{"report_id":"d5c975dc-72a2-4dc4-81e1-723f562abd4c","version":6,"status":"done","tags":[],"date":"2023-12-04T18:07:36Z","url":{"schema":"http","addr":"langhesn.com/","fqdn":"langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"216.245.214.83","port":0,"asn":46475,"as":"LIMESTONENETWORKS","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"ww1.langhesn.com/","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"title":"Langhesn.com"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-26T09:09:17Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"default"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"langhesn.com","ip":{"addr":"216.245.214.83","port":443,"asn":46475,"as":"LIMESTONENETWORKS","country":"United States","country_code":"US"},"domain_registered":"2022-12-07","domain_rank":0,"first_seen":"2022-12-01 13:31:14","last_seen":"2023-11-03 17:38:08","alert_count":1,"request_count":1,"received_data":370,"sent_data":479,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ww1.langhesn.com","ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2022-12-07","domain_rank":0,"first_seen":"2023-10-23 19:49:56","last_seen":"2023-10-23 19:49:56","alert_count":4,"request_count":4,"received_data":36993,"sent_data":1768,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.google.com","ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":7,"first_seen":"2015-05-10 13:11:19","last_seen":"2023-11-19 18:48:38","alert_count":0,"request_count":4,"received_data":74501,"sent_data":3017,"comment":"","tags":null,"fingerprints":null},{"fqdn":"afs.googleusercontent.com","ip":{"addr":"142.250.74.97","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-11-17","domain_rank":12123,"first_seen":"2013-05-06 21:11:00","last_seen":"2023-12-04 05:11:59","alert_count":0,"request_count":2,"received_data":2094,"sent_data":1001,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ebe9f3326ccd743108547246c249dd29","sha1":"3259137cdae7cf5e5b0fc61d3cae999b81651c29","sha256":"4e24d7e24a7e09a5078379f6f417f0b5ef8126b72bafd19e1d58be71d138e448","sha512":"01fea24772a5d063147652468889d701e5d8f35aee704a9af891d360f2be693f7c29a58d3f3d6375f21b5bf22fd5908412b7442835d8b780fdd01a7c59e3c991","ssdeep":"1536:srPOSj873QtAPyqqf/2uYgMjaitiKc1CPEU6i5QI+/F2R26i57VlcZ6gCzUIomHx:H2sAU5QI+t2RqB+Z+Umpa+NilYtN","tlshash":"78e35b9a7761302663a354f4603f028fb23ab959e84885f4f194d4e47cb8da91237fbd","size":149599,"data":"","first_seen":"2023-11-08T14:41:34Z","last_seen":"2024-08-20T20:24:43.42298Z","times_seen":1200,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol318%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol472\u0026client=dp-bodis30_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fww1.langhesn.com%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2298147197369106\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17300002%2C17301157\u0026format=r3\u0026nocache=1811701713246781\u0026num=0\u0026output=afd_ads\u0026domain_name=ww1.langhesn.com\u0026v=3\u0026bsl=8\u0026pac=2\u0026u_his=2\u0026u_tz=0\u0026dt=1701713246782\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026cl=579967862\u0026uio=-\u0026cont=rs\u0026jsid=caf\u0026jsv=579967862\u0026rurl=http%3A%2F%2Fww1.langhesn.com%2F","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"36c6c60e6f3a47583308584f1b1de5d4","sha1":"86459eb04f39386f001d07cb805e6bcbc3dde1aa","sha256":"59f1c6080a5ec780892fa8c1d4c81b0d8b31e306365a7cde17f610f390afd863","sha512":"ddb2e98870e6e9702477295dbea148eabc21452744cfffb47db3ddfc01da34e359717491b37261a85aa902b84a5a31e9da85f5610540eff255cc0477961f8eff","ssdeep":"","tlshash":"300123912d740171d