Report - ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

Report Overview

Visited public
2023-09-23 22:51:05
Tags
URL
ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Finishing URL
ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
IP / ASN
199.59.243.224
#16509 AMAZON-02
Title
Aalcovid19.org

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ww25.aalcovid19.org	unknown	2022-09-27	2022-10-14 07:12:05	2023-09-22 20:40:59	5.0 kB	75 kB	199.59.243.224
ocsp.pki.goog	175	2016-06-13	2018-07-01 08:43:07	2023-09-23 18:12:07	2.7 kB	5.6 kB	142.250.74.131
www.google.com	7	1997-09-15	2015-05-10 13:11:19	2023-09-20 20:05:47	3.7 kB	63 kB	142.250.74.132
afs.googleusercontent.com	12123	2008-11-17	2013-05-06 21:11:00	2023-09-23 05:11:31	981 B	2.1 kB	142.250.74.97
fonts.googleapis.com	8877	2005-01-25	2013-06-10 22:14:26	2023-09-24 00:15:11	434 B	17 kB	142.250.74.106
fonts.gstatic.com	unknown	2008-02-11	2014-09-09 02:40:21	2023-09-23 23:57:04	550 B	17 kB	216.58.207.227

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-23 22:50:46	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-09-23 22:50:46	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-09-23 22:50:46	medium	Client IP	199.59.243.224	ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1
2023-09-23 22:50:47	medium	Client IP	199.59.243.224	ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1
2023-09-23 22:50:47	medium	Client IP	199.59.243.224	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1
2023-09-23 22:50:47	medium	Client IP	199.59.243.224	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1
2023-09-23 22:50:47	medium	Client IP	199.59.243.224	ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M1
2023-09-23 22:50:47	medium	Client IP	199.59.243.224	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1
2023-09-23 22:50:47	medium	Client IP	199.59.243.224	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e	ScriptElement	899 B	2024-08-21	2024-08-21
Pretty URL ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e IP 199.59.243.224 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-21 05:54 Last Seen2024-08-21 05:54 Times Seen1 Hash cd322e126da82602b0a23dcb979a3fc9 95a177112cb982116e0f2d155c2de13f00a342fe 15f7b4083d5f7684e1c6e0fc8bd52fc902819b8d50c22af03824661b0f107979 Loading...

	ww25.aalcovid19.org/aXIaVoNVU.js	ScriptElement	68 kB	2023-08-11	2023-09-26
Pretty URL ww25.aalcovid19.org/aXIaVoNVU.js IP 199.59.243.224 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 01:02 Last Seen2023-09-26 15:04 Times Seen7775 Hash 3ef0d214cbad58830beddd8bffd52c13 b6afe664ac6da2b0afccae8fb8782acaa9b7c6c9 7128591ce2852ff92fd3ca220b9fdd6e99a901dd2e4164ba264e5a0b9a19965b Loading...

	www.google.com/adsense/domains/caf.js	ScriptElement	152 kB	2023-09-22	2024-08-21
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-22 16:11 Last Seen2024-08-21 06:05 Times Seen165 Hash 5ee29d19f178f1cf433ca48eb0b1d2a5 e14920b7baf6b4c0c1fe5ec4010b4328dd27d26b 5682db9a6d13b5c88119a6de133b6b839e9c25d851a61f940c146e9163fac832 Loading...

	www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264	ScriptElement	2.4 kB	2024-08-21	2024-08-21
Pretty URL www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264 IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-21 05:54 Last Seen2024-08-21 05:54 Times Seen1 Hash 4c7bd352e10a2b31344100b9cdb3a6df ff22c64c941c5a3a0494e1fbaa3efdb9337cd4b3 3af804159bf0952eee938a4d2cab40236892eb20c489315df3ad4cd0425da163 Loading...

	www.google.com/adsense/domains/caf.js	ScriptElement	152 kB	2023-09-22	2024-08-21
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-22 15:43 Last Seen2024-08-21 06:05 Times Seen186 Hash d1a59a244b6086ca865fc119fb2ff247 a7d448cf673d72947a6d4ef6e93cadea5314d987 6a931e4acfd6e9dc5aadcb9908c0d682fd8ec656de820a17e724f368b27a4af7 Loading...

