mydoom | d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01e

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 06:44 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
Size

29KB
MD5

f8fe6fc4011a3ee519aa620eddffb6f0
SHA1

4d164b35afc8272f145a1158ea089ff09fd4b551
SHA256

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01e
SHA512

3c3486f33d0f9439043d25527157c9e15c5c34af055513d7621ead3c94b5a18173e67371897604507e59f69b481c1f7dd3994f0a751b683e141271694f5eeed7
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/8:AEwVs+0jNDY1qi/q0

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 3 IoCs

resource	yara_rule
behavioral2/memory/1712-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1712-51-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1712-56-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Executes dropped EXE 1 IoCs

pid	Process
4768	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1712-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x00080000000234d9-4.dat	upx
behavioral2/memory/4768-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1712-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4768-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4768-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1712-51-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4768-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1712-56-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4768-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d0000000006c3-70.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
File created	C:\Windows\java.exe	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
File created	C:\Windows\services.exe	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4768	1712	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe	81
PID 1712 wrote to memory of 4768	1712	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe	81
PID 1712 wrote to memory of 4768	1712	d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe	81

C:\Users\Admin\AppData\Local\Temp\d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
"C:\Users\Admin\AppData\Local\Temp\d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4768

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

0.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.159.190.20.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

56.163.245.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.163.245.4.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

83.210.23.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

83.210.23.2.in-addr.arpa

IN PTR

Response

83.210.23.2.in-addr.arpa

IN PTR

a2-23-210-83deploystaticakamaitechnologiescom
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

11.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.227.111.52.in-addr.arpa

IN PTR

Response
DNS

m-ou.se

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

m-ou.se

IN MX

Response

m-ou.se

IN MX

aspmx3 googlemailcom

m-ou.se

IN MX

aspmxlgoogle�9

m-ou.se

IN MX

alt2�L

m-ou.se

IN MX

aspmx2�.

m-ou.se

IN MX

alt1�L

m-ou.se

IN MX

aspmx4�.

m-ou.se

IN MX

aspmx5�.
DNS

aspmx3.googlemail.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

aspmx3.googlemail.com

IN A

Response

aspmx3.googlemail.com

IN A

142.250.153.26
DNS

acm.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

acm.org

IN MX

Response

acm.org

IN MX

mail mailroutenet
DNS

mail.mailroute.net

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

mail.mailroute.net

IN A

Response

mail.mailroute.net

IN A

199.89.1.120

mail.mailroute.net

IN A

199.89.3.120
DNS

cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

cs.stanford.edu

IN MX

Response

cs.stanford.edu

IN MX

�

cs.stanford.edu

IN MX

smtp1�

cs.stanford.edu

IN MX

smtp2�
DNS

cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

cs.stanford.edu

IN A

Response

cs.stanford.edu

IN A

171.64.64.64
DNS

burtleburtle.net

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

burtleburtle.net

IN MX

Response

burtleburtle.net

IN MX

mx�
DNS

mx.burtleburtle.net

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

mx.burtleburtle.net

IN A

Response

mx.burtleburtle.net

IN A

65.254.254.50

mx.burtleburtle.net

IN A

65.254.254.52

mx.burtleburtle.net

IN A

65.254.254.51
DNS

alumni.caltech.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

alumni.caltech.edu

IN MX

Response

alumni.caltech.edu

IN MX

alumni-caltech-edumail protectionoutlookcom
DNS

alumni-caltech-edu.mail.protection.outlook.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

alumni-caltech-edu.mail.protection.outlook.com

IN A

Response

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.10.5

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.42.14

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.10.8

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.42.13
DNS

gzip.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN MX

Response

gzip.org

IN MX

�
DNS

gzip.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN A

Response

gzip.org

IN A

85.187.148.2
DNS

search.yahoo.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

search.yahoo.com

IN A

Response

search.yahoo.com

IN CNAME

ds-global3.l7.search.ystg1.b.yahoo.com

ds-global3.l7.search.ystg1.b.yahoo.com

IN A

212.82.100.137
GET

http://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:02 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
DNS

www.altavista.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

www.altavista.com

IN A

Response

www.altavista.com

IN CNAME

us.yhs4.search.yahoo.com

us.yhs4.search.yahoo.com

IN CNAME

ds-global3.l7.search.ystg1.b.yahoo.com

ds-global3.l7.search.ystg1.b.yahoo.com

IN A

212.82.100.137
GET

http://www.altavista.com/web/results?q=mail+burtleburtle.net&kgs=0&kls=0&nbq=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mail+burtleburtle.net&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:02 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=mail+acm.org&kgs=0&kls=0&nbq=20

