| syndicatedsearch.goog/afs/gen_204?client=dp-bodis31_3ph&output=uds_ads_only&zx=8axaabpi78n8&cd_fexp=72717107&aqid=CDMEaMz4HJu0iM0Pq6Gi0Q8&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=364&adbw=700&adbah=114%2C114%2C114&adbn=master-1&eawp=partner-dp-bodis31_3ph&errv=747525664&csala=22%7C0%7C602%7C95%7C35&lle=0&ifv=1&hpt=0 |  216.58.207.238 | 204 No Content | 0 B |
URL GET syndicatedsearch.goog/afs/gen_204?client=dp-bodis31_3ph&output=uds_ads_only&zx=8axaabpi78n8&cd_fexp=72717107&aqid=CDMEaMz4HJu0iM0Pq6Gi0Q8&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=364&adbw=700&adbah=114%2C114%2C114&adbn=master-1&eawp=partner-dp-bodis31_3ph&errv=747525664&csala=22%7C0%7C602%7C95%7C35&lle=0&ifv=1&hpt=0 IP216.58.207.238:443
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog Fingerprint25:85:6E:DB:F5:A7:5C:14:22:6A:F8:44:8F:EE:EB:07:7A:40:68:30 ValidityMon, 31 Mar 2025 08:57:43 GMT - Mon, 23 Jun 2025 08:57:42 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-bodis31_3ph&output=uds_ads_only&zx=8axaabpi78n8&cd_fexp=72717107&aqid=CDMEaMz4HJu0iM0Pq6Gi0Q8&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=364&adbw=700&adbah=114%2C114%2C114&adbn=master-1&eawp=partner-dp-bodis31_3ph&errv=747525664&csala=22%7C0%7C602%7C95%7C35&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.kxhkqd.restspeedwall.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-v3UdkXiyuUu_qANpNGVY-A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Sat, 19 Apr 2025 23:34:34 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 | 199.59.243.228 | 200 OK | 1.2 kB |
URL User Request GET ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 IP199.59.243.228:80
File typeHTML document, ASCII text, with very long lines (474) Hash0a6ccc83bc4f6cfbe0b6aebb85e5f7b1 9f1b4d0e0aeadb78909abadcb4f4715a1748e083 c9044d4124e88dba9dcdc479a8028e10f5f615436c381ac44cb82e6efb32a28d
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO HTTP Request to a *.buzz domain |
GET /?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 HTTP/1.1
Host: ww25.kxhkqd.restspeedwall.buzz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sat, 19 Apr 2025 23:34:30 GMT
content-type: text/html; charset=utf-8
content-length: 1206
x-request-id: 79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_uke5g7aXs9fX2AEyer/lAEcalFaZDMAVp/YsxtODRSle/vLnUiiXquSUHeHx3YsBop285SUDmzJSB41hsjV1nA==
set-cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5; expires=Sat, 19 Apr 2025 23:49:30 GMT; path=/
|
|
| syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol123%2Cpid-bodis-gcontrol494%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2589285024539458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717107&format=r3&nocache=9881745105672165&num=0&output=afd_ads&domain_name=ww25.kxhkqd.restspeedwall.buzz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1745105672167&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=747525664&rurl=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fsubid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05 | 216.58.207.238 | 200 OK | 14 kB |
URL GET syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol123%2Cpid-bodis-gcontrol494%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2589285024539458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717107&format=r3&nocache=9881745105672165&num=0&output=afd_ads&domain_name=ww25.kxhkqd.restspeedwall.buzz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1745105672167&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=747525664&rurl=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fsubid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05 IP216.58.207.238:443
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog Fingerprint25:85:6E:DB:F5:A7:5C:14:22:6A:F8:44:8F:EE:EB:07:7A:40:68:30 ValidityMon, 31 Mar 2025 08:57:43 GMT - Mon, 23 Jun 2025 08:57:42 GMT
File typeHTML document, ASCII text, with very long lines (13187) Hashf78b43b347e60fc83cd337f70bc56b50 3de134f0f8c841e526dc61846b281d2850a3fa77 cd26a9e08ab1bff06c3d5184f825d3813af5b7a3a0ae68b27f21d85e895fa1d4
GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol123%2Cpid-bodis-gcontrol494%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2589285024539458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717107&format=r3&nocache=9881745105672165&num=0&output=afd_ads&domain_name=ww25.kxhkqd.restspeedwall.buzz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1745105672167&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=747525664&rurl=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fsubid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.kxhkqd.restspeedwall.buzz/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sat, 19 Apr 2025 23:34:32 GMT
expires: Sat, 19 Apr 2025 23:34:32 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-VYYoUqGwgb_wOp_BoSXijA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2700
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ww25.kxhkqd.restspeedwall.buzz/_tr | 199.59.243.228 | 200 OK | 2 B |
