{"report_id":"456f8bc3-fb8a-4a4c-ac38-d498a5248148","version":6,"status":"done","tags":["dyndns","opendir"],"date":"2026-02-24T14:22:12Z","url":{"schema":"http","addr":"storageboost.work.gd","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"storageboost.work.gd/","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"title":"Index of /","dom":{"size":1912,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"5caa56ce4c545dd743ad08d2056c5346","sha1":"8e422f75a2c48144eaf1a0f338865010fadd13dd","sha256":"c6e14661c466f4e3701563932614a7fb872e9c02d5cd85cdcf6cf35c6810635a","sha512":"205af71cc5ee831f3ba0fe321901452b8248ff0cc01ce0e6f890d834e1e86b10d61e797a316e69174eecb55a6e75ea5e8bf7107e820cf77dec14fdf25f6b4e80","ssdeep":"","tlshash":"68411544eae6837b698214a7c2007cd9cbe68abcc7b049647c4f98cbd75c8fcc507292","dom_hash":"domhashd5f12ecdd18b69d532c66c5ce413aed1","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"storageboost.work.gd","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-31T14:22:12Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":6,"urlquery":3,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":37698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.118608+0000\",\"flow_id\":690719660423774,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37698,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1219},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":2425,\"start\":\"2026-02-24T14:21:51.899678+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":37698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.311259+0000\",\"flow_id\":690719660423774,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37698,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/blank.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":148},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":4,\"bytes_toserver\":1244,\"bytes_toclient\":2946,\"start\":\"2026-02-24T14:21:51.899678+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":37702,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.434311+0000\",\"flow_id\":582722707802021,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37702,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/folder.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":225},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":642,\"bytes_toclient\":673,\"start\":\"2026-02-24T14:21:52.214949+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":37706,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.437003+0000\",\"flow_id\":274262451572210,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37706,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/unknown.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":245},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":643,\"bytes_toclient\":693,\"start\":\"2026-02-24T14:21:52.216562+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":37718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.437705+0000\",\"flow_id\":695890801087326,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37718,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/image2.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":309},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":642,\"bytes_toclient\":758,\"start\":\"2026-02-24T14:21:52.217950+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":37718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.547240+0000\",\"flow_id\":695890801087326,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37718,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/x-icon\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1150},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":6,\"pkts_toclient\":4,\"bytes_toserver\":1139,\"bytes_toclient\":2352,\"start\":\"2026-02-24T14:21:52.217950+0000\"}}"}],"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null},{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]},"summary":[{"fqdn":"storageboost.work.gd","ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"2022-06-18","domain_rank":0,"first_seen":"2026-02-24T04:39:59.371054Z","last_seen":"2026-02-24T04:39:59.371054Z","alert_count":50,"request_count":7,"received_data":5840,"sent_data":2739,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]},{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"storageboost.work.gd/icons/blank.gif","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://storageboost.work.gd/","date":"2026-02-24T14:21:52.221Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /icons/blank.gif HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://storageboost.work.gd/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 24 Feb 2026 14:21:52 GMT\r\nServer: Apache/2.4.66 (Win64) OpenSSL/3.6.0 PHP/8.2.30\r\nLast-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\nETag: \"94-3e9564c23b600\"\r\nAccept-Ranges: bytes\r\nContent-Length: 148\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/gif\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]},{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]}],"data":{"size":148,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 20 x 22","md5":"19517fb39a31be6b8d7ccf53ad84908f","sha1":"ebbcfdc6acc99f7aac3bf7fe72bc55f07f03f7e9","sha256":"3cb0e54babf019703fe671a32fcc3947aab9079ec2871cf0f9639245cc12d878","sha512":"be752ff4c7aa3ab46fdbd93555a17e422e7c8b8661f40f899f51ec9393b510dcb2e66436a4f2c78a42af77dd95e01a3438c88cfaa3e0b02694c1912d5294ee16","ssdeep":"","tlshash":"80c02b4edec0e411c040553c0c0db7577702f1500b277108b482b3c72ef780258b2447","first_seen":"2023-05-02T00:24:31Z","last_seen":"2026-08-01T15:12:00.91426Z","times_seen":9272,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":1,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.311259+0000\",\"flow_id\":690719660423774,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37698,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/blank.