46b04112e4f3f9058dd14712187354cb84d7cdb307efdf66290ab","size":659,"data":"","first_seen":"2024-08-20T16:47:35.966965Z","last_seen":"2024-08-20T16:47:35.966965Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9936326b99d390a8db3297e3ef06b08f","sha1":"65a7954dcffefe28444eb367c8a3ed1f636318bd","sha256":"4445c2b418767ae76cab2ee7edbe1e6d78d535a90e04fdee5b50205a1991856b","sha512":"6b7ae1d50ea2b4849291ddaa06a61a3791e0445dee5b41128daa5803a9803a0962db2752fe0e6953c882337eb26c5533162c9b3dc97364162ac815db2ef716b0","ssdeep":"1536:RrPOSj873QtAPyqqf/2uYgMjaitiKc1CPEU6i5QI+/F2R26i57VlcZ6gCzUIomHx:I2sAU5QI+t2RqB+Z+Umpa+NilYtN","tlshash":"05e35b9a7761302663a354f4603f028fb23ab959e84885f4f194d4e47cb8da91237fbd","size":149574,"data":"","first_seen":"2023-11-09T20:01:28Z","last_seen":"2023-12-07T21:19:16Z","times_seen":454,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"ww1.langhesn.com/","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1f0db00fed118cd0fbfb221349846eac","sha1":"3b0753041d356e4635535def1faf43872e8a94a5","sha256":"0de6cafda08af69e9774f44bf97f429298ce71f84afb90824624e622c9a0225e","sha512":"5497b1c37a99545a52d0284fa2ae19939442b1130093dac2b307611b1b9e4c37b76cdd0d43140d3ebd15b4ada7ab7c196f721a6753417e3ad5a2b7a27773cf4c","ssdeep":"","tlshash":"64e0cdad103dad8dd4319813166b9f88bb9824d61490b245f79158d6956469b48081de","size":303,"data":"","first_seen":"2024-08-20T16:47:35.969562Z","last_seen":"2024-08-20T16:47:35.969562Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"ww1.langhesn.com/bEtxyiCcc.js","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"136bc91b923c115f678c13f3740bf8fa","sha1":"d8044de6e6a8b05f087f9fb73545d5b2e9666d61","sha256":"46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7","sha512":"2ff613aa8dc2887a5c2f9d8d40e618ef82b8ffc46392affd32a9fa2225360f1db5244a51f82d5eba8fcf3c200f179da20433761a3ebb6fce0e4ede99d129a3cb","ssdeep":"768:TP2yO6VcKMnneNdxBB5gPi09GrnqVGQxeEigyDdem+euRONzLKBX1TLBJ2w66njL:wnCniGQxeEDRmK","tlshash":"a7e22aa139f7e0604ae2c6caa97b5216f338611a3409d06cf56c88ce3759d47d33ebb5","size":32054,"data":"","first_seen":"2023-11-14T16:51:06Z","last_seen":"2024-08-20T19:38:18.077194Z","times_seen":5630,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"langhesn.com/","fqdn":"langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"216.245.214.83","port":443,"asn":46475,"as":"LIMESTONENETWORKS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-12-04T18:07:24.629Z","timestamp":1701713244629,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"langhesn.com","organization":""},"issuer":{"commonName":"R3","organization":"Let's Encrypt"},"validity":{"start":"Thu, 28 Sep 2023 09:38:01 GMT","end":"Wed, 27 Dec 2023 09:38:00 GMT"},"fingerprint":{"sha1":"F5:93:34:E2:45:5C:3B:67:52:03:AC:52:A2:C8:7B:83:06:E0:B2:19","sha256":"1C:4C:75:75:11:02:7D:2D:A0:F0:90:90:76:DD:F5:4B:38:F3:DB:11:27:4A:F7:D5:6A:1F:78:E6:1F:87:81:5E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: langhesn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ncache-control: max-age=0, private, must-revalidate\r\ncontent-length: 11\r\ndate: Mon, 04 Dec 2023 18:07:19 GMT\r\nlocation: http://ww1.langhesn.com\r\nserver: Cowboy\r\nset-cookie: sid=f6fef744-92cf-11ee-98d6-3760936fbfa5; path=/; domain=.langhesn.com; expires=Sat, 22 Dec 2091 21:21:27 