URL POST ww25.kxhkqd.restspeedwall.buzz/_tr IP199.59.243.228:80
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05
File typeASCII text, with no line terminators Hash444bcb3a3fcf8389296c49467f27e1d6 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
POST /_tr HTTP/1.1
Host: ww25.kxhkqd.restspeedwall.buzz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05
Content-Type: application/json
Content-Length: 2049
Origin: http://ww25.kxhkqd.restspeedwall.buzz
DNT: 1
Connection: keep-alive
Cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sat, 19 Apr 2025 23:34:32 GMT
content-type: application/json; charset=utf-8
content-length: 2
x-request-id: 50bf95f4-e6d8-4375-9800-39806ca97363
set-cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5; expires=Sat, 19 Apr 2025 23:49:32 GMT
|
|
| afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b | 142.250.74.33 | 200 OK | 200 B |
URL GET afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b IP142.250.74.33:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol123%2Cpid-bodis-gcontrol494%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2589285024539458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717107&format=r3&nocache=9881745105672165&num=0&output=afd_ads&domain_name=ww25.kxhkqd.restspeedwall.buzz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1745105672167&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=747525664&rurl=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fsubid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subject*.googleusercontent.com Fingerprint85:7D:D7:AA:27:49:F3:83:36:F8:74:84:32:01:E8:F1:A5:3B:95:77 ValidityMon, 31 Mar 2025 08:55:30 GMT - Mon, 23 Jun 2025 08:55:29 GMT
File typeSVG Scalable Vector Graphics image Hashd47125b2ba92be53dcff07ba322ce1de e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28 5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 19 Apr 2025 08:45:03 GMT
expires: Sun, 20 Apr 2025 07:45:03 GMT
cache-control: public, max-age=82800
age: 53370
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| syndicatedsearch.goog/afs/gen_204?client=dp-bodis31_3ph&output=uds_ads_only&zx=ypzttbu3e3p&cd_fexp=72717107&aqid=CDMEaMz4HJu0iM0Pq6Gi0Q8&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=364&adbw=700&adbah=114%2C114%2C114&adbn=master-1&eawp=partner-dp-bodis31_3ph&errv=747525664&csala=22%7C0%7C602%7C95%7C35&lle=0&ifv=1&hpt=0 | 216.58.207.238 | 204 No Content | 0 B |
URL GET syndicatedsearch.goog/afs/gen_204?client=dp-bodis31_3ph&output=uds_ads_only&zx=ypzttbu3e3p&cd_fexp=72717107&aqid=CDMEaMz4HJu0iM0Pq6Gi0Q8&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=364&adbw=700&adbah=114%2C114%2C114&adbn=master-1&eawp=partner-dp-bodis31_3ph&errv=747525664&csala=22%7C0%7C602%7C95%7C35&lle=0&ifv=1&hpt=0 IP216.58.207.238:443
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog Fingerprint25:85:6E:DB:F5:A7:5C:14:22:6A:F8:44:8F:EE:EB:07:7A:40:68:30 ValidityMon, 31 Mar 2025 08:57:43 GMT - Mon, 23 Jun 2025 08:57:42 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-bodis31_3ph&output=uds_ads_only&zx=ypzttbu3e3p&cd_fexp=72717107&aqid=CDMEaMz4HJu0iM0Pq6Gi0Q8&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=364&adbw=700&adbah=114%2C114%2C114&adbn=master-1&eawp=partner-dp-bodis31_3ph&errv=747525664&csala=22%7C0%7C602%7C95%7C35&lle=0&ifv=1&hpt=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.kxhkqd.restspeedwall.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-wE-womuM0wU2wig7v5iZ2A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Sat, 19 Apr 2025 23:34:34 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| syndicatedsearch.goog/adsense/domains/caf.js | 216.58.207.238 | 200 OK | 144 kB |
URL GET syndicatedsearch.goog/adsense/domains/caf.js IP216.58.207.238:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol123%2Cpid-bodis-gcontrol494%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2589285024539458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717107&format=r3&nocache=9881745105672165&num=0&output=afd_ads&domain_name=ww25.kxhkqd.restspeedwall.buzz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1745105672167&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=747525664&rurl=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fsubid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subjectsyndicatedsearch.goog Fingerprint25:85:6E:DB:F5:A7:5C:14:22:6A:F8:44:8F:EE:EB:07:7A:40:68:30 ValidityMon, 31 Mar 2025 08:57:43 GMT - Mon, 23 Jun 2025 08:57:42 GMT
File typeJavaScript source, ASCII text, with very long lines (1839) Size144 kB (144035 bytes) Hash42aee60b820a982c9ec46781b3cf9555 0b6ea1d48181c9986637a6a00fca1e283c0aa17a 775b1f18d131b5e287ac19dd485121e56f53eabdb6c7f6cd11eaa9d880b4c67d
GET /adsense/domains/caf.js HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sat, 19 Apr 2025 23:34:32 GMT
expires: Sat, 19 Apr 2025 23:34:32 GMT
cache-control: private, max-age=3600
