{"report_id":"7e0ba7b2-deca-4b26-8831-23673909d497","version":6,"status":"done","tags":[],"date":"2026-03-31T22:37:00Z","url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"172.237.146.25","port":0,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"title":"Redirecting...","dom":{"size":7891,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e606562f3eaf575d1e4e311e2a1d0fc9","sha1":"8cf6ee90ea03706bc356fe0b5095820b0cd40b62","sha256":"4ea4a7393e17cf7e51e21013a90ad35ac0ef171a518bda6bbabc0d125665f909","sha512":"1961c1fdd953c73e913f1ecfafc8277f331a4d5a8a336d56db8eebeb34bf9172f8001269535169f682b6ad6e514cfb1bff5a4b238042f262498f73137ea23a6e","ssdeep":"192:JhBryl3b01g6E+/Oi7tFoQnLnMk92rusaqCiSlkIkpkmkAkekuikIkRkD6:Jz76","tlshash":"3af143a158fb000735839415ab71a39f5695d253ed07d9493a8d4b8c8fcfe99cce32a8","dom_hash":"domhash178fb39a46bb38c1b59dad0ed8caaebf","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"172.237.146.25","port":0,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-05T22:37:00Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":22,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:38Z","timestamp":1774996598,"ip_dst":{"addr":"172.237.146.25","port":443,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":52546,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:38.397706+0000\",\"flow_id\":1706486278831140,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":52546,\"dest_ip\":\"172.237.146.25\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029707,\"rev\":9,\"signature\":\"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_28\"]}},\"tls\":{\"sni\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":942,\"bytes_toclient\":957,\"start\":\"2026-03-31T22:36:38.179236+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":43092,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.013821+0000\",\"flow_id\":41548649087443,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":43092,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":577,\"bytes_toclient\":3692,\"start\":\"2026-03-31T22:36:40.803283+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":443,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":52554,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.086043+0000\",\"flow_id\":1029833508667792,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":52554,\"dest_ip\":\"172.237.146.25\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029707,\"rev\":9,\"signature\":\"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_28\"]}},\"tls\":{\"sni\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"version\":\"UNDETERMINED\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":2,\"bytes_toserver\":789,\"bytes_toclient\":140,\"start\":\"2026-03-31T22:36:38.410000+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.328256+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":697,\"bytes_toclient\":1654,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.543495+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":6,\"bytes_toserver\":1366,\"bytes_toclient\":3759,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58692,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.755768+0000\",\"flow_id\":1615057162685448,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58692,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.543752+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.968708+0000\",\"flow_id\":1329091797682400,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58698,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.755936+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.178848+0000\",\"flow_id\":153228536301804,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58704,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.968940+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.390928+0000\",\"flow_id\":370601126181749,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58718,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.179061+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58724,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.603058+0000\",\"flow_id\":1896467714996219,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58724,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.391163+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58740,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.812846+0000\",\"flow_id\":1796693477176475,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58740,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.603291+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58748,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.022761+0000\",\"flow_id\":2194029491677118,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58748,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.812990+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58762,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.409147+0000\",\"flow_id\":622221785235813,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58762,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.196965+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58772,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.620876+0000\",\"flow_id\":133239758601933,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58772,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.409293+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58782,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.834818+0000\",\"flow_id\":1402235090860599,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58782,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.621111+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58786,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.047050+0000\",\"flow_id\":186667004313063,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58786,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.835047+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58792,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.258876+0000\",\"flow_id\":422428496672871,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58792,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.047207+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58800,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.471292+0000\",\"flow_id\":1935642111833104,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58800,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.259088+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