GMT; max-age=2147483647; secure; HttpOnly\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"32682312d17c7cbf18e73594f5570319","sha1":"60e22121bdd0bc71cdb2bae2a3aa577006b2eae9","sha256":"e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47","sha512":"68337debb9cd659cece621af582ae2bc4b56b9cf06b26c45f4d9eb8beb91d3f36bead287218b5aa2bb4853a1cf1a12017ca57318d7e12f489884fdc6b261dfc1","ssdeep":"","tlshash":"3550000030c0300c0000000c0000030003000000000c033f0c3003c00c000000000003","first_seen":"2023-04-05T04:09:22Z","last_seen":"2025-03-02T06:14:56.641448Z","times_seen":15034,"resource_available":false,"data":null}},"time_used":1571,"timings":{"blocked":439,"dns":1,"connect":135,"send":0,"wait":692,"receive":0,"ssl":287},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"ww1.langhesn.com/","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-12-04T18:07:25.766Z","timestamp":1701713245766,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: ww1.langhesn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\ndate: Mon, 04 Dec 2023 18:07:20 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 1021\r\nx-request-id: b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f\r\ncache-control: no-store, max-age=0\r\naccept-ch: sec-ch-prefers-color-scheme\r\ncritical-ch: sec-ch-prefers-color-scheme\r\nvary: sec-ch-prefers-color-scheme\r\nx-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_WgzZdRfCjGTTJu3mXlGqWyUnGkmALDyNYA7XG9Z82vMa7lcPU+It02q9D6VBqYaKC4UVxEAPX3L2pnvls0PFIQ==\r\nset-cookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f; expires=Mon, 04 Dec 2023 18:22:20 GMT; path=/\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1021,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document text\\012- HTML document text\\012- HTML document text\\012- HTML document text\\012- HTML document text\\012- exported SGML document, ASCII text, with very long lines (318)","md5":"64172bfdd342a507f8ae26d2cdf6a6af","sha1":"9f07156870a3177c605d82a78ab6ae97f3e6a793","sha256":"8cbf6de4bdab68def20cbc91cb3aec6dbca1e645b2b0758aa0d811d2ac722173","sha512":"9d3c7e600f1522e9997483182b919a38276d357710ee007c0dc968dc0a96fd64e595ebe89bdac29fdc8ee5a4f4bb99eb34b25debbec34ec7b8f59a512b6b5991","ssdeep":"","tlshash":"971165761465994960b0495159b1eb0c8d4e298f5240b9817fd9d0bb4cc07d3dc2e1dd","first_seen":"2023-12-04T19:07:37Z","last_seen":"2023-12-04T19:07:37Z","times_seen":1,"resource_available":false,"data":null}},"time_used":609,"timings":{"blocked":204,"dns":203,"connect":1,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"ww1.langhesn.com/bEtxyiCcc.js","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://ww1.langhesn.com/","date":"2023-12-04T18:07:26.358Z","timestamp":1701713246358,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /bEtxyiCcc.js HTTP/1.1\r\nHost: ww1.langhesn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://ww1.langhesn.com/\r\nCookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\ndate: Mon, 04 Dec 2023 18:07:20 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 32054\r\nx-request-id: 722c1466-8b7a-40ff-abaa-40cdf07b76dc\r\nset-cookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f; expires=Mon, 04 Dec 2023 18:22:20 GMT\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32054,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (32051)","md5":"136bc91b923c115f678c13f3740bf8fa","sha1":"d8044de6e6a8b05f087f9fb73545d5b2e9666d61","sha256":"46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7","sha512":"2ff613aa8dc2887a5c2f9d8d40e618ef82b8ffc46392affd32a9fa2225360f1db5244a51f82d5eba8fcf3c200f179da20433761a3ebb6fce0e4ede99d129a3cb","ssdeep":"768:TP2yO6VcKMnneNdxBB5gPi09GrnqVGQxeEigyDdem+euRONzLKBX1TLBJ2w66njL:wnCniGQxeEDRmK","tlshash":"a7e22aa139f7e0604ae2c6caa97b5216f338611a3409d06cf56c88ce3759d47d33ebb5","first_seen":"2023-11-14T16:51:06Z","last_seen":"2024-08-20T19:38:18.077194Z","times_seen":5630,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"ww1.langhesn.com/_fd","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://ww1.langhesn.com/","date":"2023-12-04T18:07:26.473Z","timestamp":1701713246473,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /_fd