Report - ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530

Report Overview

Visited public
2023-12-07 10:22:25
Tags
URL
ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Finishing URL
ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
IP / ASN
199.59.243.225
#16509 AMAZON-02
Title
Aalcovid19.org

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ww25.aalcovid19.org	unknown	2022-09-27	2022-10-14 07:12:05	2023-12-06 15:23:31	3.0 kB	38 kB	199.59.243.225
www.google.com	7	1997-09-15	2015-05-10 13:11:19	2023-11-19 18:48:38	3.9 kB	307 kB	142.250.74.164
afs.googleusercontent.com	12123	2008-11-17	2013-05-06 21:11:00	2023-12-07 07:28:57	1.0 kB	2.1 kB	142.250.74.161

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-07 10:22:14	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-12-07 10:22:14	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-12-07 10:22:14	medium	Client IP	199.59.243.225	ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1
2023-12-07 10:22:14	medium	Client IP	199.59.243.225	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1
2023-12-07 10:22:15	medium	Client IP	199.59.243.225	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1
2023-12-07 10:22:15	medium	Client IP	199.59.243.225	ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M1

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530	ScriptElement	659 B	2024-08-20	2024-08-20
Pretty URL www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530 IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-20 16:28 Last Seen2024-08-20 16:28 Times Seen1 Hash ec6b01bea321020e46c7d72ee849d8df 77db3fd9a3f7885e47433c8416979ba0cf580458 d9e24a68974d59c7be47e7de244723976921c5649a527bb942990616b2324ae3 Loading...

	www.google.com/adsense/domains/caf.js	ScriptElement	150 kB	2023-11-09	2024-08-20
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-09 16:02 Last Seen2024-08-20 20:16 Times Seen923 Hash cbe93eb59d248b9b1b2dd7d250d88a2b 9839181a76fba020337581a9fd8eae99c44aa99d 3b6a70927bad7500dbe7f17d9efd56ff4d6fc10997d95096c3fa87da267f6989 Loading...

	ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530	ScriptElement	751 B	2024-08-20	2024-08-20
Pretty URL ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530 IP 199.59.243.225 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-20 16:28 Last Seen2024-08-20 16:28 Times Seen1 Hash 59904e7f5ac379cff39008a2e97d2342 4a0a1831a80ac9138ccb35f52dd4f081e992b32f 7c2cbbe3a258f98ee46facc9ed3849ba177d116075b213e9059278e597543e4f Loading...

	ww25.aalcovid19.org/blwlajsCE.js	ScriptElement	32 kB	2023-11-14	2024-08-20
Pretty URL ww25.aalcovid19.org/blwlajsCE.js IP 199.59.243.225 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-14 16:51 Last Seen2024-08-20 19:38 Times Seen5630 Hash 136bc91b923c115f678c13f3740bf8fa d8044de6e6a8b05f087f9fb73545d5b2e9666d61 46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7 Loading...

	www.google.com/adsense/domains/caf.js	ScriptElement	150 kB	2023-11-09	2024-08-20
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-09 14:10 Last Seen2024-08-20 20:17 Times Seen2217 Hash 8a76c49bbeb49fa874cb415fe2b10d0c 76de9796dbe01e64d77fccd00d0b19cf382493b8 a1f85a8b9c0ae7e01a01780b44c447ebbadb5d856c6ff826e2cd9fe19f15135f Loading...

HTTP Transactions (11)

URL IP Response Size

ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530

199.59.243.225

200 OK

1.5 kB

URL User Request GET HTTP/1.1
ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
IP
199.59.243.225:80
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (766)
Size
1.5 kB (1469 bytes)
Hash
498cfdcbe46c0adad00501ff4d2686da
b71ff9a9c12f31c89aa952c502884bfea3c2ede6
956a906fc0e785a67d3cb8e4453df336ad225fe9af438c41b98d6280bc2354fa

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

HTTP Headers

GET /eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530 HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Thu, 07 Dec 2023 10:22:08 GMT
content-type: text/html; charset=utf-8
content-length: 1469
x-request-id: d73f2679-97b4-4789-bac5-e75b0b0cb499
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_kk9yfw1kXc7Ri2Uc8F9M2mFPgy00zVehc9e086lqJaFvUW7SZDG/AlFkEG9fcjmMK4167oVPWzBC4B+n4jVpnQ==
set-cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499; expires=Thu, 07 Dec 2023 10:37:08 GMT; path=/

ww25.aalcovid19.org/blwlajsCE.js

199.59.243.225

200 OK

32 kB

URL GET HTTP/1.1
ww25.aalcovid19.org/blwlajsCE.js
IP
199.59.243.225:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530

File type
Unicode text, UTF-8 text, with very long lines (32051)
Size
32 kB (32054 bytes)
Hash
136bc91b923c115f678c13f3740bf8fa
d8044de6e6a8b05f087f9fb73545d5b2e9666d61
46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1

