{"report_id":"5da58d83-7022-43a2-8885-7ae0c2c3cfa3","version":6,"status":"done","tags":[],"date":"2023-11-13T04:01:14Z","url":{"schema":"http","addr":"cert-agid.gov.it/download/log4shell-iocs.txt","fqdn":"cert-agid.gov.it","domain":"cert-agid.gov.it","tld":"gov.it"},"ip":{"addr":"93.147.186.162","port":0,"asn":30722,"as":"Vodafone Italia S.p.A.","country":"Italy","country_code":"IT"},"final":{"url":{"schema":"https","addr":"cert-agid.gov.it/download/log4shell-iocs.txt","fqdn":"cert-agid.gov.it","domain":"cert-agid.gov.it","tld":"gov.it"},"title":"cert-agid.gov.it/download/log4shell-iocs.txt"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-26T14:10:14Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"default"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"cert-agid.gov.it","ip":{"addr":"93.147.186.162","port":0,"asn":30722,"as":"Vodafone Italia S.p.A.","country":"Italy","country_code":"IT"},"domain_registered":"2022-07-07","domain_rank":0,"first_seen":"2020-07-15 10:08:09","last_seen":"2023-10-24 11:44:31","alert_count":3,"request_count":2,"received_data":962510,"sent_data":954,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2023-11-13","alert":"Detects JNDI Exploit Kit patterns in files","trigger":"cert-agid.gov.it/download/log4shell-iocs.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2021-12-12","description":"Detects JNDI Exploit Kit patterns in files","reference":"https://github.com/pimps/JNDI-Exploit-Kit","rule":"EXPL_JNDI_Exploit_Patterns_Dec21_1","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2023-11-13","alert":"Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228","trigger":"cert-agid.gov.it/download/log4shell-iocs.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2021-12-10","description":"Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228","modified":"2021-12-13","reference":"https://twitter.com/Reelix/status/1469327487243071493","rule":"SUSP_Base64_Encoded_Exploit_Indicators_Dec21","score":"70"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2023-11-13","alert":"Detects indicators of JDNI usage in log files and other payloads","trigger":"cert-agid.gov.it/download/log4shell-iocs.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2021-12-10","description":"Detects indicators of JDNI usage in log files and other payloads","modified":"2021-12-12","reference":"https://github.com/flypig5211/JNDIExploit","rule":"SUSP_JDNIExploit_Indicators_Dec21","score":"70"}}]},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"cert-agid.gov.it/download/log4shell-iocs.txt","fqdn":"cert-agid.gov.it","domain":"cert-agid.gov.it","tld":"gov.it"},"ip":{"addr":"93.147.186.162","port":0,"asn":30722,"as":"Vodafone Italia S.p.A.","country":"Italy","country_code":"IT"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2023-11-13T04:00:57.84478668Z","timestamp":1699848057844,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /download/log4shell-iocs.txt HTTP/1.1\r\nHost: cert-agid.gov.it\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Mon, 13 Nov 2023 04:00:57 GMT\r\nContent-Type: text/plain\r\nContent-Length: 959618\r\nLast-Modified: Fri, 14 Oct 2022 09:25:26 GMT\r\nConnection: keep-alive\r\nETag: \"63492b06-ea482\"\r\nX-Frame-Options: SAMEORIGIN\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nAccept-Ranges: bytes\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":959618,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"JSON data\\012- , ASCII text","md5":"431b6bbf92fbe5bfc742f297bf19f6e7","sha1":"3593b7c0cf8c6ee9cff479c6e0e3c5b57a0f6da5","sha256":"01eb3542e9e6aa0887cd60d90c3f385adb481aa55b8b54e78b2541e130c84f50","sha512":"64baa37a6dd0c260f58becabe3eb396d6095b0ee5db1b3331bdc28ecd16a1b6034c87f57e8b1da145ef1a5d2850862ddedaf8f5a3cf5b0b0305f3cdf96668605","ssdeep":"3072:hc3vUy8fzH8WlkJT42T8sWOEL6D7ZyRytVwjo8MK:a3vUyeZawjo8MK","tlshash":"d81541a4d6101fd45e8cc49e710d5490248a55a38c82f2cabbef264e2f1c19f7ef9b5e","first_seen":"2023-10-14T05:55:56Z","last_seen":"2024-08-21T04:46:13.697738Z","times_seen":4,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2023-11-13","alert":"Detects JNDI Exploit Kit patterns in files","trigger":"cert-agid.gov.it/download/log4shell-iocs.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2021-12-12","description":"Detects JNDI Exploit Kit patterns in files","reference":"https://github.com/pimps/JNDI-Exploit-Kit","rule":"EXPL_JNDI_Exploit_Patterns_Dec21_1","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2023-11-13","alert":"Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228","trigger":"cert-agid.gov.it/download/log4shell-iocs.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2021-12-10","description":"Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228","modified":"2021-12-13","reference":"https://twitter.com/Reelix/status/1469327487243071493","rule":"SUSP_Base64_Encoded_Exploit_Indicators_Dec21","score":"70"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2023-11-13","alert":"Detects indicators of JDNI usage in log files and other payloads","trigger":"cert-agid.gov.it/download/log4shell-iocs.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2021-12-10","description":"Detects indicators of JDNI usage in log files and other payloads","modified":"2021-12-12","reference":"https://github.com/flypig5211/JNDIExploit","rule":"SUSP_JDNIExploit_Indicators_Dec21","score":"70"}}],"urlquery":null}},{"url":{"schema":"http","addr":"cert-agid.gov.it/favicon.ico","fqdn":"cert-agid.gov.it","domain":"cert-agid.gov.it","tld":"gov.it"},"ip":{"addr":"93.147.186.162","port":0,"asn":30722,"as":"Vodafone Italia S.p.A.","country":"Italy","country_code":"IT"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2023-11-13T04:00:57.917098237Z","timestamp":1699848057917,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cert-agid.gov.it\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cert-agid.gov.it/download/log4shell-iocs.txt\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Mon, 13 Nov 2023 04:00:57 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 2238\r\nLast-Modified: Mon, 20 Apr 2020 08:09:19 GMT\r\nConnection: keep-alive\r\nETag: \"5e9d58af-8be\"\r\nX-Frame-Options: SAMEORIGIN\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nAccept-Ranges: bytes\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":2238,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel\\012- data","md5":"089f393733f65ae81cc06fd2eebad812","sha1":"9fb291ce00f0cad86e1fe7e35eac0b3c18c17828","sha256":"21fbda558e170e162752f486c6db8753ca366ef4f6d8e95cc2768664e134240c","sha512":"2ef11503abcb6cefc999be1066d913fa28cb30e9dc4d8b5d67260252c98051c71f7e764fe11874991288606ab60ff124333941f694aa62ecb5a8e2ccaab91901","ssdeep":"","tlshash":"","first_seen":"2023-10-14T05:55:56Z","last_seen":"2024-08-21T04:46:13.698905Z","times_seen":4,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}