HTTP/1.1\r\nHost: ww1.langhesn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://ww1.langhesn.com/\r\nContent-Type: application/json\r\nOrigin: http://ww1.langhesn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: openresty\r\ndate: Mon, 04 Dec 2023 18:07:20 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: gzip\r\ncontent-length: 2039\r\nx-version: 2.110.4\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nset-cookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f; expires=Mon, 04 Dec 2023 18:22:20 GMT; Max-Age=900; path=/; httponly\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2039,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with very long lines (3977), with no line terminators","md5":"d4c8fa97314b06ca8748451ea4cfb95b","sha1":"5a14be5d95f8339fddbd843ab778044392af901e","sha256":"4b78720e8a52e427edc7896ed6ae37a895caf76ae0e55cdae6dea930dd468f7c","sha512":"5a4f17a5235078dc4f6722a2b9dba58d2274fd26798291e53d26a202737dcb55cc434604706926403603d1fabc6f4b1d1b96520a1e668f8ed5cd4ca619aeb96e","ssdeep":"","tlshash":"f181f9db8e167da89726920724dd45d7030d838f1862c199c52d99e8cf1db4f35d113f","first_seen":"2023-12-04T19:07:37Z","last_seen":"2023-12-04T19:07:37Z","times_seen":1,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.google.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol318%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol472\u0026client=dp-bodis30_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fww1.langhesn.com%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2298147197369106\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17300002%2C17301157\u0026format=r3\u0026nocache=1811701713246781\u0026num=0\u0026output=afd_ads\u0026domain_name=ww1.langhesn.com\u0026v=3\u0026bsl=8\u0026pac=2\u0026u_his=2\u0026u_tz=0\u0026dt=1701713246782\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026cl=579967862\u0026uio=-\u0026cont=rs\u0026jsid=caf\u0026jsv=579967862\u0026rurl=http%3A%2F%2Fww1.langhesn.com%2F","date":"2023-12-04T18:07:27.078Z","timestamp":1701713247078,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 23 Oct 2023 11:18:24 GMT","end":"Mon, 15 Jan 2024 11:18:23 GMT"},"fingerprint":{"sha1":"4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95","sha256":"15:CB:A2:CE:4B:FE:61:1E:1A:B7:EA:EF:89:4D:AC:02:D4:54:5E:C6:82:ED:66:53:FC:05:C1:2F:71:78:EA:AE"}}},"request":{"raw":"GET /adsense/domains/caf.js HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://ww1.langhesn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-type: text/javascript; charset=UTF-8\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"ads-afs-ui\"\r\nreport-to: {\"group\":\"ads-afs-ui\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/ads-afs-ui\"}]}\r\ndate: Mon, 04 Dec 2023 18:07:21 GMT\r\nexpires: Mon, 04 Dec 2023 18:07:21 GMT\r\ncache-control: private, max-age=3600\r\netag: \"14990009047394774639\"\r\nx-content-type-options: nosniff\r\nlink: \u003chttps://www.adsensecustomsearchads.com\u003e; rel=\"preconnect\"\r\ncontent-encoding: gzip\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":56891,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"gzip compressed data, max compression\\012- data","md5":"dc2952524c91de915e6396b2d1101c6e","sha1":"78f6da97884c7322a130b162c2e4c93e0a947a0d","sha256":"d2b1e7c7f40cf4a021f19835015c00b299de8215a02cf33678a511bfd89ec923","sha512":"935c13541c6d6689558ba6c651ab2066246b9deafeb55e77d9117e0857f72f15765d5e12fc62e1fce16e76f458e2383c3aa9f9cd555d5940e8bb080987ffb2bb","ssdeep":"1536:FRYwqrAbGiuCP3H+jJEcUxhMtX+ICfsilx0Cr770Ld:FmbAbGm2jJEcUxMX+IOsile/x","tlshash":"8243f1cd7a606feca69c0125df39b27e08e166664304555eaea87b6c1b2cb920d0adc4","first_seen":"2023-12-04T19:07:37Z","last_seen":"2023-12-04T19:07:37Z","times_seen":1,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff","fqdn":"afs.