HTTP Headers

GET /blwlajsCE.js HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Thu, 07 Dec 2023 10:22:08 GMT
content-type: application/javascript; charset=utf-8
content-length: 32054
x-request-id: c3966412-8b84-40fd-85e2-562577197aa5
set-cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499; expires=Thu, 07 Dec 2023 10:37:08 GMT

ww25.aalcovid19.org/_fd?subid1=20231207-2121-4780-aae1-68bd8622b530

199.59.243.225

200 OK

2.6 kB

URL POST HTTP/1.1
ww25.aalcovid19.org/_fd?subid1=20231207-2121-4780-aae1-68bd8622b530
IP
199.59.243.225:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530

File type
ASCII text, with very long lines (4857), with no line terminators
Size
2.6 kB (2592 bytes)
Hash
6689b43f98fed1ab8c68d360365264fb
758872cc233cdd9c8ec56529747bff8455a0114c
90b9d43c290afad1c970619d9de5b3257ccf10ab9bb375391525ea9fe7ad44aa

Detections

NIDS	Severity	Alert
suricata	medium	ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M1

HTTP Headers

POST /_fd?subid1=20231207-2121-4780-aae1-68bd8622b530 HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Content-Type: application/json
Origin: http://ww25.aalcovid19.org
DNT: 1
Connection: keep-alive
Cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
server: openresty
date: Thu, 07 Dec 2023 10:22:08 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 2592
x-version: 2.110.4
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499; expires=Thu, 07 Dec 2023 10:37:08 GMT; Max-Age=900; path=/; httponly

www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530

142.250.74.164

200 OK

2.6 kB

URL GET HTTP/3
www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (13169)
Size
2.6 kB (2603 bytes)
Hash
26e37432b8c9b854ebe92434ced2a74a
fe1a95e56e0209e126a14db7a11d76b0d4903aa1
e26a19adfeacb88a98b364ac647a8931bd9c39a3727db939f56cba6710d06d29

HTTP Headers

GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Thu, 07 Dec 2023 10:22:09 GMT
expires: Thu, 07 Dec 2023 10:22:09 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-7YZnow50LcKRE1la_JRBLA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2603
x-xss-protection: 0
set-cookie: CONSENT=PENDING+091; expires=Sat, 06-Dec-2025 10:22:09 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b

142.250.74.161

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
IP
142.250.74.161:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE
ValidityMon, 23 Oct 2023 11:23:50 GMT - Mon, 15 Jan 2024 11:23:49 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
174 B (174 bytes)
Hash
d47125b2ba92be53dcff07ba322ce1de
e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28
5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 04:41:03 GMT
expires: Fri, 08 Dec 2023 03:41:03 GMT
cache-control: public, max-age=82800
age: 20466
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ww25.aalcovid19.org/_tr

199.59.243.225

200 OK

22 B

URL POST HTTP/1.1
ww25.aalcovid19.org/_tr
IP
199.59.243.225:80
ASN
#16509 AMAZON-02

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530

File type
ASCII text, with no line terminators
Size
22 B (22 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

HTTP Headers

POST /_tr HTTP/1.1
Host: ww25.aalcovid19.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Content-Type: application/json
Content-Length: 2053
Origin: http://ww25.aalcovid19.org
DNT: 1
Connection: keep-alive
Cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: openresty
date: Thu, 07 Dec 2023 10:22:08 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 22
x-version: 2.110.4
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=d73f2679-97b4-4789-bac5-e75b0b0cb499; expires=Thu, 07 Dec 2023 10:37:09 GMT; Max-Age=900; path=/; httponly

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff

142.250.74.161

200 OK

278 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
IP
142.250.74.161:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE
ValidityMon, 23 Oct 2023 11:23:50 GMT - Mon, 15 Jan 2024 11:23:49 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (306)
Size
278 B (278 bytes)
Hash
fe7dd8c3c629cc6e9cd6d3e4d3cbe905
59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18
5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 06 Dec 2023 23:30:37 GMT
expires: Thu, 07 Dec 2023 22:30:37 GMT
cache-control: public, max-age=82800
age: 39092
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=w8ntywgm5qoj&aqid=0ZxxZdOOC6-7xdwPnfuUsAs&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=579967862&csala=5%7C0%7C276%7C68%7C14&lle=0&ifv=1&hpt=0

142.250.74.164

204 No Content

0 B

URL GET HTTP/3
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=w8ntywgm5qoj&aqid=0ZxxZdOOC6-7xdwPnfuUsAs&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=579967862&csala=5%7C0%7C276%7C68%7C14&lle=0&ifv=1&hpt=0
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=w8ntywgm5qoj&aqid=0ZxxZdOOC6-7xdwPnfuUsAs&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=579967862&csala=5%7C0%7C276%7C68%7C14&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-815xw91OLU7sq96du-agAg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Thu, 07 Dec 2023 10:22:11 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=C1e9phORU6J99KFAj0hkdit0W8Xz_kIYC3p8GpL08dHatUNYYBs6V7iq6du57zgeY7qo080D3qUeFdWsMVz2oy2M9Bh5TIYG5HvMtxIKacplhXltG1vMSn3oDxSXReOBZNtevHujADGLmEUUCs4rjORgyye3i190-rixEnHMzmE; expires=Fri, 07-Jun-2024 10:22:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+302; expires=Sat, 06-Dec-2025 10:22:10 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=fpoa8lgat7mu&aqid=0ZxxZdOOC6-7xdwPnfuUsAs&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=579967862&csala=5%7C0%7C276%7C68%7C14&lle=0&ifv=1&hpt=0