HTTP Transactions (22)

URL IP Response Size

ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

199.59.243.224

1.6 kB

URL User Request GET
ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
IP
199.59.243.224:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (914)
Size
1.6 kB (1617 bytes)
Hash
060ee6f83d36d34f822514613a19ea6a
f9cd21c0b4de9a592c5122a889d3103f25505db2
45ad9bfd40ab9c8376822437627aa4805cda6df3e0adc03fc7dc27e4b2ae7692

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

HTTP Headers

GET /regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Sat, 23 Sep 2023 22:50:47 GMT
content-type: text/html; charset=utf-8
content-length: 1617
x-request-id: 6c9a3eb4-f7dc-41fb-8fb3-28271b815439
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Rn9CjRDwcCFe5ka04Bf4M0crf9SIpXAbrcDQtPR1zVV7ebAblItI1EPDtquPaJH6bULPPMcURBgFCJyB/1Z7ew==
set-cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439; expires=Sat, 23 Sep 2023 23:05:47 GMT; path=/

ww25.aalcovid19.org/aXIaVoNVU.js

199.59.243.224

200 OK

68 kB

URL GET HTTP/1.1
ww25.aalcovid19.org/aXIaVoNVU.js
IP
199.59.243.224:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

File type
HTML document, ASCII text, with very long lines (65536), with no line terminators
Size
68 kB (68406 bytes)
Hash
3ef0d214cbad58830beddd8bffd52c13
b6afe664ac6da2b0afccae8fb8782acaa9b7c6c9
7128591ce2852ff92fd3ca220b9fdd6e99a901dd2e4164ba264e5a0b9a19965b

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

HTTP Headers

GET /aXIaVoNVU.js HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Sat, 23 Sep 2023 22:50:47 GMT
content-type: application/javascript; charset=utf-8
content-length: 68406
x-request-id: 15a6a41f-a15d-4558-a19d-acac0d98f3c4
set-cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439; expires=Sat, 23 Sep 2023 23:05:47 GMT

ww25.aalcovid19.org/_fd?subid1=20230924-0850-1849-94fc-7aa57e2de07e

199.59.243.224

200 OK

2.6 kB

URL POST HTTP/1.1
ww25.aalcovid19.org/_fd?subid1=20230924-0850-1849-94fc-7aa57e2de07e
IP
199.59.243.224:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

File type
ASCII text, with very long lines (4837), with no line terminators
Size
2.6 kB (2580 bytes)
Hash
0f066bb9844de36a2409125054360476
77c7591a9cf25a9810489a3951d5f462abe08fdb
959c9a93f4a3bd4ff96de495a16cc4f2879aca388c3a83892c8aeadbffa74623

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M1

HTTP Headers

POST /_fd?subid1=20230924-0850-1849-94fc-7aa57e2de07e HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Content-Type: application/json
Origin: http://ww25.aalcovid19.org
DNT: 1
Connection: keep-alive
Cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
server: openresty
date: Sat, 23 Sep 2023 22:50:46 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 2580
x-version: 2.106.5
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439; expires=Sat, 23 Sep 2023 23:05:47 GMT; Max-Age=900; path=/; httponly

ww25.aalcovid19.org/px.gif?ch=1&rn=0.4184946375677171

199.59.243.224

200 OK

42 B

URL GET HTTP/1.1
ww25.aalcovid19.org/px.gif?ch=1&rn=0.4184946375677171
IP
199.59.243.224:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

HTTP Headers

GET /px.gif?ch=1&rn=0.4184946375677171 HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: openresty
date: Sat, 23 Sep 2023 22:50:47 GMT
content-type: image/gif
content-length: 42
last-modified: Tue, 18 Jul 2023 15:33:43 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ranges: bytes

ww25.aalcovid19.org/px.gif?ch=2&rn=0.4184946375677171

199.59.243.224

200 OK

42 B

URL GET HTTP/1.1
ww25.aalcovid19.org/px.gif?ch=2&rn=0.4184946375677171
IP
199.59.243.224:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

