{"report_id":"216ae378-f770-41bb-9dca-2834961adfb6","version":6,"status":"done","tags":[],"date":"2025-11-23T19:34:52Z","url":{"schema":"http","addr":"ultrapremium.cloud:8080/get.php?username=18eVelyn903972\u0026password=09fArias284571\u0026type=m3u_plus","fqdn":"ultrapremium.cloud","domain":"ultrapremium.cloud","tld":"cloud"},"ip":{"addr":"23.153.216.58","port":0,"asn":16611,"as":"INFINIAHOST","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing","dom":{"size":3632,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"884c8edb778dd55ef9d60d4a0ba8924a","sha1":"5140c39637f4c8cd953a2d4978cb95d3dc629311","sha256":"362a8b59fbbd71576a576d9e852b9384fe83c23a8daac2ab79d4b3304a0880ff","sha512":"846454abbe152ec5afc62294b2fd7c82834e6e79bb5ffc40ec905b2b1c5cc413ecfe0e22c7ef03b7c4cd1030d654b07ec83277e2ea3a67bb1f39efa3090c4e82","ssdeep":"","tlshash":"8c7156a514f0552714a383a5dd81bb1b9f827a07cf8c6a403b9f00f22f97d58886f20d","dom_hash":"domhash03f850468cad29251ed949292c202f85","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ultrapremium.cloud:8080/get.php?username=18eVelyn903972\u0026password=09fArias284571\u0026type=m3u_plus","fqdn":"ultrapremium.cloud","domain":"ultrapremium.cloud","tld":"cloud"},"ip":{"addr":"23.153.216.58","port":0,"asn":16611,"as":"INFINIAHOST","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-28T19:34:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-23T19:34:33Z","timestamp":1763926473,"ip_dst":{"addr":"192.169.69.26","port":80,"asn":27323,"as":"SERVERSTADIUM","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.13","port":53004,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain","source":"{\"timestamp\":\"2025-11-23T19:34:33.051050+0000\",\"flow_id\":1302693120710481,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":53004,\"dest_ip\":\"192.169.69.26\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042937,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_15\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"10007456782318.duckdns.org\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":3,\"pkts_toclient\":2,\"bytes_toserver\":473,\"bytes_toclient\":116,\"start\":\"2025-11-23T19:29:58.530257+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-23T19:34:48Z","timestamp":1763926488,"ip_dst":{"addr":"192.169.69.26","port":80,"asn":27323,"as":"SERVERSTADIUM","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.13","port":53048,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain","source":"{\"timestamp\":\"2025-11-23T19:34:48.456800+0000\",\"flow_id\":1030177446017966,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":53048,\"dest_ip\":\"192.169.69.26\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042937,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_15\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"10007456782318.duckdns.org\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":3,\"pkts_toclient\":2,\"bytes_toserver\":593,\"bytes_toclient\":116,\"start\":\"2025-11-23T19:30:01.113582+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"ultrapremium.cloud","ip":{"addr":"23.153.216.58","port":8080,"asn":16611,"as":"INFINIAHOST","country":"United States","country_code":"US"},"domain_registered":"2022-01-16","domain_rank":1833329,"first_seen":"2022-01-17T05:26:20Z","last_seen":"2025-10-31T17:01:56.464074Z","alert_count":0,"request_count":1,"received_data":19527437,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null},"http":[{"url":{"schema":"http","addr":"ultrapremium.cloud:8080/get.php?username=18eVelyn903972\u0026password=09fArias284571\u0026type=m3u_plus","fqdn":"ultrapremium.cloud","domain":"ultrapremium.cloud","tld":"cloud"},"ip":{"addr":"23.153.216.58","port":8080,"asn":16611,"as":"INFINIAHOST","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-23T19:34:29.046Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /get.php?username=18eVelyn903972\u0026password=09fArias284571\u0026type=m3u_plus HTTP/1.1\r\nHost: ultrapremium.cloud:8080\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 23 Nov 2025 19:34:31 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 19527099\r\nConnection: keep-alive\r\nContent-Description: File Transfer\r\nExpires: 0\r\nCache-Control: must-revalidate\r\nPragma: public\r\nContent-Disposition: attachment; filename=\"tv_channels_18eVelyn903972_plus.m3u\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19527099,"size_decoded":0,"mime_type":"application/vnd.apple.mpegurl","magic":"M3U playlist, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"7c68beca8a60c9ebcc953c412755e3c4","sha1":"be1f1166c076998bc6af2cad43368efc0cf077bd","sha256":"ba1a669f089aed7d0ff3fff2a10aa9ce2778f30581cc3af1478ebb1743313fa9","sha512":"b9e15b80decea7c322314e35cbdd24cda83013a1b420799713546dd5849615e81440ca95bf9a1312f7fda14223a24b0c62186ab110887fea7518836b4b0f9642","ssdeep":"6144:s86AsOCEkWn+j3oL2ts8o4oUYFXRIhE7ilS0:sTSkWn2Bts8o4QXRtB0","tlshash":"853512774b5a95835777caf638eb6cce90658cad1dc195c7828f43faf090068af4226c","first_seen":"2025-11-23T19:34:54.146024Z","last_seen":"2025-11-23T19:34:54.146024Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5210,"timings":{"blocked":173,"dns":42,"connect":135,"send":0,"wait":2249,"receive":2611,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}