octet-stream
content-length: 62924
date: Fri, 16 Aug 2024 23:07:56 GMT
pragma: public
x-cache: Hit from cloudfront
via: 1.1 c0d3087d57a8a55d4c0bfa30ec3ed778.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: KeUEHC8yRocB4H43CCKrdbeGRmdd9k-FTlmi_tIvATpfZxE1SrBdLg==
age: 555
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://consent.trustarc.com/log?domain=godaddy_parking_iab.com&country=gb&state=&behavior=implied&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&c=d8f8&referer=http://ww1.exotic-live.com&language=en

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /log?domain=godaddy_parking_iab.com&country=gb&state=&behavior=implied&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&c=d8f8&referer=http://ww1.exotic-live.com&language=en HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/gif
content-length: 43
date: Fri, 16 Aug 2024 23:17:11 GMT
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
content-security-policy: object-src 'none'; frame-ancestors https://*.trustarc.com https://*.prod.internal.trustarc.com https://*.trustarc.eu https://*.prod.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.trustarc-svc.net https://*.truste-svc.net https://*.qa.truste-svc.net https://*.dev.truste-svc.net http://localhost:* https://*.nymity.com https://*.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: cross-origin
expect-ct: enforce, max-age=60
permissions-policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-cache: Miss from cloudfront
via: 1.1 bb2554f7baaaf76b8275e54a76206d98.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: EfvOI8zX_Zt6b3kIjdaIQA7TRVroGNY_pELTPObziIZzv7CNOo37eg==
vary: Origin
GET

https://consent.trustarc.com/asset/ic-error.svg

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /asset/ic-error.svg HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/svg+xml
last-modified: Wed, 20 Mar 2019 06:14:12 GMT
pragma: public
content-encoding: gzip
date: Fri, 16 Aug 2024 23:11:52 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 bb2554f7baaaf76b8275e54a76206d98.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: nIwLjc3fGrHHfDLUAR7n8EP8j_3rH99fhaXftfWV6yfNJYyE4uB2cg==
age: 319
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
vary: Origin
GET

https://consent.trustarc.com/asset/ic-close-white.svg

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /asset/ic-close-white.svg HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/png
content-length: 2639
date: Fri, 16 Aug 2024 23:09:54 GMT
pragma: public
x-cache: Hit from cloudfront
via: 1.1 bb2554f7baaaf76b8275e54a76206d98.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: LhVlkM3SKsg3NdvOPOYSUV3JhMKjklGS7-2hq0KBiuGcR5Y2lCvVBQ==
age: 437
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
vary: Origin
GET

https://consent.trustarc.com/get?name=Powered-By-TrustArc.png

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /get?name=Powered-By-TrustArc.png HTTP/2.0
host: consent.trustarc.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/svg+xml
last-modified: Wed, 20 Mar 2019 06:14:09 GMT
pragma: public
content-encoding: gzip
date: Fri, 16 Aug 2024 23:17:09 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 bb2554f7baaaf76b8275e54a76206d98.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: WM8GouWQ0DcWoFcgFkaDuaRJi_ImNHodP_dM6fYY2G-_AEv_0uD8SQ==
age: 2
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
vary: Origin
GET

https://consent.trustarc.com/bannermsg?action=views&domain=godaddy_parking_iab.com&behavior=implied&country=gb&language=en&rand=0.21965182074605138&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&referer=http://ww1.exotic-live.com

msedge.exe

Remote address:

18.165.242.33:443

Request

GET /bannermsg?action=views&domain=godaddy_parking_iab.com&behavior=implied&country=gb&language=en&rand=0.21965182074605138&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&referer=http://ww1.exotic-live.com HTTP/2.0
host: consent.trustarc.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: http://ww1.exotic-live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/gif
content-length: 43
date: Fri, 16 Aug 2024 23:17:11 GMT
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
content-security-policy: object-src 'none'; frame-ancestors https://*.trustarc.com https://*.prod.internal.trustarc.com https://*.trustarc.eu https://*.prod.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.trustarc-svc.net https://*.truste-svc.net https://*.qa.truste-svc.net https://*.dev.truste-svc.net http://localhost:* https://*.nymity.com https://*.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: cross-origin
expect-ct: enforce, max-age=60
permissions-policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-cache: Miss from cloudfront
via: 1.1 bb2554f7baaaf76b8275e54a76206d98.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P6
x-amz-cf-id: 6QcePVy5iPqEW160MNZWMwz1syFc8rl2d5YW5gM-mn948nElG6jrpw==
vary: Origin
DNS

trustarc.com

msedge.exe

Remote address:

8.8.8.8:53

Request

trustarc.com

IN A

Response

trustarc.com

IN A

141.193.213.20

trustarc.com

IN A

141.193.213.21
DNS

www.godaddy.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.godaddy.com

IN A

Response

www.godaddy.com

IN CNAME

wildcard-ipv6.godaddy.com.edgekey.net

wildcard-ipv6.godaddy.com.edgekey.net

IN CNAME

e6001.dscx.akamaiedge.net

e6001.dscx.akamaiedge.net

IN A

23.211.96.23
DNS

33.242.165.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

33.242.165.18.in-addr.arpa

IN PTR

Response

33.242.165.18.in-addr.arpa

IN PTR

server-18-165-242-33lhr61r cloudfrontnet
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 940465
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4F5445B06EEB4EB895BA976E7FECDC94 Ref B: LON04EDGE1110 Ref C: 2024-08-16T23:17:44Z
date: Fri, 16 Aug 2024 23:17:43 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 577346
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4CA8114000B44E2BBA5DA8F08A22E240 Ref B: LON04EDGE1110 Ref C: 2024-08-16T23:17:44Z
date: Fri, 16 Aug 2024 23:17:43 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388129_199HS4001G3EH5S78&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239339388129_199HS4001G3EH5S78&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 676162
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9667B79459984948A99419E30B9F168A Ref B: LON04EDGE1110 Ref C: 2024-08-16T23:17:44Z
date: Fri, 16 Aug 2024 23:17:43 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 838075
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 02CF5AF909F54E89A8C49BD23BB5D205 Ref B: LON04EDGE1110 Ref C: 2024-08-16T23:17:44Z
date: Fri, 16 Aug 2024 23:17:43 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
DNS

10.28.171.150.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.28.171.150.in-addr.arpa

IN PTR

Response

18.245.143.36:80

0catch.com

msedge.exe

242 B
132 B
5
3
18.245.143.36:80

http://0catch.com/freewebsite.png

http

msedge.exe

678 B
810 B
7
5

HTTP Request

GET http://0catch.com/freewebsite.png

HTTP Response

301
18.245.143.36:443

https://0catch.com/freewebsite.png

tls, http2

msedge.exe

1.7kB
7.4kB
15
18

HTTP Request

GET https://0catch.com/freewebsite.png

HTTP Response

200
65.39.176.53:80

redvase.bravenet.com

msedge.exe

260 B
5
65.39.176.53:80

redvase.bravenet.com

msedge.exe

260 B
5
65.39.176.52:80

redvase.bravenet.com

msedge.exe

260 B
5
65.39.176.52:80

redvase.bravenet.com

msedge.exe

260 B
5
65.39.176.51:80

redvase.bravenet.com

msedge.exe

260 B
5
65.39.176.51:80

redvase.bravenet.com

msedge.exe

260 B
5
77.247.183.155:80

http://exotic-live.com/go.php?sid=14

http

msedge.exe

1.2kB
1.1kB
6
5

HTTP Request

GET http://exotic-live.com/go.php?sid=14

HTTP Response

200
77.247.183.155:80

http://exotic-live.com/go.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTcyMzg1NzQyNywiaWF0IjoxNzIzODUwMjI3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydm01aDloNWM4YXFjMDZqMnMwNGVrYzciLCJuYmYiOjE3MjM4NTAyMjcsInRzIjoxNzIzODUwMjI3OTkwOTg1fQ.tuIXWQwi1lO2tlLozjBEXsPy_as3HA7NDmT_1wh4-G8&sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b

http

msedge.exe

1.1kB
574 B
5
5

HTTP Request

GET http://exotic-live.com/go.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTcyMzg1NzQyNywiaWF0IjoxNzIzODUwMjI3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydm01aDloNWM4YXFjMDZqMnMwNGVrYzciLCJuYmYiOjE3MjM4NTAyMjcsInRzIjoxNzIzODUwMjI3OTkwOTg1fQ.tuIXWQwi1lO2tlLozjBEXsPy_as3HA7NDmT_1wh4-G8&sid=a85b93d8-5c25-11ef-b3ae-dc43d8d52e0b