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mail+acm.org&kgs=0&kls=0&nbq=20 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:02 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 INKApi Error

Date: Wed, 25 Sep 2024 06:46:02 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Content-Length: 0
GET

https://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:02 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
DNS

search.lycos.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

search.lycos.com

IN A

Response

search.lycos.com

IN CNAME

search-core2.bo3.lycos.com

search-core2.bo3.lycos.com

IN A

209.202.254.10
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:02 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu
Content-Length: 312
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:02 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org
Content-Length: 305
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:02 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:02 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
DNS

www.google.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.187.228
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=alumni.caltech.edu+mailto&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=alumni.caltech.edu+mailto&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dalumni.caltech.edu%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjCgiHLmdaPs6f7yUdPppXpIHXWBS1-ZSwRZQdDHGo-lyoAd3ofn1YM0g_SB5GeJCvwyAXJaAUM
x-hallmonitor-challenge: CgwIquPOtwYQnLmjxAMSBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ystNbdVlaOwzGqcs-8ogLQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:02 GMT
Server: gws
Content-Length: 458
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cqL5GiCt9AqFbwqCzO3iNU8zi-QEyabokzoyYtJyl7UDriLRtVVyGM; expires=Mon, 24-Mar-2025 06:46:02 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDsvm4AHktTSYT3cmDTdQUQKuznaKgM3wyxpf5PIOz8Zx7BgR5PxLTIgJZjg1gY3j4yAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDsvm4AHktTSYT3cmDTdQUQKuznaKgM3wyxpf5PIOz8Zx7BgR5PxLTIgJZjg1gY3j4yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:03 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3291
X-XSS-Protection: 0
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mail&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mail&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDsvm4AHktTSYT3cmDTdQUQKuznaKgM3wyxpf5PIOz8Zx7BgR5PxLTIgJZjg1gY3j4yAXJaAUM
x-hallmonitor-challenge: CgwIquPOtwYQ5t26rgMSBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-9YZdJEPtuYJstkrfxzivXQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:02 GMT
Server: gws
Content-Length: 445
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7coNjcEg5mqqKUxu05Bsj6Y5qeWX5K3Hdd9ZHCV-Q5ouTAFrwFTs8xY; expires=Mon, 24-Mar-2025 06:46:02 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+acm.org&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+acm.org&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bacm.org%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDMo_FIgFSUQSN-ttxrHmQrXNNHmWTpYfWPSPgCiT_4gyh6Qudwmn20ZEekukkOFfIyAXJaAUM
x-hallmonitor-challenge: CgsIq-POtwYQx-u6ZxIEiscdLA
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HgSqJgYe2wM2UFbdQBiazg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: gws
Content-Length: 447
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cpF2TmKpQYNJh64rHaeGfRuc-u48n4_8h2ezAl_FKTbo6e1Wp6mtFk; expires=Mon, 24-Mar-2025 06:46:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bacm.org%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDMo_FIgFSUQSN-ttxrHmQrXNNHmWTpYfWPSPgCiT_4gyh6Qudwmn20ZEekukkOFfIyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bacm.org%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDMo_FIgFSUQSN-ttxrHmQrXNNHmWTpYfWPSPgCiT_4gyh6Qudwmn20ZEekukkOFfIyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:03 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3297
X-XSS-Protection: 0
DNS

r10.o.lencr.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

8.8.8.8:53

Request

r10.o.lencr.org

IN A

Response

r10.o.lencr.org

IN CNAME

o.lencr.edgesuite.net

o.lencr.edgesuite.net

IN CNAME

a1887.dscq.akamai.net

a1887.dscq.akamai.net

IN A

96.17.179.193

a1887.dscq.akamai.net

IN A

96.17.179.201
GET

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQm%2FTGeMjmA8601cvXq8gl6CA%3D%3D

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

96.17.179.193:80

Request

GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQm%2FTGeMjmA8601cvXq8gl6CA%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: r10.o.lencr.org

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "94C759EF52B77D2F17AC1B9FEC91E5010456547EA36C17848D991D5C9BDA48CF"
Last-Modified: Sun, 22 Sep 2024 18:30:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1670
Expires: Wed, 25 Sep 2024 07:13:52 GMT
Date: Wed, 25 Sep 2024 06:46:02 GMT
Connection: keep-alive
GET

http://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:02 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=
Content-Length: 25
Content-Type: text/html
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: Apache
X-Powered-By: PHP/7.2.17
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

https://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:03 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
DNS