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.97","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://www.google.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol318%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol472\u0026client=dp-bodis30_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fww1.langhesn.com%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2298147197369106\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17300002%2C17301157\u0026format=r3\u0026nocache=1811701713246781\u0026num=0\u0026output=afd_ads\u0026domain_name=ww1.langhesn.com\u0026v=3\u0026bsl=8\u0026pac=2\u0026u_his=2\u0026u_tz=0\u0026dt=1701713246782\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026cl=579967862\u0026uio=-\u0026cont=rs\u0026jsid=caf\u0026jsv=579967862\u0026rurl=http%3A%2F%2Fww1.langhesn.com%2F","date":"2023-12-04T18:07:27.207Z","timestamp":1701713247207,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 23 Oct 2023 11:23:50 GMT","end":"Mon, 15 Jan 2024 11:23:49 GMT"},"fingerprint":{"sha1":"2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE","sha256":"40:92:8E:18:42:CF:E7:31:DB:E9:39:E6:0B:C6:BC:AE:B4:2F:20:21:CC:80:C5:E8:5F:34:DE:01:85:5C:78:F1"}}},"request":{"raw":"GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1\r\nHost: afs.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.google.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers\r\ncross-origin-opener-policy: same-origin; report-to=\"afs-native-asset-managers\"\r\nreport-to: {\"group\":\"afs-native-asset-managers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers\"}]}\r\ncontent-length: 278\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 04 Dec 2023 02:30:27 GMT\r\nexpires: Tue, 05 Dec 2023 01:30:27 GMT\r\ncache-control: public, max-age=82800\r\nage: 56214\r\nlast-modified: Tue, 27 Jun 2023 17:28:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":278,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image\\012- , ASCII text, with very long lines (306)","md5":"fe7dd8c3c629cc6e9cd6d3e4d3cbe905","sha1":"59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18","sha256":"5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e","sha512":"1c663e07978d95c838aed54421a9c725d7311b8c002f436b30555affb26c25f6ebecff6af5c54ef112370a36a5f5aadf611304bffe76a59fb3d206e943cf153f","ssdeep":"","tlshash":"eff055bcd2ad4914a608c7017ef8a5174066f0c563cc01ceee81ac69f0614e43a63ade","first_seen":"2023-04-07T08:14:08Z","last_seen":"2026-05-03T16:41:57.827597Z","times_seen":69546,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":97,"dns":1,"connect":8,"send":0,"wait":10,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"ww1.langhesn.com/_tr","fqdn":"ww1.langhesn.com","domain":"langhesn.com","tld":"com"},"ip":{"addr":"199.59.243.225","port":80,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://ww1.langhesn.com/","date":"2023-12-04T18:07:27.195Z","timestamp":1701713247195,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /_tr HTTP/1.1\r\nHost: ww1.langhesn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://ww1.langhesn.com/\r\nContent-Type: application/json\r\nContent-Length: 1605\r\nOrigin: http://ww1.langhesn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: openresty\r\ndate: Mon, 04 Dec 2023 18:07:20 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: gzip\r\ncontent-length: 22\r\nx-version: 2.110.4\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nset-cookie: parking_session=b3ae5ba8-cf6a-41f7-bbb9-c90fd6737e5f; expires=Mon, 04 Dec 2023 18:22:21 GMT; Max-Age=900; path=/; httponly\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-05-07T23:55:07.425207Z","times_seen":407490,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2023-12-04","alert":"Sinkholed","trigger":"langhesn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b","fqdn":"afs.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.97","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://www.google.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol318%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol472\u0026client=dp-bodis30_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fww1.langhesn.com%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2298147197369106\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17300002%2C17301157\u0026format=r3\u0026nocache=1811701713246781\u0026num=0\u0026output=afd_ads\u0026domain_name=ww1.langhesn.com\u0026v=3\u0026bsl=8\u0026pac=2\u0026u_his=2\u0026u_tz=0\u0026dt=1701713246782\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026cl=579967862\u0026uio=-\u0026cont=rs\u0026jsid=caf\u0026jsv=579967862\u0026rurl=http%3A%2F%2Fww1.langhesn.com%2F","date":"2023-12-04T18:07:27.210Z","timestamp":1701713247210,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 23 Oct 2023 11:23:50 GMT","end":"Mon, 15 Jan 2024 11:23:49 GMT"},"fingerprint":{"sha1":"2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE","sha256":"40:92:8E:18:42:CF:E7:31:DB:E9:39:E6:0B:C6:BC:AE:B4:2F:20:21:CC:80:C5:E8:5F:34:DE:01:85:5C:78:F1"}}},"request":{"raw":"GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1\r\nHost: afs.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.google.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers\r\ncross-origin-opener-policy: same-origin; report-to=\"afs-native-asset-managers\"\r\nreport-to: {\"group\":\"afs-native-asset-managers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers\"}]}\r\ncontent-length: 174\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 04 Dec 2023 07:40:52 GMT\r\nexpires: Tue, 05 Dec 2023 06:40:52 GMT\r\ncache-control: public, max-age=82800\r\nage: 37589\r\nlast-modified: Thu, 02 Nov 2023 22:48:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":174,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image\\012- , ASCII text, with no line terminators","md5":"d47125b2ba92be53dcff07ba322ce1de","sha1":"e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28","sha256":"5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6","sha512":"78a1bf7547b1c28f600163689161955bc56a621ace3228c9169143be933ccf789fc6106bbf729f2e9483bcaa03271529d3913088094c7fb906b44673e13f1f92","ssdeep":"","tlshash":"72d02291d2286d38441e82e0c37c712200ee70a2230c10ccfa81a700720c8abb8a1668","first_seen":"2023-04-07T07:55:51Z","last_seen":"2026-02-01T02:48:24.72202Z","times_seen":175105,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":107,"dns":1,"connect":20,"send":0,"wait":9,"receive":0,"ssl":82},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/afs/gen_204?client=dp-bodis30_3ph\u0026output=uds_ads_only\u0026zx=fwsziwnhvlfo\u0026aqid=WRVuZdiODMWhxdwP3fGquAQ\u0026psid=3113057640\u0026pbt=bs\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis30_3ph\u0026errv=579967862\u0026csala=5%7C0%7C313%7C52%7C9\u0026lle=0\u0026ifv=1\u0026hpt=0","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://ww1.langhesn.com/","date":"2023-12-04T18:07:28.663Z","timestamp":1701713248663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 