HTTP Headers

GET /px.gif?ch=2&rn=0.4184946375677171 HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: openresty
date: Sat, 23 Sep 2023 22:50:47 GMT
content-type: image/gif
content-length: 42
last-modified: Tue, 18 Jul 2023 15:33:43 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
c17d1900febb134482f5f3fdc9fd4b69
18d8f12fa6991f23477832a6c6a356fadd6e8508
19d15be13fbb8add8926f12e5c810a16851ee487bb211efa193d1ea199ecf0ce

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:47 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/adsense/domains/caf.js

142.250.74.132

200 OK

56 kB

URL GET HTTP/2
www.google.com/adsense/domains/caf.js
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintD2:77:FE:08:C6:61:6A:42:5C:1F:85:13:DA:23:B2:B8:46:20:45:88
ValidityMon, 04 Sep 2023 08:23:29 GMT - Mon, 27 Nov 2023 08:23:28 GMT

File type
gzip compressed data, max compression\012- data
Size
56 kB (55616 bytes)
Hash
c367c353662816f5698f7dc925cea494
338a1b865883cd1d1ec739fb6cfae0b766038bcb
e66223973b3c245ec49c7a0b22ea6868363db3b4068ab0ff623cf738f2d64d9e

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sat, 23 Sep 2023 22:50:47 GMT
expires: Sat, 23 Sep 2023 22:50:47 GMT
cache-control: private, max-age=3600
etag: "18403392908549085565"
x-content-type-options: nosniff
link: <https://afs.googlesyndication.com>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264

142.250.74.132

200 OK

3.1 kB

URL GET HTTP/3
www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (13183)
Size
3.1 kB (3146 bytes)
Hash
3ab9d36b2e67a1b4428bf79144792fed
57e80e200fb9c072f00135a7edce1e0cf1099814
95569d0048f56811e66b52fa0b2fb5a339be89b10898b4a52902bd949c76c771

HTTP Headers

GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sat, 23 Sep 2023 22:50:48 GMT
expires: Sat, 23 Sep 2023 22:50:48 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-RPF4p1KaadkhaekoVnxdmA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 3146
x-xss-protection: 0
set-cookie: CONSENT=PENDING+047; expires=Mon, 22-Sep-2025 22:50:48 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
a92bb4fa44dc5e89db73ebc0e40801f9
7f0416f383c857c48006658e927f4de597472863
e511500b4244c44623b4953f149d51e0ca0ab43098038aceaea5f9ce0740c3b8

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b

142.250.74.97

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
174 B (174 bytes)
Hash
d47125b2ba92be53dcff07ba322ce1de
e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28
5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 23 Sep 2023 17:58:53 GMT
expires: Sun, 24 Sep 2023 16:58:53 GMT
cache-control: public, max-age=82800
age: 17515
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
a92bb4fa44dc5e89db73ebc0e40801f9
7f0416f383c857c48006658e927f4de597472863
e511500b4244c44623b4953f149d51e0ca0ab43098038aceaea5f9ce0740c3b8