137.100.82.212.in-addr.arpa

Remote address:

8.8.8.8:53

Request

137.100.82.212.in-addr.arpa

IN PTR

Response

137.100.82.212.in-addr.arpa

IN PTR

ats1l7searchvipir2yahoocom
DNS

10.254.202.209.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.254.202.209.in-addr.arpa

IN PTR

Response

10.254.202.209.in-addr.arpa

IN PTR

search-core2bo3lycoscom
DNS

228.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.187.250.142.in-addr.arpa

IN PTR

Response

228.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f41e100net
DNS

40.13.222.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

40.13.222.173.in-addr.arpa

IN PTR

Response

40.13.222.173.in-addr.arpa

IN PTR

a173-222-13-40deploystaticakamaitechnologiescom
DNS

193.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

193.179.17.96.in-addr.arpa

IN PTR

Response

193.179.17.96.in-addr.arpa

IN PTR

a96-17-179-193deploystaticakamaitechnologiescom
GET

http://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:03 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dalumni.caltech.edu%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjCgiHLmdaPs6f7yUdPppXpIHXWBS1-ZSwRZQdDHGo-lyoAd3ofn1YM0g_SB5GeJCvwyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dalumni.caltech.edu%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjCgiHLmdaPs6f7yUdPppXpIHXWBS1-ZSwRZQdDHGo-lyoAd3ofn1YM0g_SB5GeJCvwyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:03 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3330
X-XSS-Protection: 0
GET

http://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:03 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

https://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:03 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+alumni.caltech.edu&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=email+alumni.caltech.edu&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgSKxx0sGKvjzrcGIjBBur9FB4X6yVfghgaG1bBJgbAjVzoJ7yYpPQSxu_eSIt1FmaDxB0vJDme_f9bLyBkyAXJaAUM
x-hallmonitor-challenge: CgwIq-POtwYQ3LyJogISBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tEF3CpJcRhAmWKCNeJ3T3Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: gws
Content-Length: 457
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cqs3Jk-sSf7tL-cKQ46R3B7HrNmFWhR1ABlTXi1bNecSp9i7qc69g; expires=Mon, 24-Mar-2025 06:46:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgSKxx0sGKvjzrcGIjBBur9FB4X6yVfghgaG1bBJgbAjVzoJ7yYpPQSxu_eSIt1FmaDxB0vJDme_f9bLyBkyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgSKxx0sGKvjzrcGIjBBur9FB4X6yVfghgaG1bBJgbAjVzoJ7yYpPQSxu_eSIt1FmaDxB0vJDme_f9bLyBkyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:03 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3327
X-XSS-Protection: 0
GET

https://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:03 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+cs.stanford.edu&num=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=email+cs.stanford.edu&num=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKvjzrcGIjCzKDECpAU1izvtl0fw4lQrXn1-zTUl4JNhkAov2dyWN7T209sb54d8NCdcoonxxrUyAXJaAUM
x-hallmonitor-challenge: CgwIq-POtwYQheavlQMSBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-KolV76LH_yIYROUlU2FsMQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: gws
Content-Length: 453
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cp4RzrvHumoYlpx1juY_ZaGUIBksOUx5Ye3p2J9NhixGylbxijPHA; expires=Mon, 24-Mar-2025 06:46:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKvjzrcGIjCzKDECpAU1izvtl0fw4lQrXn1-zTUl4JNhkAov2dyWN7T209sb54d8NCdcoonxxrUyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKvjzrcGIjCzKDECpAU1izvtl0fw4lQrXn1-zTUl4JNhkAov2dyWN7T209sb54d8NCdcoonxxrUyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:03 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3315
X-XSS-Protection: 0
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org
Content-Length: 303
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:03 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail
Content-Length: 312
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://www.altavista.com/web/results?q=contact+mail+cs.stanford.edu&kgs=0&kls=0

