Google Search History

[neoprema]

It's not the actual url, I'm just using an example.. .

well that makes it like 0 helpful lol.

We're not kids, paste the ACTUAL urls.

 

[SHL]

@SHL It's good of you to take an interest. Do you know what his home life's like?

No but learner is well behaved and respectful.

 

[chan0o]

No, malware won't be opening chrome and browsing questionable websites at that slow pace.
Threat actor don't use GUI to pull content from the web (just use curl, wget etc).
If you want to threat hunt, look for non-interactive, silent cmd or powershell as a starting point.

Why not just block the domains on the router and /or firewall if you don't want them to access those sites?

If you are feeling extra trolly, setup an internal DNS and update those domains to redirect to "Y'all need Jesus" meme.

 

[dontcryforme]

Need some guidance on a sensitive issue. Was doing some clearing up of a young (12 year old) students laptop who uses it for learning/studying online. I was clearing up the browser cache and history when I noticed some unsavoury website visits. I have questioned the student indirectly about whether he/she is using the browser for anything other than studies and he/she denies it. The strange thing is that the searches look very random, example:

Friday 16th (16:31) - www.abc.com
(16:34) - www.efg.com
(16:36) - www.hij.com
Thurs 15th (16:41) - www.klm.com
(16:42) - www.nop.com
Wed 14th (16:28) - www.qrs.com
(16:30) - www.tuv.com
(16:32) - www.xyz.com

I know it's practically impossible for members here to give a straight forward answer as there are many possibilities and I would like to give the benefit of doubt to the student so my first question is: Could a a virus cause the above? (I have scanned the drive and no problems found). The student uses Zoom and Zoho for classes and the standard Chrome browser.

The times are strange. Thats when some people get off work

 

[SHL]

The times are strange. Thats when some people get off work

Some online classes are at those times that's why I am concerned but probable cause is as mentioned by @HocusPocusFM . I'm going to investigate further a bit later during the day.