58806,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.683363+0000\",\"flow_id\":1233445023658480,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58806,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.471536+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58822,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.895802+0000\",\"flow_id\":564177449807433,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58822,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.683593+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:45Z","timestamp":1774996605,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58824,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:45.108510+0000\",\"flow_id\":1207265050536987,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58824,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.896027+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:45Z","timestamp":1774996605,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":58826,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:45.318287+0000\",\"flow_id\":1320353686988942,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58826,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:45.108686+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.ozon.blablacar.covid19.mitrasbf.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2022-07-15","domain_rank":0,"first_seen":"2026-03-31T22:37:00.204763Z","last_seen":"2026-03-31T22:37:00.204763Z","alert_count":44,"request_count":4,"received_data":5596,"sent_data":1744,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"router.parklogic.com","ip":{"addr":"172.234.216.100","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"domain_registered":"2007-02-28","domain_rank":346495,"first_seen":"2025-03-19T10:23:50.028513Z","last_seen":"2026-03-30T03:36:29.844204Z","alert_count":0,"request_count":1,"received_data":8041,"sent_data":548,"comment":"","tags":null,"fingerprints":null},{"fqdn":"parking3.parklogic.com","ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"domain_registered":"2007-02-28","domain_rank":497061,"first_seen":"2023-05-10T10:50:24Z","last_seen":"2026-03-30T12:55:28.309731Z","alert_count":0,"request_count":4,"received_data":1933,"sent_data":2101,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d191b93239ac2b340a2ba1c82ee5e6d0","sha1":"b56be9980d2f586bd9954d5ee7493defd2bcb8ce","sha256":"62e65154e4fd0b1f0d590621ff70f83d4b9e4d4ca1de94c879e3531a07ddd934","sha512":"974dd5a8b7596a2a49e704e472af5020945356139d383f9ea1f0b36a3bf2fde0039c14a327daf9327e1b20193996ef0ece1fb56a9984e2e8e5e4e0f192ebab2c","ssdeep":"96:ItDJYtoAJS8ffKH1NPIX4rDJcs01cq4o5nZ2QxZ0TctK21epKED7B6YR:IVJYtoA1ffqzr/Jcs0Bbf51ego7R","tlshash":"bc911971b386303a4be115ea957ba728b23f921434078062d7aefcd13c2099b40d7f99","size":4570,"data":"","first_seen":"2026-03-31T22:37:09.433174Z","last_seen":"2026-03-31T22:37:09.433174Z","times_seen":1,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":43092,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.013821+0000\",\"flow_id\":41548649087443,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":43092,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":577,\"bytes_toclient\":3692,\"start\":\"2026-03-31T22:36:40.803283+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.328256+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":697,\"bytes_toclient\":1654,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=mitrasbf.com","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"619ca239e8d073f6a125a352ef0c75a2","sha1":"0854a273fbe300e18ad4425d004b08a225ad3768","sha256":"2f46333f9ca16aa418351eb7b328aa7f165733dcaaeff174508b6f0d62926b9f","sha512":"fc81b88cb4da13bae1040b45c7780ff5614f903451df5b43a445381a356e75c5248c35e4f2f732cc82d6368afaef92ecb67f895909bff0afb36e29da4f915408","ssdeep":"","tlshash":"bc21ef8815e151a200f375789bbf8618e575540b2106cef17c6c19805fa113ad6e4ab6","size":1329,"data":"","first_seen":"2026-03-29T14:20:13.728488Z","last_seen":"2026-03-31T22:37:09.427458Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-31T22:36:37.817Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: cdek.ozon.blablacar.covid19.mitrasbf.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T14:47:06.668895Z","times_seen":13379084,"resource_available":true,"data":null}},"time_used":593,"timings":{"blocked":593,"dns":0,"connect":110,"send":0,"wait":0,"receive":0,"ssl":-1},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":43092,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.013821+0000\",\"flow_id\":41548649087443,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":43092,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":577,\"bytes_toclient\":3692,\"start\":\"2026-03-31T22:36:40.803283+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.328256+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":697,\"bytes_toclient\":1654,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.ozon.blablacar.covid19.mitrasbf.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-31T22:36:41.115Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: cdek.ozon.blablacar.covid19.mitrasbf.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Tue, 31 Mar 2026 22:36:41 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-store, max-age=0\r\nAccept-CH: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64\r\nPermissions-Policy: ch-ua=(self \"https://*.parklogic.com\"), ch-ua-arch=(self \"https://*.parklogic.com\"), ch-ua-bitness=(self \"https://*.parklogic.com\"), ch-ua-full-version=(self \"https://*.parklogic.com\"), ch-ua-full-version-list=(self \"https://*.parklogic.com\"), ch-ua-mobile=(self \"https://*.parklogic.com\"), ch-ua-model=(self \"https://*.parklogic.com\"), ch-ua-platform=(self \"https://*.parklogic.com\"), ch-ua-platform-version=(self \"https://*.parklogic.com\"), ch-ua-wow64=(self \"https://*.parklogic.com\")\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4665,"size_decoded":0,"mime_type":"text/html","magic":"JavaScript source, ASCII text, with very long lines (4665), with no line