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=contact+mail+cs.stanford.edu&kgs=0&kls=0 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:03 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:04 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=email+gzip.org&kgs=0&kls=0&nbq=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=email+gzip.org&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:05 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://www.altavista.com/web/results?q=mail+alumni.caltech.edu&kgs=0&kls=0&nbq=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /web/results?q=mail+alumni.caltech.edu&kgs=0&kls=0&nbq=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.altavista.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:05 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:03 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: Apache
X-Powered-By: PHP/7.2.22
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=email+acm.org
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=email+acm.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=email+acm.org HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: Apache
X-Powered-By: PHP/7.2.22
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:03 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:03 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:04 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: Apache
X-Powered-By: PHP/7.2.14
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: Apache
X-Powered-By: PHP/7.2.14
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:04 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mailto&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mailto&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKzjzrcGIjBceKJqrvwtpihIBLMZNSrXQs4I5M7RhZw4GvoAx0Yr945CpmBSfEMD-mzMHR7Msg8yAXJaAUM
x-hallmonitor-challenge: CgwIrOPOtwYQ5sagrQISBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-yrawkh_lf30PR3MI5FD29A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: gws
Content-Length: 447
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7crCihxenyQVCjZE-mxFZSQd3936IyCTQBjkyyPOHdGxYwQa_SpXKGU; expires=Mon, 24-Mar-2025 06:46:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+cs.stanford.edu&num=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+cs.stanford.edu&num=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCZrCk3K_N5-L0bUq5GctCtWbMKszDuygkj8g_HcqCdnnc7ryQIAKE3_tg9BecpuvgyAXJaAUM
x-hallmonitor-challenge: CgsIrePOtwYQgrmmQRIEiscdLA
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-RDKSBPWzljU2RcyK56gPLw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:05 GMT
Server: gws
Content-Length: 452
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cquIWIPzrFQFokgkasyyJCDGgZ-RPvhSjyhHPtEZ4sA79PMc-AdY3s; expires=Mon, 24-Mar-2025 06:46:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCZrCk3K_N5-L0bUq5GctCtWbMKszDuygkj8g_HcqCdnnc7ryQIAKE3_tg9BecpuvgyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCZrCk3K_N5-L0bUq5GctCtWbMKszDuygkj8g_HcqCdnnc7ryQIAKE3_tg9BecpuvgyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:05 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3312
X-XSS-Protection: 0
GET

https://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:04 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:04 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=reply+burtleburtle.net&num=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=reply+burtleburtle.net&num=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dreply%2Bburtleburtle.net%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCjre9ZQ9jHP6KWI0KG33Ej_VBMGUBM-48hH9kOY9zk30nk7NAxGFzy0wDyvxOzDEEyAXJaAUM
x-hallmonitor-challenge: CgwIrOPOtwYQ57yl3gISBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tl4udhMfSVNL3zWLYHBZMQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: gws
Content-Length: 454
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cpeEvmnMYP1VaR6rspT5xYjImGotLzoXEOKRO8QPaWlyugkW191Nw; expires=Mon, 24-Mar-2025 06:46:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKzjzrcGIjBceKJqrvwtpihIBLMZNSrXQs4I5M7RhZw4GvoAx0Yr945CpmBSfEMD-mzMHR7Msg8yAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKzjzrcGIjBceKJqrvwtpihIBLMZNSrXQs4I5M7RhZw4GvoAx0Yr945CpmBSfEMD-mzMHR7Msg8yAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3297
X-XSS-Protection: 0
GET

https://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:04 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:80

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:04 GMT
Server: Apache
Location: https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se
Content-Length: 304
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:04 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 302 Found

Date: Wed, 25 Sep 2024 06:46:05 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.lycos.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 25 Sep 2024 06:46:05 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dreply%2Bburtleburtle.net%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCjre9ZQ9jHP6KWI0KG33Ej_VBMGUBM-48hH9kOY9zk30nk7NAxGFzy0wDyvxOzDEEyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dreply%2Bburtleburtle.net%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCjre9ZQ9jHP6KWI0KG33Ej_VBMGUBM-48hH9kOY9zk30nk7NAxGFzy0wDyvxOzDEEyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3318
X-XSS-Protection: 0
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+acm.org&num=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=email+acm.org&num=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bacm.org%26num%3D50&hl=en&q=EgSKxx0sGK3jzrcGIjAkQE93by0YayOGaRa2meqXpj8OV-8T4YNrg7yVTG4Q2Xy01KnA0FeI88Q8bVedmKIyAXJaAUM
x-hallmonitor-challenge: CgwIrePOtwYQvKCZ5AESBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-84juwPztCMG8N6U8aF2-dw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:05 GMT
Server: gws
Content-Length: 445
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7coqVOvqyM1SpvaMwtjaB_CleAKjsYDFeOK6BeOjQopOAav4mkn71WA; expires=Mon, 24-Mar-2025 06:46:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=contact+e-mail+m-ou.se&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=contact+e-mail+m-ou.se&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dcontact%2Be-mail%2Bm-ou.se%26num%3D100&hl=en&q=EgSKxx0sGK3jzrcGIjAAd8-m3SlXjtijZ71EOOqpPZCpVan4ildeAgTgtgVp9Uhf4ZwUIlsKdOB918HZifYyAXJaAUM
x-hallmonitor-challenge: CgwIrePOtwYQrsfnzAMSBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-eBrWFgMt0JP0DbHgj0JNsQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:05 GMT
Server: gws
Content-Length: 457
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7coKGct35fu3p5TTPvC8wTJDb697Y3-be3E6YgTks8JTi_HgOee1Jg; expires=Mon, 24-Mar-2025 06:46:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+gzip.org&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+gzip.org&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive
GET