etag: "14478210006332764065"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff | 142.250.74.33 | 200 OK | 200 B |
URL GET afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff IP142.250.74.33:443
Requested byhttps://syndicatedsearch.goog/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol123%2Cpid-bodis-gcontrol494%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162&client=dp-bodis31_3ph&r=m&hl=en&ivt=0&rpbu=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fcaf%3D1%26bpt%3D345%26subid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2589285024539458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301548%2C17301266%2C72717107&format=r3&nocache=9881745105672165&num=0&output=afd_ads&domain_name=ww25.kxhkqd.restspeedwall.buzz&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1745105672167&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=747525664&rurl=http%3A%2F%2Fww25.kxhkqd.restspeedwall.buzz%2F%3Fsubid1%3D20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subject*.googleusercontent.com Fingerprint85:7D:D7:AA:27:49:F3:83:36:F8:74:84:32:01:E8:F1:A5:3B:95:77 ValidityMon, 31 Mar 2025 08:55:30 GMT - Mon, 23 Jun 2025 08:55:29 GMT
File typeSVG Scalable Vector Graphics image Hash11b3089d616633ca6b73b57aa877eeb4 07632f63e06b30d9b63c97177d3a8122629bda9b 809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 19 Apr 2025 01:38:28 GMT
expires: Sun, 20 Apr 2025 00:38:28 GMT
cache-control: public, max-age=82800
age: 78965
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 |  0.0.0.0 | | 0 B |
URL User Request GET ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO HTTP Request to a *.buzz domain |
GET /?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 HTTP/1.1
Host: ww25.kxhkqd.restspeedwall.buzz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| ww25.kxhkqd.restspeedwall.buzz/bgxHWMwhP.js | 199.59.243.228 | 200 OK | 36 kB |
URL GET ww25.kxhkqd.restspeedwall.buzz/bgxHWMwhP.js IP199.59.243.228:80
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (35690) Hashb31a2ef88b7707fdd5e9dacade05a504 349fc0a18b1b31d2fe8f81a28034dd600caf4ae1 1a05b5cf9f72b9af409d10301e29196c4435fd094310bd0da4c2d7856b80d0af
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO HTTP Request to a *.buzz domain |
GET /bgxHWMwhP.js HTTP/1.1
Host: ww25.kxhkqd.restspeedwall.buzz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05
Cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sat, 19 Apr 2025 23:34:31 GMT
content-type: application/javascript; charset=utf-8
content-length: 35693
x-request-id: d0429ead-667b-4f9a-816c-82cc700ae00d
set-cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5; expires=Sat, 19 Apr 2025 23:49:31 GMT
|
|
| ww25.kxhkqd.restspeedwall.buzz/_fd?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 | 199.59.243.228 | 200 OK | 5.2 kB |
URL POST ww25.kxhkqd.restspeedwall.buzz/_fd?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 IP199.59.243.228:80
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05
File typeASCII text, with very long lines (5229), with no line terminators Hashb9afaa3dbc1a7abdb04fd31392a8a2ac 795020d0a24d9bfd6b6a1c49b405fb137d99d074 f0a1dc18c777767a81e405da9ed2a32e87156a18fed81d5d5ad68e5ccf44164b
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO HTTP Request to a *.buzz domain |
POST /_fd?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 HTTP/1.1
Host: ww25.kxhkqd.restspeedwall.buzz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05
Content-Type: application/json
Origin: http://ww25.kxhkqd.restspeedwall.buzz
DNT: 1
Connection: keep-alive
Cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/1.1 200 OK
date: Sat, 19 Apr 2025 23:34:31 GMT
content-type: application/json; charset=utf-8
content-length: 5229
x-request-id: 5c933c3e-0fdc-41d1-a4f9-e170970d369f
set-cookie: parking_session=79e421cc-ca8a-4c5f-9b6b-80b9fb3b03c5; expires=Sat, 19 Apr 2025 23:49:31 GMT
|
|
| www.google.com/adsense/domains/caf.js?abp=1&bodis=true | 142.250.178.100 | 200 OK | 144 kB |
URL GET www.google.com/adsense/domains/caf.js?abp=1&bodis=true IP142.250.178.100:443
Requested byhttp://ww25.kxhkqd.restspeedwall.buzz/?subid1=20250420-0807-41c2-a5e5-ecf7fc91ab05 CertificateIssuerGoogle Trust Services Subjectwww.google.com FingerprintFD:1E:8C:23:6E:3E:CE:28:8F:BB:1E:C1:87:A0:77:5D:45:20:F7:03 ValidityMon, 31 Mar 2025 08:56:21 GMT - Mon, 23 Jun 2025 08:56:20 GMT
File typeJavaScript source, ASCII text, with very long lines (1839) Size144 kB (144019 bytes) Hash97e89d8ec8ce7fc75b0a9dca6c5d7a02 028794a73993db1926c899f182f5e756931d262c 03134bffc7423a6fd9a1ebe89aafa2509d7b787bb70bc936443a4c23accc1783
GET /adsense/domains/caf.js?abp=1&bodis=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww25.kxhkqd.restspeedwall.buzz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sat, 19 Apr 2025 23:34:31 GMT
expires: Sat, 19 Apr 2025 23:34:31 GMT
cache-control: private, max-age=3600
etag: "12479839741467696111"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|