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":148},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":4,\"bytes_toserver\":1244,\"bytes_toclient\":2946,\"start\":\"2026-02-24T14:21:51.899678+0000\"}}"}],"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"http","addr":"storageboost.work.gd/icons/folder.gif","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://storageboost.work.gd/","date":"2026-02-24T14:21:52.223Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /icons/folder.gif HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://storageboost.work.gd/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 24 Feb 2026 14:21:52 GMT\r\nServer: Apache/2.4.66 (Win64) OpenSSL/3.6.0 PHP/8.2.30\r\nLast-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\nETag: \"e1-3e9564c23b600\"\r\nAccept-Ranges: bytes\r\nContent-Length: 225\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/gif\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]}],"data":{"size":225,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 20 x 22","md5":"d342cba375fea336967317bdb5d7cf19","sha1":"768de3abb08abc5fe2db93454a78c9d3d955d5e4","sha256":"fbe5eca717cfbcb58891d431f9afaf30aa740d9fce007e820a599f22afa0dee2","sha512":"7fbf98d95066a7443805da1645490e0e98b7674d092e496acecea6e6bebbf74385e687db788517ab412dd60381d1f7f2243ef167646bd906d460e67eaa15e315","ssdeep":"","tlshash":"b6d0a72585914d50dd40b5bc04053552b7e2e2128babbc00e94259cb5a6685164b3406","first_seen":"2023-05-02T00:24:31Z","last_seen":"2026-08-01T15:12:00.915577Z","times_seen":4417,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":89,"dns":1,"connect":96,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37702,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.434311+0000\",\"flow_id\":582722707802021,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37702,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/folder.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":225},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":642,\"bytes_toclient\":673,\"start\":\"2026-02-24T14:21:52.214949+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"http","addr":"storageboost.work.gd/icons/image2.gif","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://storageboost.work.gd/","date":"2026-02-24T14:21:52.225Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /icons/image2.gif HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://storageboost.work.gd/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 24 Feb 2026 14:21:52 GMT\r\nServer: Apache/2.4.66 (Win64) OpenSSL/3.6.0 PHP/8.2.30\r\nLast-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\nETag: \"135-3e9564c23b600\"\r\nAccept-Ranges: bytes\r\nContent-Length: 309\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/gif\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]}],"data":{"size":309,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 20 x 22","md5":"e9d3a53f5dab2854316d3f8a4afe69b0","sha1":"b13d3b360793455ab7af134a09c683eb31b72ef5","sha256":"1e09d5e4e03c57ba24c23b84cc4af3ce66cb44259849d929b911711c25d25c5e","sha512":"e6d9217751b64526516019be5d624093b6ed26b81e0489e4116bc764b339235ccd08be1c364e91e870a16fac8daed2d89bf3a5da1624e5bab5b5ce4dd0ce1916","ssdeep":"","tlshash":"71e0eb38cdd8e811c32028bf0419205bb76883b287bb29cd9c01fa8e0c860a1cc3097b","first_seen":"2023-05-03T16:33:54Z","last_seen":"2026-07-28T12:08:00.343883Z","times_seen":1250,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":89,"dns":1,"connect":96,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.437705+0000\",\"flow_id\":695890801087326,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37718,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/image2.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":309},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":642,\"bytes_toclient\":758,\"start\":\"2026-02-24T14:21:52.217950+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"http","addr":"storageboost.work.gd/icons/unknown.gif","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://storageboost.work.gd/","date":"2026-02-24T14:21:52.227Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /icons/unknown.gif HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://storageboost.work.gd/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 24 Feb 2026 14:21:52 GMT\r\nServer: Apache/2.4.66 (Win64) OpenSSL/3.6.0 PHP/8.2.30\r\nLast-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\nETag: \"f5-3e9564c23b600\"\r\nAccept-Ranges: bytes\r\nContent-Length: 245\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/gif\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]},{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":245,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 20 x 22","md5":"088e8e238b79e9ea2b4371abb91b1fea","sha1":"dc1cdfa814046ea64609c438e1777f55ff3aa86c","sha256":"15f5fd53009f61c653aa23d91334f9d7fa2fbd325eab859b68d77a45bb6a78b8","sha512":"3fd0722505117d869f0dda1f61644c30582e2a5e449452c8037c6c9360b4a4b1f11a8b5b9439a72be1a717ffdff7ee30c512d26740f6d0048cbe3ced4553e042","ssdeep":"","tlshash":"87d09727eee18c00d00092fc298073227342da24979ee910b49397c60a609aa1432906","first_seen":"2023-05-02T10:55:37Z","last_seen":"2026-07-31T18:00:43.120788Z","times_seen":3708,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":88,"dns":1,"connect":98,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37706,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.437003+0000\",\"flow_id\":274262451572210,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37706,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/icons/unknown.