http://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:05 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50
Content-Length: 25
Content-Type: text/html
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+m-ou.se&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=email+m-ou.se&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bm-ou.se%26num%3D100&hl=en&q=EgSKxx0sGK3jzrcGIjBFF1vj5U3KINSr1YVuvSw19EJiR5beIfNUR31vBxGtSVrBZeyhmexFMCrZOyWRjgkyAXJaAUM
x-hallmonitor-challenge: CgwIrePOtwYQzY6F5AISBIrHHSw
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-6swaG3yUV9UCn0JNRHXnjQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/xsrp
Date: Wed, 25 Sep 2024 06:46:05 GMT
Server: gws
Content-Length: 446
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cqq0k49j2e8CAGJJP9p5n9OOVHgmmtTC3Ra31D9gMY0WfRslFQRcA; expires=Mon, 24-Mar-2025 06:46:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
GET

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bacm.org%26num%3D50&hl=en&q=EgSKxx0sGK3jzrcGIjAkQE93by0YayOGaRa2meqXpj8OV-8T4YNrg7yVTG4Q2Xy01KnA0FeI88Q8bVedmKIyAXJaAUM

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bacm.org%26num%3D50&hl=en&q=EgSKxx0sGK3jzrcGIjAkQE93by0YayOGaRa2meqXpj8OV-8T4YNrg7yVTG4Q2Xy01KnA0FeI88Q8bVedmKIyAXJaAUM HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 25 Sep 2024 06:46:05 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3291
X-XSS-Protection: 0
GET

https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:443

Request

GET /search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: search.yahoo.com

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/plain; charset=utf-8;
Secure_search_bypass: true
Date: Wed, 25 Sep 2024 06:46:05 GMT
Content-Encoding: gzip
Age: 0
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
GET

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

209.202.254.10:443

Request

GET /default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.lycos.com
Connection: Keep-Alive
GET

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+mailto&num=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

142.250.187.228:80

Request

GET /search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+mailto&num=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive
GET

http://search.yahoo.com/search?p=gzip.org+e-mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=gzip.org+e-mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 25 Sep 2024 06:46:06 GMT
Connection: close
Server: ATS
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block; report=https://csp.search.yahoo.com/xssreport
Referrer-Policy: no-referrer-when-downgrade
Location: https://search.yahoo.com/search?p=gzip.org+e-mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
Content-Length: 25
Content-Type: text/html
GET

http://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

Remote address:

212.82.100.137:80

Request

GET /search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: search.yahoo.com
Connection: Keep-Alive

172.16.1.2:1034

services.exe

260 B
5
10.241.35.61:1034

services.exe

260 B
5
10.202.221.84:1034

services.exe

260 B
5
172.16.1.5:1034

services.exe

260 B
5
10.222.21.129:1034

services.exe

260 B
5
10.152.243.207:1034

services.exe

208 B
4
142.250.153.26:25

aspmx3.googlemail.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
199.89.1.120:25

mail.mailroute.net

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
171.64.64.64:25

cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
171.64.64.64:25

cs.stanford.edu

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
65.254.254.50:25

mx.burtleburtle.net

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
52.101.10.5:25

alumni-caltech-edu.mail.protection.outlook.com

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
85.187.148.2:25

gzip.org

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

156 B
3
212.82.100.137:80

http://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

632 B
661 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
212.82.100.137:80

http://www.altavista.com/web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.4kB
1.4kB
10
7

HTTP Request

GET http://www.altavista.com/web/results?q=mail+burtleburtle.net&kgs=0&kls=0&nbq=50

HTTP Response

500

HTTP Request

GET http://www.altavista.com/web/results?q=mail+acm.org&kgs=0&kls=0&nbq=20

HTTP Response

500

HTTP Request

GET http://www.altavista.com/web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50

HTTP Response

500
212.82.100.137:443

https://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=cs.stanford.edu+contact+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

500
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.0kB
1.4kB
8
5

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

HTTP Response

301

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

HTTP Response

301
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

618 B
647 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

2.1kB
17.2kB
24
18

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=e-mail+cs.stanford.edu

HTTP Response

404
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.5kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=mailto+gzip.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