23 Oct 2023 11:18:24 GMT","end":"Mon, 15 Jan 2024 11:18:23 GMT"},"fingerprint":{"sha1":"4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95","sha256":"15:CB:A2:CE:4B:FE:61:1E:1A:B7:EA:EF:89:4D:AC:02:D4:54:5E:C6:82:ED:66:53:FC:05:C1:2F:71:78:EA:AE"}}},"request":{"raw":"GET /afs/gen_204?client=dp-bodis30_3ph\u0026output=uds_ads_only\u0026zx=fwsziwnhvlfo\u0026aqid=WRVuZdiODMWhxdwP3fGquAQ\u0026psid=3113057640\u0026pbt=bs\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis30_3ph\u0026errv=579967862\u0026csala=5%7C0%7C313%7C52%7C9\u0026lle=0\u0026ifv=1\u0026hpt=0 HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://ww1.langhesn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nTE: trailers\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-SAK0nkIcjWF_Ni_aNTI04Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\ndate: Mon, 04 Dec 2023 18:07:23 GMT\r\nserver: gws\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nset-cookie: NID=511=g48X0hoRL6ru7B2ew-iSLB8tzm0tGStTWAHDfU02gW3UZ9bG5Iscp_BEKjHBywI2wgpme6XHhuXv7y_Xv0q1Z7kSce8mqXnPTQXHBekvRO1jwxHLLPhlEmGCe1CD4TIapO6nKXyfq5niVro4IdqualCpIMejSaeCep2Pa4xQBJk; expires=Tue, 04-Jun-2024 18:07:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none\nCONSENT=PENDING+943; expires=Wed, 03-Dec-2025 18:07:23 GMT; path=/; domain=.google.com; Secure\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-05-07T23:57:24.160467Z","times_seen":14812332,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/afs/gen_204?client=dp-bodis30_3ph\u0026output=uds_ads_only\u0026zx=wmlj8jva9lk2\u0026aqid=WRVuZdiODMWhxdwP3fGquAQ\u0026psid=3113057640\u0026pbt=bv\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis30_3ph\u0026errv=579967862\u0026csala=5%7C0%7C313%7C52%7C9\u0026lle=0\u0026ifv=1\u0026hpt=0","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://ww1.langhesn.com/","date":"2023-12-04T18:07:29.164Z","timestamp":1701713249164,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 23 Oct 2023 11:18:24 GMT","end":"Mon, 15 Jan 2024 11:18:23 GMT"},"fingerprint":{"sha1":"4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95","sha256":"15:CB:A2:CE:4B:FE:61:1E:1A:B7:EA:EF:89:4D:AC:02:D4:54:5E:C6:82:ED:66:53:FC:05:C1:2F:71:78:EA:AE"}}},"request":{"raw":"GET /afs/gen_204?client=dp-bodis30_3ph\u0026output=uds_ads_only\u0026zx=wmlj8jva9lk2\u0026aqid=WRVuZdiODMWhxdwP3fGquAQ\u0026psid=3113057640\u0026pbt=bv\u0026adbx=290\u0026adby=145\u0026adbh=481\u0026adbw=700\u0026adbah=153%2C153%2C153\u0026adbn=master-1\u0026eawp=partner-dp-bodis30_3ph\u0026errv=579967862\u0026csala=5%7C0%7C313%7C52%7C9\u0026lle=0\u0026ifv=1\u0026hpt=0 HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://ww1.langhesn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nTE: trailers\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-iWxNoS7_qgtyVfZ-70-H9w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\ndate: Mon, 04 Dec 2023 18:07:23 GMT\r\nserver: gws\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nset-cookie: NID=511=rSN6A8_Zhi4PavYL-beGQZwuV4QVpXEzSsQjT-oCqdjfg07Ln-r8WOhdKdb-VzAgmiXDw1P4rJSLgKk6XFahjdXsSZu-Iu-6a_HZMb35228MUD9nXK7_axdssjKdjPsTMipH7GNfsPWb31XKbylA_5Q60SIbUZ-mq4L1ZQ_Bnnc; expires=Tue, 04-Jun-2024 18:07:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none\nCONSENT=PENDING+170; expires=Wed, 03-Dec-2025 18:07:23 