HTTP Response

302
77.247.183.155:80

exotic-live.com

msedge.exe

190 B
84 B
4
2
3.33.243.145:80

http://ww1.exotic-live.com/lander

http

msedge.exe

1.4kB
1.9kB
8
8

HTTP Request

GET http://ww1.exotic-live.com/

HTTP Response

200

HTTP Request

GET http://ww1.exotic-live.com/lander

HTTP Response

200
3.33.243.145:80

ww1.exotic-live.com

msedge.exe

236 B
132 B
5
3
88.221.135.162:443

https://img1.wsimg.com/parking-lander/static/js/main.44e3ce99.js

tls, http2

msedge.exe

5.7kB
192.7kB
95
152

HTTP Request

GET https://img1.wsimg.com/parking-lander/static/css/main.b04c2b5f.css

HTTP Response

200

HTTP Request

GET https://img1.wsimg.com/parking-lander/static/js/main.44e3ce99.js

HTTP Response

200
104.22.74.216:443

https://btloader.com/tag?o=5097926782615552&upapi=true

tls, http2

msedge.exe

2.4kB
23.9kB
27
32

HTTP Request

GET https://btloader.com/tag?o=5097926782615552&upapi=true

HTTP Response

200

HTTP Request

GET https://btloader.com/tag?o=5097926782615552&upapi=true

HTTP Response

304
172.217.20.196:443

https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true

tls, http2

msedge.exe

3.2kB
66.2kB
45
56

HTTP Request

GET https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true
142.250.74.238:443

syndicatedsearch.goog

tls, http2

msedge.exe

953 B
5.6kB
8
7
88.221.135.162:443

https://img1.wsimg.com/parking-lander/px.js?ch=2&abp=2&gdabp=true

tls, http2

msedge.exe

1.9kB
9.4kB
16
21

HTTP Request

GET https://img1.wsimg.com/parking-lander/px.js?ch=1&abp=1&gdabp=true

HTTP Response

200

HTTP Request

GET https://img1.wsimg.com/parking-lander/px.js?ch=2&abp=2&gdabp=true

HTTP Response

200
172.67.69.19:443

https://ad-delivery.net/px.gif?ch=1&e=0.9824614551279742

tls, http2

msedge.exe

2.8kB
4.8kB
15
14

HTTP Request

GET https://ad-delivery.net/px.gif?ch=2

HTTP Request

GET https://ad-delivery.net/px.gif?ch=1&e=0.9824614551279742

HTTP Response

200

HTTP Response

200
172.67.69.19:443

ad-delivery.net

tls, http2

msedge.exe

2.0kB
3.1kB
9
7
50.17.135.148:443

https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true

tls, http2

msedge.exe

2.1kB
7.6kB
14
15

HTTP Request

OPTIONS https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true

HTTP Response

200

HTTP Request

GET https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.exotic-live.com&portfolioId=&abp=1&gdabp=true

HTTP Response

200
18.244.155.128:80

http://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1

http

msedge.exe

778 B
1.0kB
5
4

HTTP Request

GET http://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1

HTTP Response

301
18.244.155.128:443

https://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1

tls, http2

msedge.exe

2.1kB
20.6kB
21
22

HTTP Request

GET https://consent.truste.com/notice?domain=godaddy_parking_iab.com&c=teconsent&js=nj&noticeType=bb&text=true&privacypolicylink=https%3A%2F%2Fwww.godaddy.com%2Fagreements%2Fshowdoc%3Fpageid%3DPRIVACY&gtm=1

HTTP Response

200
18.165.242.33:443

https://consent.trustarc.com/get?name=MuseoSans-300.otf

tls, http2

msedge.exe

7.9kB
278.6kB
138
209

HTTP Request

GET https://consent.trustarc.com/asset/tcfapi2.2.js

HTTP Request

GET https://consent.trustarc.com/asset/notice.js/v/v1.7-38

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://consent.trustarc.com/iab/v2?domain=godaddy_parking_iab.com&locale=en&iab22=true

HTTP Request

GET https://consent.trustarc.com/get?name=MuseoSans_500.otf

HTTP Request

GET https://consent.trustarc.com/get?name=MuseoSans-300.otf

HTTP Response

200

HTTP Response

200

HTTP Response

200
18.165.242.33:443

consent.trustarc.com

tls

msedge.exe

989 B
6.5kB
9
10
18.165.242.33:443

https://consent.trustarc.com/bannermsg?action=views&domain=godaddy_parking_iab.com&behavior=implied&country=gb&language=en&rand=0.21965182074605138&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&referer=http://ww1.exotic-live.com

tls, http2

msedge.exe

2.9kB
15.5kB
26
26

HTTP Request

GET https://consent.trustarc.com/log?domain=godaddy_parking_iab.com&country=gb&state=&behavior=implied&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&c=d8f8&referer=http://ww1.exotic-live.com&language=en

HTTP Response

200

HTTP Request

GET https://consent.trustarc.com/asset/ic-error.svg

HTTP Request

GET https://consent.trustarc.com/asset/ic-close-white.svg

HTTP Request

GET https://consent.trustarc.com/get?name=Powered-By-TrustArc.png

HTTP Request

GET https://consent.trustarc.com/bannermsg?action=views&domain=godaddy_parking_iab.com&behavior=implied&country=gb&language=en&rand=0.21965182074605138&session=550e52a1-ff60-4d9a-ba55-4ebb13df12f0&userType=NEW&referer=http://ww1.exotic-live.com

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
150.171.28.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

tls, http2

13.7kB
348.7kB
264
262

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388129_199HS4001G3EH5S78&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.8kB
14
12
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13

8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

0catch.com

dns

msedge.exe

56 B
120 B
1
1

DNS Request

0catch.com

DNS Response

18.245.143.36

18.245.143.108

18.245.143.68

18.245.143.24
8.8.8.8:53

redvase.bravenet.com

dns

msedge.exe

132 B
114 B
2
1

DNS Request

redvase.bravenet.com

DNS Request

redvase.bravenet.com

DNS Response

65.39.176.53

65.39.176.52

65.39.176.51
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

22.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

22.160.190.20.in-addr.arpa
8.8.8.8:53

36.143.245.18.in-addr.arpa

dns

72 B
128 B
1
1

DNS Request

36.143.245.18.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

107.39.156.108.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

107.39.156.108.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
224.0.0.251:5353