500
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDsvm4AHktTSYT3cmDTdQUQKuznaKgM3wyxpf5PIOz8Zx7BgR5PxLTIgJZjg1gY3j4yAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
5.3kB
11
8

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=alumni.caltech.edu+mailto&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmail%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDsvm4AHktTSYT3cmDTdQUQKuznaKgM3wyxpf5PIOz8Zx7BgR5PxLTIgJZjg1gY3j4yAXJaAUM

HTTP Response

429
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bacm.org%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDMo_FIgFSUQSN-ttxrHmQrXNNHmWTpYfWPSPgCiT_4gyh6Qudwmn20ZEekukkOFfIyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.7kB
6.6kB
12
9

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mail&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mailto+acm.org&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmailto%2Bacm.org%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjDMo_FIgFSUQSN-ttxrHmQrXNNHmWTpYfWPSPgCiT_4gyh6Qudwmn20ZEekukkOFfIyAXJaAUM

HTTP Response

429
96.17.179.193:80

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQm%2FTGeMjmA8601cvXq8gl6CA%3D%3D

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

426 B
1.0kB
4
3

HTTP Request

GET http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQm%2FTGeMjmA8601cvXq8gl6CA%3D%3D

HTTP Response

200
212.82.100.137:80

http://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

621 B
650 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

2.2kB
17.3kB
25
19

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+gzip.org

HTTP Response

404
212.82.100.137:443

https://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.6kB
6.3kB
16
11

HTTP Request

GET https://search.yahoo.com/search?p=e-mail+burtleburtle.net&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

HTTP Response

500
212.82.100.137:80

http://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

625 B
654 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dalumni.caltech.edu%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjCgiHLmdaPs6f7yUdPppXpIHXWBS1-ZSwRZQdDHGo-lyoAd3ofn1YM0g_SB5GeJCvwyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

872 B
3.8kB
8
5

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dalumni.caltech.edu%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKrjzrcGIjCgiHLmdaPs6f7yUdPppXpIHXWBS1-ZSwRZQdDHGo-lyoAd3ofn1YM0g_SB5GeJCvwyAXJaAUM

HTTP Response

429
212.82.100.137:80

http://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

624 B
653 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.5kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

500
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgSKxx0sGKvjzrcGIjBBur9FB4X6yVfghgaG1bBJgbAjVzoJ7yYpPQSxu_eSIt1FmaDxB0vJDme_f9bLyBkyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
5.3kB
11
8

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+alumni.caltech.edu&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Balumni.caltech.edu%26num%3D100&hl=en&q=EgSKxx0sGKvjzrcGIjBBur9FB4X6yVfghgaG1bBJgbAjVzoJ7yYpPQSxu_eSIt1FmaDxB0vJDme_f9bLyBkyAXJaAUM

HTTP Response

429
212.82.100.137:443

https://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=cs.stanford.edu+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

500
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKvjzrcGIjCzKDECpAU1izvtl0fw4lQrXn1-zTUl4JNhkAov2dyWN7T209sb54d8NCdcoonxxrUyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
5.2kB
10
7

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+cs.stanford.edu&num=50

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKvjzrcGIjCzKDECpAU1izvtl0fw4lQrXn1-zTUl4JNhkAov2dyWN7T209sb54d8NCdcoonxxrUyAXJaAUM

HTTP Response

429
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.0kB
1.4kB
8
5

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org

HTTP Response

301

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

HTTP Response

301
212.82.100.137:80

http://www.altavista.com/web/results?q=mail+alumni.caltech.edu&kgs=0&kls=0&nbq=50

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.8kB
1.9kB
10
6

HTTP Request

GET http://www.altavista.com/web/results?q=contact+mail+cs.stanford.edu&kgs=0&kls=0

HTTP Response

500

HTTP Request

GET http://www.altavista.com/web/results?q=e-mail+burtleburtle.net&kgs=0&kls=0&nbq=50

HTTP Response

500

HTTP Request

GET http://www.altavista.com/web/results?q=email+gzip.org&kgs=0&kls=0&nbq=50

HTTP Response

500

HTTP Request

GET http://www.altavista.com/web/results?q=mail+alumni.caltech.edu&kgs=0&kls=0&nbq=50

HTTP Response

500
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

626 B
655 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=email+acm.org

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

2.1kB
17.2kB
24
18

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=email+acm.org

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=email+acm.org

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

626 B
655 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.5kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

500
212.82.100.137:443

https://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=burtleburtle.net+email&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

