IP 15.197.148.33:0
File typeHTML document, ASCII text, with no line terminators Hashe89f75f918dbdcee28604d4e09dd71d7 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 |
GET / HTTP/1.1
Host: coronavirusinsurance.ca
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Fri, 10 May 2024 21:33:51 GMT
Content-Type: text/html
Content-Length: 114
Connection: keep-alive
|
IP15.197.148.33:0
File typeHTML document, ASCII text, with no line terminators Hashe89f75f918dbdcee28604d4e09dd71d7 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 |
GET / HTTP/1.1
Host: coronavirusinsurance.ca
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Fri, 10 May 2024 21:33:51 GMT
Content-Type: text/html
Content-Length: 114
Connection: keep-alive
|
IP15.197.148.33:0
File typeHTML document, ASCII text, with no line terminators Hashe89f75f918dbdcee28604d4e09dd71d7 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 |
GET / HTTP/1.1
Host: coronavirusinsurance.ca
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Fri, 10 May 2024 21:33:54 GMT
Content-Type: text/html
Content-Length: 114
Connection: keep-alive
|
| coronavirusinsurance.ca/lander | 3.33.130.190 | | 73 B |
URL User Request GET coronavirusinsurance.ca/lander IP3.33.130.190:0
File typeHTML document, ASCII text Hash2acded3c2d667adce452e48f4e189ef7 20480b2594553f2f3e1fbe194a4ad7822a2c509f 9318c7d13b72b237c5832cdbab8506fe975f7d06fab5496fab968d1b866255a6
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 |
GET /lander HTTP/1.1
Host: coronavirusinsurance.ca
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://coronavirusinsurance.ca/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: openresty
Date: Fri, 10 May 2024 21:33:56 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 73
Connection: keep-alive
Location: https://coronavirusinsurance.ca/lander
|
| coronavirusinsurance.ca/favicon.ico |  0.0.0.0 | | 0 B |
URL GET coronavirusinsurance.ca/favicon.ico IP0.0.0.0:0
Requested byhttp://coronavirusinsurance.ca/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 | | suricata | medium | ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 |
GET /favicon.ico HTTP/1.1
Host: coronavirusinsurance.ca
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://coronavirusinsurance.ca/
Pragma: no-cache
Cache-Control: no-cache
|