msedge.exe

586 B
9
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

adunit.adrevmedia.com

dns

msedge.exe

67 B
133 B
1
1

DNS Request

adunit.adrevmedia.com
8.8.8.8:53

exotic-live.com

dns

msedge.exe

61 B
77 B
1
1

DNS Request

exotic-live.com

DNS Response

77.247.183.155
8.8.8.8:53

155.183.247.77.in-addr.arpa

dns

73 B
137 B
1
1

DNS Request

155.183.247.77.in-addr.arpa
8.8.8.8:53

ww1.exotic-live.com

dns

msedge.exe

65 B
127 B
1
1

DNS Request

ww1.exotic-live.com

DNS Response

3.33.243.145

15.197.204.56
8.8.8.8:53

www.google.com

dns

msedge.exe

120 B
76 B
2
1

DNS Request

www.google.com

DNS Request

www.google.com

DNS Response

172.217.20.196
8.8.8.8:53

btloader.com

dns

msedge.exe

58 B
106 B
1
1

DNS Request

btloader.com

DNS Response

104.22.74.216

172.67.41.60

104.22.75.216
8.8.8.8:53

img1.wsimg.com

dns

msedge.exe

60 B
186 B
1
1

DNS Request

img1.wsimg.com

DNS Response

88.221.135.162

88.221.135.179
8.8.8.8:53

216.74.22.104.in-addr.arpa

dns

144 B
134 B
2
1

DNS Request

216.74.22.104.in-addr.arpa

DNS Request

216.74.22.104.in-addr.arpa
8.8.8.8:53

162.135.221.88.in-addr.arpa

dns

146 B
139 B
2
1

DNS Request

162.135.221.88.in-addr.arpa

DNS Request

162.135.221.88.in-addr.arpa
8.8.8.8:53

145.243.33.3.in-addr.arpa

dns

142 B
127 B
2
1

DNS Request

145.243.33.3.in-addr.arpa

DNS Request

145.243.33.3.in-addr.arpa
8.8.8.8:53

syndicatedsearch.goog

dns

msedge.exe

67 B
83 B
1
1

DNS Request

syndicatedsearch.goog

DNS Response

142.250.74.238
8.8.8.8:53

ad-delivery.net

dns

msedge.exe

61 B
109 B
1
1

DNS Request

ad-delivery.net

DNS Response

172.67.69.19

104.26.2.70

104.26.3.70
8.8.8.8:53

api.aws.parking.godaddy.com

dns

msedge.exe

73 B
135 B
1
1

DNS Request

api.aws.parking.godaddy.com

DNS Response

50.17.135.148

18.214.32.149
8.8.8.8:53

196.20.217.172.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

196.20.217.172.in-addr.arpa
8.8.8.8:53

238.74.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

238.74.250.142.in-addr.arpa
8.8.8.8:53

consent.truste.com

dns

msedge.exe

64 B
128 B
1
1

DNS Request

consent.truste.com

DNS Response

18.244.155.128

18.244.155.92

18.244.155.107

18.244.155.55
8.8.8.8:53

consent.trustarc.com

dns

msedge.exe

66 B
130 B
1
1

DNS Request

consent.trustarc.com

DNS Response

18.165.242.33

18.165.242.40

18.165.242.12

18.165.242.59
8.8.8.8:53

19.69.67.172.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

19.69.67.172.in-addr.arpa
8.8.8.8:53

70.214.58.216.in-addr.arpa

dns

72 B
169 B
1
1

DNS Request

70.214.58.216.in-addr.arpa
8.8.8.8:53

148.135.17.50.in-addr.arpa

dns

72 B
127 B
1
1

DNS Request

148.135.17.50.in-addr.arpa
8.8.8.8:53

128.155.244.18.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

128.155.244.18.in-addr.arpa
8.8.8.8:53

trustarc.com

dns

msedge.exe

58 B
90 B
1
1

DNS Request

trustarc.com

DNS Response

141.193.213.20

141.193.213.21
8.8.8.8:53

www.godaddy.com

dns

msedge.exe

61 B
164 B
1
1

DNS Request

www.godaddy.com

DNS Response

23.211.96.23
8.8.8.8:53

33.242.165.18.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

33.242.165.18.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

124 B
170 B
2
1

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Response

150.171.28.10

150.171.27.10
8.8.8.8:53

10.28.171.150.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

10.28.171.150.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
49f8b66720fecfa0783ab4e8dcb8ee34

SHA1
a2cf08287859300c4a2fcff79328082a7c31eb48

SHA256
b4eca77a3c83f910d9650af19e10fce8d71bff1378beb540699089288c12bf8b

SHA512
99f02912470d2f90c11e7d97d9a6ea1077060c80489fbfea41596591ee9b92428111fa6950c2270135292084ac5a40db88cd67bfb96b842e2afb44f678fddf5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
81b4ab89b012c6fdd249e364967a4a3c

SHA1
3a72bc3817e7394712dac612fde82c322d4e30af

SHA256
a7baf57bee3d533c950bf088a1660b0ca8a0b6e676bff2c816eabb19787e5994

SHA512
a29c1a32c84beb54a8b965f12f81d4e31b287f91cee3608847a00b85f784d6442eee328d72cc22409a7e047757f5b4b6f1f775ef9a22adf8e60f522a9740a346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1022B

MD5
0a57c8ee77dfd93f23fcbbed81471411

SHA1
76d68fca8173204399563649692808e01092c1bd

SHA256
af628073abcfdc3333741dda1a242757b8a824ac6d502474596906d88a25f43d

SHA512
3ab0ec9d988ef6a53a40661f53b81809886f979b69f2c076ae5d0d9b8ac4940283a887eb9409b8a66b23d1bcc49155f45a866d14ee35aa4867bb4d1d5f6f86a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d49fdfa66d845955e5796f0ba8b08c6

SHA1
e5762f76139604de0be89e4bbd5ae6edc1e050e6

SHA256
4d89ba24ec14b92ff515f00f611956e2a283801edb5dd7530fda92c9b0b64e88

SHA512
5da973a2e16b49d594ea7ea6744108e01b29c5e4092b7d82a5401757e5a291e34346836bc4ee4ed88d0287f6e4130b5b9726a28b4594bd3f8f9c00caeb9e91e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdadd8d0120d4b07eddb59da1fa02596

SHA1
a6b941c63bd5dcca69da092315672d3f8415ae67

SHA256
68062ff20cf349c8692784652ae747dd193ea9be826dc4f226b0d3e396df48b9

SHA512
abc7c530629c2359457e74e78b11317533073bbf1eb39398bade3d2ed5f023472d92602a31c781ee57bb3832dd39115b19100ddfb51f7b305ba3e3bd57b33489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0437a15c8265397c1b4ee0beb40dc487

SHA1
42649ae4809f08d675a4f7e919ae93eddba67fe4

SHA256
af553a2e9df3469643f69d76b1525c54cd40749f16cd7daa3c51f58de161a41f

SHA512
b3824a82482d42d1d9b8d25b85862521d61d5926f026d8e8fa316087dcfd26e3940abaad4b2fe9cee3d799f0222c0587024d5fb7f73ad2bd8f02e141646a6e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd07f8370110b9ff3a81db8a65320d7d

SHA1
fe68ed12d453ea902d601c7eff4c81a97d4ed808

SHA256
eef9bca0e3eb250c8b37388addcf11b04cc6ad1e343d9452713f1dcc0faa1a19

SHA512
bef4f02ab0669a716156e0188135b44e75abfd2c6ecddbbd2bb7503bd0b7e07f5ff38ed3ed57bdc8db67b2bee23fb3d3c769d54d3d4e23aa9f305faaf0786820

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request