500
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

2.1kB
17.2kB
24
18

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=acm.org+contact+e-mail

HTTP Response

404
212.82.100.137:80

http://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

616 B
645 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCZrCk3K_N5-L0bUq5GctCtWbMKszDuygkj8g_HcqCdnnc7ryQIAKE3_tg9BecpuvgyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.7kB
6.7kB
12
9

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=acm.org+mailto&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+cs.stanford.edu&num=50

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dmail%2Bcs.stanford.edu%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCZrCk3K_N5-L0bUq5GctCtWbMKszDuygkj8g_HcqCdnnc7ryQIAKE3_tg9BecpuvgyAXJaAUM

HTTP Response

429
212.82.100.137:443

https://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.6kB
6.3kB
16
11

HTTP Request

GET https://search.yahoo.com/search?p=mail+acm.org&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

500
212.82.100.137:80

http://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

635 B
664 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKzjzrcGIjBceKJqrvwtpihIBLMZNSrXQs4I5M7RhZw4GvoAx0Yr945CpmBSfEMD-mzMHR7Msg8yAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
5.2kB
10
7

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=reply+burtleburtle.net&num=50

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dacm.org%2Bmailto%26num%3D100&hl=en&q=EgSKxx0sGKzjzrcGIjBceKJqrvwtpihIBLMZNSrXQs4I5M7RhZw4GvoAx0Yr945CpmBSfEMD-mzMHR7Msg8yAXJaAUM

HTTP Response

429
212.82.100.137:443

https://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.6kB
6.3kB
16
11

HTTP Request

GET https://search.yahoo.com/search?p=alumni.caltech.edu+contact+mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

500
209.202.254.10:80

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

518 B
734 B
4
3

HTTP Request

GET http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

HTTP Response

301
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.5kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=mailto+cs.stanford.edu&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

500
209.202.254.10:443

https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

2.1kB
17.2kB
24
18

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

HTTP Response

302

HTTP Request

GET https://search.lycos.com/default.asp/?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

HTTP Response

404
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dreply%2Bburtleburtle.net%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCjre9ZQ9jHP6KWI0KG33Ej_VBMGUBM-48hH9kOY9zk30nk7NAxGFzy0wDyvxOzDEEyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

868 B
3.8kB
8
5

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Dreply%2Bburtleburtle.net%26num%3D50&hl=en&q=EgSKxx0sGKzjzrcGIjCjre9ZQ9jHP6KWI0KG33Ej_VBMGUBM-48hH9kOY9zk30nk7NAxGFzy0wDyvxOzDEEyAXJaAUM

HTTP Response

429
142.250.187.228:80

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+gzip.org&num=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
3.0kB
8
7

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+acm.org&num=50

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=contact+e-mail+m-ou.se&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=mail+gzip.org&num=100
212.82.100.137:80

http://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

617 B
646 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

301
142.250.187.228:80

http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bacm.org%26num%3D50&hl=en&q=EgSKxx0sGK3jzrcGIjAkQE93by0YayOGaRa2meqXpj8OV-8T4YNrg7yVTG4Q2Xy01KnA0FeI88Q8bVedmKIyAXJaAUM

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.3kB
5.2kB
10
7

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=email+m-ou.se&num=100

HTTP Response

302

HTTP Request

GET http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26ie%3DUTF-8%26oe%3DUTF-8%26q%3Demail%2Bacm.org%26num%3D50&hl=en&q=EgSKxx0sGK3jzrcGIjAkQE93by0YayOGaRa2meqXpj8OV-8T4YNrg7yVTG4Q2Xy01KnA0FeI88Q8bVedmKIyAXJaAUM

HTTP Response

429
212.82.100.137:443

https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.5kB
6.2kB
15
10

HTTP Request

GET https://search.yahoo.com/search?p=mailto+m-ou.se&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=50

HTTP Response

500
209.202.254.10:443

https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se

tls, http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

1.1kB
3.5kB
9
6

HTTP Request

GET https://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=mailto+m-ou.se
142.250.187.228:80

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+mailto&num=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

466 B
92 B
3
2

HTTP Request

GET http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=m-ou.se+mailto&num=100
212.82.100.137:80

http://search.yahoo.com/search?p=gzip.org+e-mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

619 B
648 B
6
5

HTTP Request

GET http://search.yahoo.com/search?p=gzip.org+e-mail&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