142.250.74.164

204 No Content

0 B

URL GET HTTP/3
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=fpoa8lgat7mu&aqid=0ZxxZdOOC6-7xdwPnfuUsAs&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=579967862&csala=5%7C0%7C276%7C68%7C14&lle=0&ifv=1&hpt=0
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=fpoa8lgat7mu&aqid=0ZxxZdOOC6-7xdwPnfuUsAs&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=579967862&csala=5%7C0%7C276%7C68%7C14&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-7OPV5rzZmHal-pqrcs5UKA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Thu, 07 Dec 2023 10:22:11 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=VVclQEYYppFDJXyBoTicoMt-Lu2jyPj9a94Du1B3psxLeIklPdSG2Kk2rO6jw8FR0cwihRm60NCiS6tij-A1ADo6qPdiVVBKonrBNqrZbuQpSBlley3BJZbGOtTX5PPfz1xg1ae6MrQIInGtdCPE90XcN4QmDmCFjbEv4ywwGH0; expires=Fri, 07-Jun-2024 10:22:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+950; expires=Sat, 06-Dec-2025 10:22:11 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.google.com/adsense/domains/caf.js

142.250.74.164

200 OK

150 kB

URL GET HTTP/2
www.google.com/adsense/domains/caf.js
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
http://ww25.aalcovid19.org/eventghost-license-keygen-%C3%91%C2%81%C3%90%C2%BA%C3%90%C2%B0%C3%91%C2%87%C3%90%C2%B0%C3%91%C2%82%C3%91%C2%8C-%C3%90%C2%B1%C3%90%C2%B5%C3%91%C2%81%C3%90%C2%BF%C3%90%C2%BB%C3%90%C2%B0%C3%91%C2%82%C3%90%C2%BD%C3%90%C2%BE-mac-win-latest-2022?subid1=20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintB0:8E:97:10:7E:30:90:F6:42:A1:32:63:5C:78:27:D3:A8:F1:05:D1
ValidityMon, 23 Oct 2023 11:24:57 GMT - Mon, 15 Jan 2024 11:24:56 GMT

File type
ASCII text, with very long lines (1888)
Size
150 kB (149590 bytes)
Hash
8a76c49bbeb49fa874cb415fe2b10d0c
76de9796dbe01e64d77fccd00d0b19cf382493b8
a1f85a8b9c0ae7e01a01780b44c447ebbadb5d856c6ff826e2cd9fe19f15135f

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.aalcovid19.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 07 Dec 2023 10:22:08 GMT
expires: Thu, 07 Dec 2023 10:22:08 GMT
cache-control: private, max-age=3600
etag: "3100330882123301848"
x-content-type-options: nosniff
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.google.com/adsense/domains/caf.js

142.250.74.164

200 OK

150 kB

URL GET HTTP/3
www.google.com/adsense/domains/caf.js
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol310%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol441&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.aalcovid19.org%3Fcaf%26subid1%3D20231207-2121-4780-aae1-68bd8622b530&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=891701944535514&num=0&output=afd_ads&domain_name=ww25.aalcovid19.org&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1701944535515&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.aalcovid19.org%2Feventghost-license-keygen-%25C3%2591%25C2%2581%25C3%2590%25C2%25BA%25C3%2590%25C2%25B0%25C3%2591%25C2%2587%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2591%25C2%258C-%25C3%2590%25C2%25B1%25C3%2590%25C2%25B5%25C3%2591%25C2%2581%25C3%2590%25C2%25BF%25C3%2590%25C2%25BB%25C3%2590%25C2%25B0%25C3%2591%25C2%2582%25C3%2590%25C2%25BD%25C3%2590%25C2%25BE-mac-win-latest-2022%3Fsubid1%3D20231207-2121-4780-aae1-68bd8622b530
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT

File type
ASCII text, with very long lines (1888)
Size
150 kB (149556 bytes)
Hash
cbe93eb59d248b9b1b2dd7d250d88a2b
9839181a76fba020337581a9fd8eae99c44aa99d
3b6a70927bad7500dbe7f17d9efd56ff4d6fc10997d95096c3fa87da267f6989

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 07 Dec 2023 10:22:09 GMT
expires: Thu, 07 Dec 2023 10:22:09 GMT
cache-control: private, max-age=3600
etag: "12555982560793362632"
x-content-type-options: nosniff
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL POST HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate