{"report_id":"5d1ff9ca-6af9-452d-adec-1ba0e0a782b4","version":6,"status":"done","tags":[],"date":"2026-03-31T22:33:16Z","url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"172.237.146.8","port":0,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"title":"Redirecting...","dom":{"size":8047,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9ed754503a6bf3b847f6e5004b2d8d76","sha1":"b3b158cfdfa27e02284f6f6d6d07e36cb99aec6b","sha256":"e62a1c0f1c07c5f268ef3c005acce89fddcf59c1d36d4dbea2056fb5c3a941c3","sha512":"4c3ded4040072e97ff808961fc3c94dc42b4fbd28805ea75de3b9f25e72825d3fa112813e5d1e905c0ddc6b7bceb779845966199e0c8132b3fd38cc27c7c6f96","ssdeep":"192:JhBryl3b01g6E+/Oi7tFoQnLnMk92rusaqCim0H6:Jzg6","tlshash":"0df1745155fb100a2483e474a770d39e56aac247ee4bda1d3b9d0388cfcedc1c8e36a9","dom_hash":"domhash178fb39a46bb38c1b59dad0ed8caaebf","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"172.237.146.8","port":0,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-05T22:33:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":20,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:54Z","timestamp":1774996374,"ip_dst":{"addr":"172.237.146.38","port":443,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":49658,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:54.695252+0000\",\"flow_id\":1833357450563621,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":49658,\"dest_ip\":\"172.237.146.38\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029707,\"rev\":9,\"signature\":\"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_28\"]}},\"tls\":{\"sni\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":953,\"bytes_toclient\":959,\"start\":\"2026-03-31T22:32:54.479269+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.233.219.123","port":80,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":48056,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.395404+0000\",\"flow_id\":1372855352284283,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48056,\"dest_ip\":\"172.233.219.123\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":588,\"bytes_toclient\":3737,\"start\":\"2026-03-31T22:32:57.185467+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":443,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":49668,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.470323+0000\",\"flow_id\":679563878646330,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":49668,\"dest_ip\":\"172.237.146.38\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029707,\"rev\":9,\"signature\":\"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_28\"]}},\"tls\":{\"sni\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"version\":\"UNDETERMINED\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":789,\"bytes_toclient\":140,\"start\":\"2026-03-31T22:32:54.705082+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.697770+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":708,\"bytes_toclient\":3722,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.897881+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":6,\"bytes_toserver\":1399,\"bytes_toclient\":3788,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50670,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.110718+0000\",\"flow_id\":572348610229257,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50670,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:57.898057+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50682,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.322693+0000\",\"flow_id\":1895739703341374,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50682,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.110910+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.533149+0000\",\"flow_id\":1431655602122018,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50698,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.322850+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.745135+0000\",\"flow_id\":1294798616666917,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50704,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.533285+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50706,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.957053+0000\",\"flow_id\":1792445739851632,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50706,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":5,\"pkts_toclient\":3,\"bytes_toserver\":765,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.745328+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.8","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":48328,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.221695+0000\",\"flow_id\":1095789159591478,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48328,\"dest_ip\":\"172.237.146.8\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.011830+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50716,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.433425+0000\",\"flow_id\":1934907657642649,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50716,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.221849+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50730,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.643583+0000\",\"flow_id\":1220826395024790,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50730,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.433558+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50742,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.856064+0000\",\"flow_id\":1666768554415001,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50742,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.643993+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50748,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.066248+0000\",\"flow_id\":1231007614963919,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50748,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.856271+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50756,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.278609+0000\",\"flow_id\":2249174709699417,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50756,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.066393+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50764,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.490547+0000\",\"flow_id\":427028391936309,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50764,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.278837+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50778,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.703580+0000\",\"flow_id\":372997703367918,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50778,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.490734+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50786,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.916646+0000\",\"flow_id\":1311207539392673,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50786,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.704673+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:01Z","timestamp":1774996381,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":50788,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:01.128500+0000\",\"flow_id\":252173830913387,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50788,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.916843+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"router.parklogic.com","ip":{"addr":"172.234.216.100","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"domain_registered":"2007-02-28","domain_rank":346495,"first_seen":"2025-03-19T10:23:50.028513Z","last_seen":"2026-03-30T03:36:29.844204Z","alert_count":0,"request_count":1,"received_data":8197,"sent_data":570,"comment":"","tags":null,"fingerprints":null},{"fqdn":"parking3.parklogic.com","ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"domain_registered":"2007-02-28","domain_rank":497061,"first_seen":"2023-05-10T10:50:24Z","last_seen":"2026-03-30T12:55:28.309731Z","alert_count":0,"request_count":5,"received_data":2097,"sent_data":2806,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","ip":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"domain_registered":"2025-08-23","domain_rank":0,"first_seen":"2026-03-31T22:33:16.796354Z","last_seen":"2026-03-31T22:33:16.796354Z","alert_count":40,"request_count":4,"received_data":5628,"sent_data":1810,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"10f02192f2230fdf70169b14a01331d5","sha1":"4c590a5b361b7da8d459ab1c87ff8ea9493c639e","sha256":"5e91e66ff266b0812cbd93f31a5870455f3dfb05a609033e812714c194ff0d33","sha512":"902bbd3e2fba525d321f44246b1c749d1db43d14b4b9e92b42af3a45bddef5348efaac524ba532b32509befa192722607dd2e538fc8f36be20079b6e47e9a987","ssdeep":"","tlshash":"12211f8815e151a200f339789bbf8718e5b5140b2007cef13c6c16805fa153ad6e4bb6","size":1342,"data":"","first_seen":"2026-03-31T22:33:26.545657Z","last_seen":"2026-03-31T22:33:26.545657Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9d4618dc0fcc33d75b43160fa31ec0f4","sha1":"3b0472b9a88e10c3884d21b64e96523ae70aff6a","sha256":"3538d332cb6444185219f52ebc30f035ce1058ac2175d9b04c27ac432616fc30","sha512":"c5b7d12e997d62d5b4477009e8b0cdce2a2e7904b82c98a6943141a35eea5560f4280a8f20058b3e4e923fcde53579ba1634876e1a80a7205281bdb64bcb596a","ssdeep":"96:ItDJYtoAJS8ffKH1NPIX4rDJcs01cq4o5nZsCG21epKED7B6YR:IVJYtoA1ffqzr/Jcs0BbsCF1ego7R","tlshash":"58911976bb86303957e511eae53f9b68763ea31134074063d7adfcd23c20a8a4097f99","size":4602,"data":"","first_seen":"2026-03-31T22:33:26.557755Z","last_seen":"2026-03-31T22:33:26.557755Z","times_seen":1,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.233.219.123","port":80,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":48056,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.395404+0000\",\"flow_id\":1372855352284283,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48056,\"dest_ip\":\"172.233.219.123\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":588,\"bytes_toclient\":3737,\"start\":\"2026-03-31T22:32:57.185467+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.697770+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":708,\"bytes_toclient\":3722,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"}],"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:33:00.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:33:00 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":542,"timings":{"blocked":218,"dns":1,"connect":104,"send":0,"wait":106,"receive":0,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:33:06.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:33:06 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-31T22:32:57.489Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 31 Mar 2026 22:32:57 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-store, max-age=0\r\nAccept-CH: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64\r\nPermissions-Policy: ch-ua=(self \"https://*.parklogic.com\"), ch-ua-arch=(self \"https://*.parklogic.com\"), ch-ua-bitness=(self \"https://*.parklogic.com\"), ch-ua-full-version=(self \"https://*.parklogic.com\"), ch-ua-full-version-list=(self \"https://*.parklogic.com\"), ch-ua-mobile=(self \"https://*.parklogic.com\"), ch-ua-model=(self \"https://*.parklogic.com\"), ch-ua-platform=(self \"https://*.parklogic.com\"), ch-ua-platform-version=(self \"https://*.parklogic.com\"), ch-ua-wow64=(self \"https://*.parklogic.com\")\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":4697,"size_decoded":0,"mime_type":"text/html","magic":"JavaScript source, ASCII text, with very long lines (4697), with no line terminators","md5":"fdbb610d658effa4fd710ad0777df70f","sha1":"3cdbf16ef88a2369b72108954ebd94fd56d8594b","sha256":"4e4f5838f23692495e0f6beb11143bfdaee48f16f3a051821a9e82c20d1e3f96","sha512":"089295840ad2b42f18a4ad30cb6d791ddf3c27bb4343ad7cecb507f68657a796e388f65d30a7e9e3da2f46c121839233cc5167b9da9153ef9967f3e214cf0fff","ssdeep":"96:nItDJYtoAJS8ffKH1NPIX4rDJcs01cq4o5nZsCG21epKED7B6YI:IVJYtoA1ffqzr/Jcs0BbsCF1ego7I","tlshash":"4ca10a75bb86303d5be511e9a43ba76c763e931134074062d79dfcd23c20a8a4097f99","first_seen":"2026-03-31T22:33:26.536554Z","last_seen":"2026-03-31T22:33:26.536554Z","times_seen":1,"resource_available":true,"data":null}},"time_used":315,"timings":{"blocked":103,"dns":1,"connect":105,"send":0,"wait":105,"receive":1,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.233.219.123","port":80,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":48056,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.395404+0000\",\"flow_id\":1372855352284283,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48056,\"dest_ip\":\"172.233.219.123\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":588,\"bytes_toclient\":3737,\"start\":\"2026-03-31T22:32:57.185467+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.697770+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":708,\"bytes_toclient\":3722,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/favicon.ico","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:32:57.793Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":2010,"timings":{"blocked":105,"dns":847,"connect":953,"send":1058,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.897881+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":6,\"bytes_toserver\":1399,\"bytes_toclient\":3788,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50670,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.110718+0000\",\"flow_id\":572348610229257,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50670,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:57.898057+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50682,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.322693+0000\",\"flow_id\":1895739703341374,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50682,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.110910+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.533149+0000\",\"flow_id\":1431655602122018,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50698,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.322850+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.745135+0000\",\"flow_id\":1294798616666917,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50704,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.533285+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50706,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.957053+0000\",\"flow_id\":1792445739851632,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50706,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":5,\"pkts_toclient\":3,\"bytes_toserver\":765,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.745328+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.8","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":48328,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.221695+0000\",\"flow_id\":1095789159591478,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48328,\"dest_ip\":\"172.237.146.8\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.011830+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50716,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.433425+0000\",\"flow_id\":1934907657642649,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50716,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.221849+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50730,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.643583+0000\",\"flow_id\":1220826395024790,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50730,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.433558+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50742,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.856064+0000\",\"flow_id\":1666768554415001,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50742,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.643993+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50748,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.066248+0000\",\"flow_id\":1231007614963919,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50748,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.856271+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50756,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.278609+0000\",\"flow_id\":2249174709699417,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50756,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.066393+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50764,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.490547+0000\",\"flow_id\":427028391936309,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50764,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.278837+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50778,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.703580+0000\",\"flow_id\":372997703367918,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50778,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.490734+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50786,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.916646+0000\",\"flow_id\":1311207539392673,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50786,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.704673+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:01Z","timestamp":1774996381,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50788,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:01.128500+0000\",\"flow_id\":252173830913387,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50788,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.916843+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:32:58.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:32:59 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1342,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text","md5":"10f02192f2230fdf70169b14a01331d5","sha1":"4c590a5b361b7da8d459ab1c87ff8ea9493c639e","sha256":"5e91e66ff266b0812cbd93f31a5870455f3dfb05a609033e812714c194ff0d33","sha512":"902bbd3e2fba525d321f44246b1c749d1db43d14b4b9e92b42af3a45bddef5348efaac524ba532b32509befa192722607dd2e538fc8f36be20079b6e47e9a987","ssdeep":"","tlshash":"12211f8815e151a200f339789bbf8718e5b5140b2007cef13c6c16805fa153ad6e4bb6","first_seen":"2026-03-31T22:33:26.545657Z","last_seen":"2026-03-31T22:33:26.545657Z","times_seen":1,"resource_available":true,"data":null}},"time_used":551,"timings":{"blocked":221,"dns":1,"connect":105,"send":0,"wait":106,"receive":0,"ssl":115},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/favicon.ico","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:32:59.008Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":3919,"timings":{"blocked":0,"dns":1908,"connect":2011,"send":1906,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.897881+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":6,\"bytes_toserver\":1399,\"bytes_toclient\":3788,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50670,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.110718+0000\",\"flow_id\":572348610229257,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50670,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:57.898057+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50682,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.322693+0000\",\"flow_id\":1895739703341374,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50682,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.110910+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.533149+0000\",\"flow_id\":1431655602122018,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50698,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.322850+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.745135+0000\",\"flow_id\":1294798616666917,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50704,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.533285+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:58Z","timestamp":1774996378,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50706,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:58.957053+0000\",\"flow_id\":1792445739851632,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50706,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":5,\"pkts_toclient\":3,\"bytes_toserver\":765,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:58.745328+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.8","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":48328,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.221695+0000\",\"flow_id\":1095789159591478,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48328,\"dest_ip\":\"172.237.146.8\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.011830+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50716,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.433425+0000\",\"flow_id\":1934907657642649,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50716,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.221849+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50730,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.643583+0000\",\"flow_id\":1220826395024790,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50730,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.433558+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:59Z","timestamp":1774996379,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50742,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:59.856064+0000\",\"flow_id\":1666768554415001,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50742,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.643993+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50748,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.066248+0000\",\"flow_id\":1231007614963919,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50748,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:32:59.856271+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50756,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.278609+0000\",\"flow_id\":2249174709699417,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50756,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.066393+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50764,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.490547+0000\",\"flow_id\":427028391936309,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50764,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.278837+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50778,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.703580+0000\",\"flow_id\":372997703367918,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50778,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.490734+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:00Z","timestamp":1774996380,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50786,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:00.916646+0000\",\"flow_id\":1311207539392673,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50786,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.704673+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:33:01Z","timestamp":1774996381,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50788,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:33:01.128500+0000\",\"flow_id\":252173830913387,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50788,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":699,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:33:00.916843+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:33:02.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:33:02 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:33:14.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=nagoya-covid19vaccine.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:33:14 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","fqdn":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","domain":"nagoya-covid19vaccine.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-31T22:32:54.196Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T13:47:07.33171Z","times_seen":13377129,"resource_available":true,"data":null}},"time_used":509,"timings":{"blocked":509,"dns":0,"connect":105,"send":0,"wait":0,"receive":0,"ssl":-1},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.233.219.123","port":80,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":48056,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.395404+0000\",\"flow_id\":1372855352284283,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":48056,\"dest_ip\":\"172.233.219.123\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":588,\"bytes_toclient\":3737,\"start\":\"2026-03-31T22:32:57.185467+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:32:57Z","timestamp":1774996377,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":50662,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:32:57.697770+0000\",\"flow_id\":787148514619502,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":50662,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":708,\"bytes_toclient\":3722,\"start\":\"2026-03-31T22:32:57.487534+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"router.parklogic.com/","fqdn":"router.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.234.216.100","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/","date":"2026-03-31T22:32:58.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"router.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 20:53:35 GMT","end":"Tue, 12 May 2026 20:53:34 GMT"},"fingerprint":{"sha1":"EF:9C:13:C7:1C:95:AE:D1:E3:3F:94:74:D9:21:40:F2:8F:AF:FA:E1","sha256":"F7:D6:65:C2:2C:7C:63:95:4F:00:7E:B1:70:8B:64:AF:C0:18:5A:EE:DD:4C:F5:7A:8C:12:C5:D8:D6:21:78:10"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: router.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 480\r\nOrigin: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":480,"data":"{\"parameters\":{\"regionName\":\"Oslo County\",\"timezoneGeo\":\"Europe/Oslo\",\"city\":\"Oslo\",\"tenant\":\"shared\",\"continent\":\"EU\",\"uuid\":\"595b3ea007fe5da2eccd6bb96de897e9\",\"continentName\":\"Europe\",\"path\":\"/\",\"country\":\"NO\",\"countryName\":\"Norway\",\"domainApex\":\"nagoya-covid19vaccine.com\",\"domainFull\":\"cdek.yandex.www.pay.stage.nagoya-covid19vaccine.com\",\"ipOrig\":\"91.90.42.154\",\"protocol\":\"http\",\"region\":\"03\",\"adBlockingDetected\":false,\"timezoneBrowser\":\"UTC\",\"webdriver\":false,\"gpu\":null}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:32:58 GMT\r\ncontent-type: text/html; charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8051,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"8549f8e4c467c03250a4f227dd4ef653","sha1":"964d5a022396a71e7dd00eea4c8eb8c51db02c27","sha256":"3553c387f34000a1d811de03cd3d197f91662565dfb3d2eb88c217d436d08f7b","sha512":"684a0342472b20912b96ce05cbc3ec34eef20f43cb3e526c4b3af99e31a91cc932f0412539113b3d14a756766977bd9a4cab8ff668836aa8788fb2dc73c9ab43","ssdeep":"192:XXBryl3b01g6E+/Oi7tFoQnLnMk92rusaqCic0no:Xtao","tlshash":"1cf1855055fb100a2487e475a770d39e526bd287ee4bca1d3b9d0388cfcadc1c8e36a9","first_seen":"2026-03-31T22:33:26.551921Z","last_seen":"2026-03-31T22:33:26.551921Z","times_seen":1,"resource_available":false,"data":null}},"time_used":886,"timings":{"blocked":222,"dns":1,"connect":105,"send":0,"wait":442,"receive":0,"ssl":113},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}