HTTP Response

301
212.82.100.137:80

http://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100

http

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

488 B
52 B
3
1

HTTP Request

GET http://search.yahoo.com/search?p=cs.stanford.edu+mailto&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=&n=100
212.82.100.137:443

search.yahoo.com

tls

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

529 B
52 B
3
1
212.82.100.137:443

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe
142.250.187.228:80

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

0.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

0.159.190.20.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

56.163.245.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

56.163.245.4.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

83.210.23.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

83.210.23.2.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

11.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

11.227.111.52.in-addr.arpa
8.8.8.8:53

m-ou.se

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

53 B
232 B
1
1

DNS Request

m-ou.se
8.8.8.8:53

aspmx3.googlemail.com

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

67 B
83 B
1
1

DNS Request

aspmx3.googlemail.com

DNS Response

142.250.153.26
8.8.8.8:53

acm.org

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

53 B
87 B
1
1

DNS Request

acm.org
8.8.8.8:53

mail.mailroute.net

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

64 B
96 B
1
1

DNS Request

mail.mailroute.net

DNS Response

199.89.1.120

199.89.3.120
8.8.8.8:53

cs.stanford.edu

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

61 B
121 B
1
1

DNS Request

cs.stanford.edu
8.8.8.8:53

cs.stanford.edu

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

61 B
77 B
1
1

DNS Request

cs.stanford.edu

DNS Response

171.64.64.64
8.8.8.8:53

burtleburtle.net

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

62 B
81 B
1
1

DNS Request

burtleburtle.net
8.8.8.8:53

mx.burtleburtle.net

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

65 B
113 B
1
1

DNS Request

mx.burtleburtle.net

DNS Response

65.254.254.50

65.254.254.52

65.254.254.51
8.8.8.8:53

alumni.caltech.edu

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

64 B
126 B
1
1

DNS Request

alumni.caltech.edu
8.8.8.8:53

alumni-caltech-edu.mail.protection.outlook.com

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

92 B
156 B
1
1

DNS Request

alumni-caltech-edu.mail.protection.outlook.com

DNS Response

52.101.10.5

52.101.42.14

52.101.10.8

52.101.42.13
8.8.8.8:53

gzip.org

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

54 B
70 B
1
1

DNS Request

gzip.org
8.8.8.8:53

gzip.org

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

54 B
70 B
1
1

DNS Request

gzip.org

DNS Response

85.187.148.2
8.8.8.8:53

search.yahoo.com

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

62 B
121 B
1
1

DNS Request

search.yahoo.com

DNS Response

212.82.100.137
8.8.8.8:53

www.altavista.com

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

63 B
157 B
1
1

DNS Request

www.altavista.com

DNS Response

212.82.100.137
8.8.8.8:53

search.lycos.com

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

62 B
109 B
1
1

DNS Request

search.lycos.com

DNS Response

209.202.254.10
8.8.8.8:53

www.google.com

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.187.228
8.8.8.8:53

r10.o.lencr.org

dns

d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01eN.exe

61 B
160 B
1
1

DNS Request

r10.o.lencr.org

DNS Response

96.17.179.193

96.17.179.201
8.8.8.8:53

137.100.82.212.in-addr.arpa

dns

73 B
119 B
1
1

DNS Request

137.100.82.212.in-addr.arpa
8.8.8.8:53

10.254.202.209.in-addr.arpa

dns

73 B
113 B
1
1

DNS Request

10.254.202.209.in-addr.arpa
8.8.8.8:53

228.187.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

228.187.250.142.in-addr.arpa
8.8.8.8:53

40.13.222.173.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

40.13.222.173.in-addr.arpa
8.8.8.8:53

193.179.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

193.179.17.96.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YHMF37VK\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp62F9.tmp

Filesize
29KB

MD5
f8fe6fc4011a3ee519aa620eddffb6f0

SHA1
4d164b35afc8272f145a1158ea089ff09fd4b551

SHA256
d5a2e87d6cf6bbe3d7d5568f9a229dd94f081b1860071ec21805ad740671a01e

SHA512
3c3486f33d0f9439043d25527157c9e15c5c34af055513d7621ead3c94b5a18173e67371897604507e59f69b481c1f7dd3994f0a751b683e141271694f5eeed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
5b5445fdb4433baf841d81635379944c

SHA1
4af75e1a22716115766909959924009e6110083e

SHA256
4f58de6fb34d899590f7c07e5bc8a3a2fd0e81d579ad554ef8ba8cb96b685956

SHA512
bb3dc75af96dbcb0903c3d67c17fd0995d4cb9544b65e0b34d0c709394afd2da53451d6716b65a338a22ab3278163ee9f73fcb67044d6371cc66cd159c4c071c

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1712-51-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1712-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1712-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1712-56-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4768-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request