terminators","md5":"7bb219c80c696362d77f6acdae3a27d8","sha1":"9c813a8579f5d1544a84bb3f9a9806e36934e74f","sha256":"2e612fabe2274d2ed88efb29888920163e5879a35c1bb0f75ac8ad3d01b6c285","sha512":"4398bef93fc9add6c92bc95c80fd97c1b02d179132b6f2750b78dd00a934a95dc9f9861eb5c1ccf4e7815cf647af0293d27a876a25c18efa936e0d4f33650a70","ssdeep":"96:nItDJYtoAJS8ffKH1NPIX4rDJcs01cq4o5nZ2QxZ0TctK21epKED7B6YI:IVJYtoA1ffqzr/Jcs0Bbf51ego7I","tlshash":"06a11a75b786303e9be015ea947ba76c763e921434078062d7aefcd13c2099b80d7f99","first_seen":"2026-03-31T22:37:09.415675Z","last_seen":"2026-03-31T22:37:09.415675Z","times_seen":1,"resource_available":true,"data":null}},"time_used":321,"timings":{"blocked":107,"dns":1,"connect":106,"send":0,"wait":106,"receive":1,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.38","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":43092,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.013821+0000\",\"flow_id\":41548649087443,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":43092,\"dest_ip\":\"172.237.146.38\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":577,\"bytes_toclient\":3692,\"start\":\"2026-03-31T22:36:40.803283+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.328256+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":517},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":697,\"bytes_toclient\":1654,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.ozon.blablacar.covid19.mitrasbf.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"router.parklogic.com/","fqdn":"router.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.234.216.100","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:41.646Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"router.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 20:53:35 GMT","end":"Tue, 12 May 2026 20:53:34 GMT"},"fingerprint":{"sha1":"EF:9C:13:C7:1C:95:AE:D1:E3:3F:94:74:D9:21:40:F2:8F:AF:FA:E1","sha256":"F7:D6:65:C2:2C:7C:63:95:4F:00:7E:B1:70:8B:64:AF:C0:18:5A:EE:DD:4C:F5:7A:8C:12:C5:D8:D6:21:78:10"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: router.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 456\r\nOrigin: http://cdek.ozon.blablacar.covid19.mitrasbf.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":456,"data":"{\"parameters\":{\"domainFull\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"ipOrig\":\"91.90.42.154\",\"protocol\":\"http\",\"region\":\"03\",\"regionName\":\"Oslo County\",\"path\":\"/\",\"uuid\":\"258afbb269bb6570fe365cfc780fda9d\",\"city\":\"Oslo\",\"tenant\":\"shared\",\"continent\":\"EU\",\"timezoneGeo\":\"Europe/Oslo\",\"country\":\"NO\",\"continentName\":\"Europe\",\"countryName\":\"Norway\",\"domainApex\":\"mitrasbf.com\",\"adBlockingDetected\":false,\"timezoneBrowser\":\"UTC\",\"webdriver\":false,\"gpu\":null}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:36:42 GMT\r\ncontent-type: text/html; charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7895,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"b26ba2126d3e715688f4a3f14c7dcc4d","sha1":"6ac9c6566c1805381327c941aafa1cdf49f0ab5d","sha256":"e9af88e139dbe1f6c61ff5879c5506fb07b67b7d81486d08bb0848da0cb97927","sha512":"8381ddf169b9aadb363154a5bb55797088707ddd673cfcbb1d934159a8ed5b9519c0c91872dc23479eb1e2c9292d05d85f012ceb4fe5ca89849e36e685843bb4","ssdeep":"192:XXBryl3b01g6E+/Oi7tFoQnLnMk92rusaqCiUlkIkpkmkAkekuikIkRkDo:XtXo","tlshash":"22f143a158fb00073583d415ab71a39f5665d253ee07d9493a8d5b8c8fcbf89cce32a8","first_seen":"2026-03-29T14:20:13.72971Z","last_seen":"2026-03-31T22:37:09.423078Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1477,"timings":{"blocked":223,"dns":1,"connect":106,"send":0,"wait":1030,"receive":0,"ssl":114},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=mitrasbf.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:44.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=mitrasbf.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.ozon.blablacar.covid19.mitrasbf.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:36:44 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T14:47:06.668895Z","times_seen":13379084,"resource_available":true,"data":null}},"time_used":546,"timings":{"blocked":220,"dns":0,"connect":105,"send":0,"wait":106,"receive":0,"ssl":112},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=mitrasbf.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:46.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=mitrasbf.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.ozon.blablacar.covid19.mitrasbf.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:36:46 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T14:47:06.668895Z","times_seen":13379084,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/favicon.ico","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:41.438Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdek.ozon.blablacar.covid19.mitrasbf.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T14:47:06.668895Z","times_seen":13379084,"resource_available":true,"data":null}},"time_used":3066,"timings":{"blocked":106,"dns":1479,"connect":1374,"send":1481,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.543495+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":6,\"bytes_toserver\":1366,\"bytes_toclient\":3759,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58692,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.755768+0000\",\"flow_id\":1615057162685448,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58692,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.543752+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.968708+0000\",\"flow_id\":1329091797682400,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58698,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.755936+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.178848+0000\",\"flow_id\":153228536301804,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58704,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.968940+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.390928+0000\",\"flow_id\":370601126181749,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58718,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.179061+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58724,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.603058+0000\",\"flow_id\":1896467714996219,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58724,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.391163+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58740,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.812846+0000\",\"flow_id\":1796693477176475,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58740,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.603291+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58748,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.022761+0000\",\"flow_id\":2194029491677118,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