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff

142.250.74.97

200 OK

278 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol322%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol491&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20230924-0850-1849-94fc-7aa57e2de07e&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301293%2C17301321%2C17301323&format=r3&nocache=2091695509448218&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1695509448220&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1264&psh=79&frm=0&cl=566716232&uio=-&cont=rs&jsid=caf&jsv=566716232&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Fregexp-extractor-%25C3%2590%25C2%25B0%25C3%2590%25C2%25BA%25C3%2591%25C2%2582%25C3%2590%25C2%25B8%25C3%2590%25C2%25B2%25C3%2590%25C2%25B8%25C3%2591%25C2%2580%25C3%2590%25C2%25BE%25C3%2590%25C2%25B2%25C3%2590%25C2%25B0%25C3%2590%25C2%25BD%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25BF%25C3%2590%25C2%25BE%25C3%2590%25C2%25BB%25C3%2590%25C2%25BD%25C3%2590%25C2%25B0%25C3%2591%25C2%258F-%25C3%2590%25C2%25B2%25C3%2590%25C2%25B5%25C3%2591%25C2%2580%25C3%2591%25C2%2581%25C3%2590%25C2%25B8%25C3%2591%25C2%258F-product-key-full-2%2F%3Fsubid1%3D20230924-0850-1849-94fc-7aa57e2de07e&adbw=master-1%3A1264
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (306)
Size
278 B (278 bytes)
Hash
fe7dd8c3c629cc6e9cd6d3e4d3cbe905
59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18
5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 23 Sep 2023 17:58:04 GMT
expires: Sun, 24 Sep 2023 16:58:04 GMT
cache-control: public, max-age=82800
age: 17564
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
a92bb4fa44dc5e89db73ebc0e40801f9
7f0416f383c857c48006658e927f4de597472863
e511500b4244c44623b4953f149d51e0ca0ab43098038aceaea5f9ce0740c3b8

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
99734170fcdad2d52884412f61321bf8
25163901dbdc047070a12d8afadcaa7009d8b595
f2a2590ac5fa2bcc9db8c46b3b4ad45f0a03b03193f601a2636e900fe851cf59

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
99734170fcdad2d52884412f61321bf8
25163901dbdc047070a12d8afadcaa7009d8b595
f2a2590ac5fa2bcc9db8c46b3b4ad45f0a03b03193f601a2636e900fe851cf59

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
23ee71f34a80feec27e23d99ecada83e
62f4c8dcc03187e2bdcdfa76dc732d4eebde5cc1
429bd03ec19810ed389955d166c98e62d9850e52160fbec3dd27da2cc30200fe

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.googleapis.com/css?family=Quicksand

142.250.74.106

200 OK

16 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Quicksand
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintBE:40:3A:A6:DE:CC:A7:8B:75:43:68:F2:F9:56:63:71:49:61:06:49
ValidityMon, 04 Sep 2023 08:23:18 GMT - Mon, 27 Nov 2023 08:23:17 GMT

File type
gzip compressed data, max compression\012- data
Size
16 kB (16233 bytes)
Hash
d2fe77d417208cf7f520c3033d652d31
4d9937cf883e43df43430621907667b5d4c50066
1ad52a506b849b48b39fec78a2a8dd695d4616e3c696882babcd8db64951c50b

HTTP Headers

GET /css?family=Quicksand HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 23 Sep 2023 22:50:48 GMT
date: Sat, 23 Sep 2023 22:50:48 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ww25.aalcovid19.org/_tr

199.59.243.224

200 OK

22 B

URL POST HTTP/1.1
ww25.aalcovid19.org/_tr
IP
199.59.243.224:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e

File type
ASCII text, with no line terminators
Size
22 B (22 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

HTTP Headers

POST /_tr HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Content-Type: application/json
Content-Length: 2161
Origin: http://ww25.aalcovid19.org
DNT: 1
Connection: keep-alive
Cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: openresty
date: Sat, 23 Sep 2023 22:50:47 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 22
x-version: 2.106.5
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=6c9a3eb4-f7dc-41fb-8fb3-28271b815439; expires=Sat, 23 Sep 2023 23:05:48 GMT; Max-Age=900; path=/; httponly

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
23ee71f34a80feec27e23d99ecada83e
62f4c8dcc03187e2bdcdfa76dc732d4eebde5cc1
429bd03ec19810ed389955d166c98e62d9850e52160fbec3dd27da2cc30200fe

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 22:50:48 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=125fhq4gb62m&aqid=yGsPZYbIAvbZywWSrrGgAg&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=566716232&csala=14%7C0%7C333%7C86%7C237&lle=0&ifv=1&usr=0&hpt=0

