| scenes.suroot.com/11/test_stub.exe |  3.214.53.82 | 200 OK | 13 kB |
URL User Request GET HTTP/1.1scenes.suroot.com/11/test_stub.exe IP3.214.53.82:80
File typeHTML document, ASCII text, with very long lines (9850), with CRLF line terminators Hash115e10b9d6d171d4e3aaa1763ba0a769 4ec551b0c5a2be349fd63783f26d2c4634b549b9 f096c55629e731821f483a9fd5dce710a7c223ff5519f7edc968ea9276b51d70
| Analyzer | Verdict | Alert |
|---|
| urlquery | suspicious | Suspicious - DynDNS domain |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO DYNAMIC_DNS HTTP Request to a *.suroot.com Domain |
GET /11/test_stub.exe HTTP/1.1
Host: scenes.suroot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 17 Apr 2024 23:57:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
|
| sitecdn.com/nb/cdl/coming-soon.png | 172.67.175.22 | 200 OK | 85 kB |
URL GET HTTP/1.1sitecdn.com/nb/cdl/coming-soon.png IP172.67.175.22:80
Requested byhttp://scenes.suroot.com/11/test_stub.exe
File typePNG image data, 1176 x 840, 8-bit/color RGBA, non-interlaced Hash353d368fd02dd60add22f8450c09fb10 05456c63a1771a5047316dce5c3e456be4787336 4eb62c1885447f1dd9c059866d840d8bd7a1e24c0ed8070c7afce7f8ba689998
GET /nb/cdl/coming-soon.png HTTP/1.1
Host: sitecdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://scenes.suroot.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 17 Apr 2024 23:57:46 GMT
Content-Type: image/png
Content-Length: 84793
Connection: keep-alive
last-modified: Wed, 28 Jun 2023 21:01:14 GMT
etag: "97c8c4ac3aad91:0"
x-powered-by: ASP.NET
access-control-allow-origin: *
lb: TclPrdLbPub3
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4100
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tJhZ7rfNhEneHXpGm7N4xEwFAz9zN1fNHxYF%2BDpafvNMV12fmTLzHuBMPJBZBz0Q2h%2BjpsRwixPxuth6HYEtIFpvrYNSxUVoZU0hsX6Uk1Zo2Of4J4jL%2BYhz%2B0O0Ag%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87605bfcfaf556c7-OSL
alt-svc: h2=":443"; ma=60
|