GMT; path=/; domain=.google.com; Secure\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-05-07T23:57:24.160467Z","times_seen":14812332,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol318%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol472\u0026client=dp-bodis30_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fww1.langhesn.com%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2298147197369106\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17300002%2C17301157\u0026format=r3\u0026nocache=1811701713246781\u0026num=0\u0026output=afd_ads\u0026domain_name=ww1.langhesn.com\u0026v=3\u0026bsl=8\u0026pac=2\u0026u_his=2\u0026u_tz=0\u0026dt=1701713246782\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026cl=579967862\u0026uio=-\u0026cont=rs\u0026jsid=caf\u0026jsv=579967862\u0026rurl=http%3A%2F%2Fww1.langhesn.com%2F","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.164","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://ww1.langhesn.com/","date":"2023-12-04T18:07:26.796Z","timestamp":1701713246796,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"GTS CA 1C3","organization":"Google Trust Services LLC"},"validity":{"start":"Mon, 23 Oct 2023 11:18:24 GMT","end":"Mon, 15 Jan 2024 11:18:23 GMT"},"fingerprint":{"sha1":"4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95","sha256":"15:CB:A2:CE:4B:FE:61:1E:1A:B7:EA:EF:89:4D:AC:02:D4:54:5E:C6:82:ED:66:53:FC:05:C1:2F:71:78:EA:AE"}}},"request":{"raw":"GET /afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol318%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol472\u0026client=dp-bodis30_3ph\u0026r=m\u0026hl=en\u0026rpbu=http%3A%2F%2Fww1.langhesn.com%3Fcaf%26\u0026max_radlink_len=50\u0026type=3\u0026uiopt=false\u0026swp=as-drid-2298147197369106\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17300002%2C17301157\u0026format=r3\u0026nocache=1811701713246781\u0026num=0\u0026output=afd_ads\u0026domain_name=ww1.langhesn.com\u0026v=3\u0026bsl=8\u0026pac=2\u0026u_his=2\u0026u_tz=0\u0026dt=1701713246782\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026cl=579967862\u0026uio=-\u0026cont=rs\u0026jsid=caf\u0026jsv=579967862\u0026rurl=http%3A%2F%2Fww1.langhesn.com%2F HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://ww1.langhesn.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-disposition: inline\r\ndate: Mon, 04 Dec 2023 18:07:21 GMT\r\nexpires: Mon, 04 Dec 2023 18:07:21 GMT\r\ncache-control: private, max-age=3600\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-PdDZwXww5kTobjMK-Tx2ig' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ncontent-encoding: br\r\nserver: gws\r\ncontent-length: 2533\r\nx-xss-protection: 0\r\nset-cookie: CONSENT=PENDING+701; expires=Wed, 03-Dec-2025 18:07:21 GMT; path=/; domain=.google.com; Secure\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13588,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document text\\012- HTML document text\\012- HTML document text\\012- HTML document text\\012- exported SGML document, ASCII text, with very long lines (12984)","md5":"f67e4eb61799ddec30f388852c0fe9ea","sha1":"5f58536a2e1ef433c5d191dafdd290b6d7827df5","sha256":"732184d169d43eda31bea6cc79f3b155f4742ba821dbe190266c33976e91d9b8","sha512":"a4bbde1a92c684e1d1c0ab2dcfce9a772effd3631685e3aa6f4dd6e9b88dc496bd32aeb04a2573c6cebddf53d80559251708cb55c3d1f8bf218240d05eda452c","ssdeep":"96:GE/yk2iwlb5lphMzTronSc90IMvm0yEM6vfNYrWrJ0OM8DrPw9eDGJBT3M8Dpw9k:GE12ikpBn9+m0yEMcfWrAAZy4YYpbkx2","tlshash":"6a523237706227290513dc541b296f6dd181d43ac4af35e848a35f26c7ebf828fe628e","first_seen":"2023-12-04T19:07:37Z","last_seen":"2023-12-04T19:07:37Z","times_seen":1,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}