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":245},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":643,\"bytes_toclient\":693,\"start\":\"2026-02-24T14:21:52.216562+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"http","addr":"storageboost.work.gd/favicon.ico","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://storageboost.work.gd/","date":"2026-02-24T14:21:52.451Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://storageboost.work.gd/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 24 Feb 2026 14:21:52 GMT\r\nServer: Apache/2.4.66 (Win64) OpenSSL/3.6.0 PHP/8.2.30\r\nLast-Modified: Wed, 28 Mar 2018 02:00:32 GMT\r\nETag: \"47e-5686f5f3c5000\"\r\nAccept-Ranges: bytes\r\nContent-Length: 1150\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/x-icon\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]},{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]}],"data":{"size":1150,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"1e7d0e39c30b085c52379e9b837c4caa","sha1":"460e0ae68a6c545a5523a9e58012d273fb915600","sha256":"e7b0ebafaeb03607b1c5342f52ccfee82554bbd337920a6c7d009815a417d809","sha512":"914e645812d3e11c60cb880baa88f5a787acdbcc30a0b15b749acfdc3940bad65cd1e4b15b914e86be21b605e63b5c6a80ac42159a1e9c711cf99481422f3277","ssdeep":"","tlshash":"1921f1926520d0cbda1a71f2e186cbf55a6c0c194c209e77587b7feb7976207de2504c","first_seen":"2023-05-02T20:04:05Z","last_seen":"2026-05-14T18:32:51.01766Z","times_seen":247,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.547240+0000\",\"flow_id\":695890801087326,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37718,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/x-icon\",\"http_refer\":\"http://storageboost.work.gd/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1150},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":6,\"pkts_toclient\":4,\"bytes_toserver\":1139,\"bytes_toclient\":2352,\"start\":\"2026-02-24T14:21:52.217950+0000\"}}"}],"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"storageboost.work.gd/","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-24T14:21:51.550Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T17:16:06.965139Z","times_seen":17657013,"resource_available":true,"data":null}},"time_used":335,"timings":{"blocked":0,"dns":131,"connect":100,"send":0,"wait":0,"receive":0,"ssl":102},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.118608+0000\",\"flow_id\":690719660423774,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37698,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1219},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":2425,\"start\":\"2026-02-24T14:21:51.899678+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"http","addr":"storageboost.work.gd/","fqdn":"storageboost.work.gd","domain":"work.gd","tld":"gd"},"ip":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-24T14:21:51.900Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: storageboost.work.gd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 24 Feb 2026 14:21:52 GMT\r\nServer: Apache/2.4.66 (Win64) OpenSSL/3.6.0 PHP/8.2.30\r\nContent-Length: 1990\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html;charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.66","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenSSL:3.6.0","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","website":"https://openssl.org","common_platform_enumeration":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","icon":"OpenSSL.png","categories":["Web server extensions"]},{"name":"PHP:8.2.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":1990,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"8648783c28d13b0c3e0ebd70d066fb0b","sha1":"1a603c82b55d1d0a862c80f808eb31fb0fadd87b","sha256":"4519b21accfe8adadf3d4a738dd42d60c7437d7b4a37bef40a2a9ad1620d4356","sha512":"69ddce0e2b9195842b481b26aefbd57f02c40df5846be4dd30b5d492641c73df2a15cf49e0ea058e3371376c9d6de1f0797a89768b2987f6e624801168a03a7b","ssdeep":"","tlshash":"07410748eae5837769821497d2007cd9cbe28abcc7f149647c4f98cbd75c9fc8517192","first_seen":"2026-02-24T14:22:15.897601Z","last_seen":"2026-02-24T14:22:15.897601Z","times_seen":1,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":98,"dns":0,"connect":98,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-24T14:21:52Z","timestamp":1771942912,"ip_dst":{"addr":"104.168.70.40","port":80,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.49","port":37698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain","source":"{\"timestamp\":\"2026-02-24T14:21:52.118608+0000\",\"flow_id\":690719660423774,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":37698,\"dest_ip\":\"104.168.70.40\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2042827,\"rev\":2,\"signature\":\"ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1568\"],\"mitre_technique_name\":[\"Dynamic_Resolution\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_02\"]}},\"http\":{\"hostname\":\"storageboost.work.gd\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1219},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":2425,\"start\":\"2026-02-24T14:21:51.899678+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"storageboost.work.gd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-24","alert":"Phishing Block","trigger":"storageboost.work.gd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]}}]}