142.250.74.132

204 No Content

0 B

URL GET HTTP/3
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=125fhq4gb62m&aqid=yGsPZYbIAvbZywWSrrGgAg&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=566716232&csala=14%7C0%7C333%7C86%7C237&lle=0&ifv=1&usr=0&hpt=0
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=125fhq4gb62m&aqid=yGsPZYbIAvbZywWSrrGgAg&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=566716232&csala=14%7C0%7C333%7C86%7C237&lle=0&ifv=1&usr=0&hpt=0 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-XM9yALZwdvgkcfxEWOXApw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sat, 23 Sep 2023 22:50:50 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=Eq-EIw7GnNy16gcRMkqBociSIB9hhtQioBVoFAf57_s7ajQwVYs_NN3EwbQpazq8NBPCL4gJUIozQmNqkeNI89_mpOu1Ljq0z3oix3SaOxzUlq0GuARV2pnyqdrUBn6Dw3cTdb098z2DQhVjMSF7QcqYlxWltELl3Sb3D1rwsvI; expires=Sun, 24-Mar-2024 22:50:50 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+831; expires=Mon, 22-Sep-2025 22:50:50 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=z64y7vvi6gye&aqid=yGsPZYbIAvbZywWSrrGgAg&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=566716232&csala=14%7C0%7C333%7C86%7C237&lle=0&ifv=1&usr=0&hpt=0

142.250.74.132

204 No Content

0 B

URL GET HTTP/3
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=z64y7vvi6gye&aqid=yGsPZYbIAvbZywWSrrGgAg&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=566716232&csala=14%7C0%7C333%7C86%7C237&lle=0&ifv=1&usr=0&hpt=0
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=z64y7vvi6gye&aqid=yGsPZYbIAvbZywWSrrGgAg&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=566716232&csala=14%7C0%7C333%7C86%7C237&lle=0&ifv=1&usr=0&hpt=0 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-mHRwCTE-xr9ExLc3DMp_Eg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sat, 23 Sep 2023 22:50:50 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=kpUZuOCfuNsjKqH9egf6z7iecrzgPE5PdB8_1ipGQzDHYqsfr6HOCLVf2H_7hmXwFi8ZG4e52Emi18lXrXyAVZj84YeEebTTzFoer2OLtReReG0hP988F-UnPNEAFpdC9EWHrBUtIWFpZ6_a-fCzl97tVG20YRKsjJoKYe5QTaY; expires=Sun, 24-Mar-2024 22:50:50 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+480; expires=Mon, 22-Sep-2025 22:50:50 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

fonts.gstatic.com/s/quicksand/v31/6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2

216.58.207.227

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/quicksand/v31/6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/regexp-extractor-%C3%90%C2%B0%C3%90%C2%BA%C3%91%C2%82%C3%90%C2%B8%C3%90%C2%B2%C3%90%C2%B8%C3%91%C2%80%C3%90%C2%BE%C3%90%C2%B2%C3%90%C2%B0%C3%90%C2%BD%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%BF%C3%90%C2%BE%C3%90%C2%BB%C3%90%C2%BD%C3%90%C2%B0%C3%91%C2%8F-%C3%90%C2%B2%C3%90%C2%B5%C3%91%C2%80%C3%91%C2%81%C3%90%C2%B8%C3%91%C2%8F-product-key-full-2/?subid1=20230924-0850-1849-94fc-7aa57e2de07e
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15788, version 1.0\012- data
Size
16 kB (15788 bytes)
Hash
39b3c04ead8a476634c6b1ad6b7d4d17
e01b0a77d134f8f28e660398865c4c0917b8b933
73b8057c918765ed1a41c6ca23e2c0530b51d396e12ce63071297c5a04178504

HTTP Headers

GET /s/quicksand/v31/6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://ww25.aalcovid19.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15788
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Sep 2023 02:36:46 GMT
expires: Wed, 18 Sep 2024 02:36:46 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:17:53 GMT
content-type: font/woff2
age: 418442
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (22)

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL POST HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type