58748,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.812990+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58762,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.409147+0000\",\"flow_id\":622221785235813,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58762,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.196965+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58772,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.620876+0000\",\"flow_id\":133239758601933,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58772,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.409293+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58782,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.834818+0000\",\"flow_id\":1402235090860599,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58782,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.621111+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58786,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.047050+0000\",\"flow_id\":186667004313063,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58786,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.835047+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58792,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.258876+0000\",\"flow_id\":422428496672871,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58792,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.047207+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58800,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.471292+0000\",\"flow_id\":1935642111833104,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58800,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.259088+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58806,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.683363+0000\",\"flow_id\":1233445023658480,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58806,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.471536+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58822,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.895802+0000\",\"flow_id\":564177449807433,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58822,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.683593+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:45Z","timestamp":1774996605,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58824,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:45.108510+0000\",\"flow_id\":1207265050536987,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58824,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.896027+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:45Z","timestamp":1774996605,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58826,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:45.318287+0000\",\"flow_id\":1320353686988942,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58826,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:45.108686+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.ozon.blablacar.covid19.mitrasbf.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=mitrasbf.com","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:42.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=mitrasbf.com HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:36:43 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1329,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text","md5":"619ca239e8d073f6a125a352ef0c75a2","sha1":"0854a273fbe300e18ad4425d004b08a225ad3768","sha256":"2f46333f9ca16aa418351eb7b328aa7f165733dcaaeff174508b6f0d62926b9f","sha512":"fc81b88cb4da13bae1040b45c7780ff5614f903451df5b43a445381a356e75c5248c35e4f2f732cc82d6368afaef92ecb67f895909bff0afb36e29da4f915408","ssdeep":"","tlshash":"bc21ef8815e151a200f375789bbf8618e575540b2106cef17c6c19805fa113ad6e4ab6","first_seen":"2026-03-29T14:20:13.728488Z","last_seen":"2026-03-31T22:37:09.427458Z","times_seen":2,"resource_available":true,"data":null}},"time_used":551,"timings":{"blocked":222,"dns":1,"connect":106,"send":0,"wait":107,"receive":0,"ssl":113},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cdek.ozon.blablacar.covid19.mitrasbf.com/favicon.ico","fqdn":"cdek.ozon.blablacar.covid19.mitrasbf.com","domain":"mitrasbf.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:43.194Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdek.ozon.blablacar.covid19.mitrasbf.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T14:47:06.668895Z","times_seen":13379084,"resource_available":true,"data":null}},"time_used":3932,"timings":{"blocked":0,"dns":1915,"connect":2016,"send":1911,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.543495+0000\",\"flow_id\":1753636430005451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58686,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":6,\"bytes_toserver\":1366,\"bytes_toclient\":3759,\"start\":\"2026-03-31T22:36:41.115915+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58692,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.755768+0000\",\"flow_id\":1615057162685448,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58692,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.543752+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:41Z","timestamp":1774996601,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58698,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:41.968708+0000\",\"flow_id\":1329091797682400,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58698,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.755936+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.178848+0000\",\"flow_id\":153228536301804,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58704,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:41.968940+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.390928+0000\",\"flow_id\":370601126181749,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58718,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.179061+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58724,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.603058+0000\",\"flow_id\":1896467714996219,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58724,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.391163+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:42Z","timestamp":1774996602,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58740,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:42.812846+0000\",\"flow_id\":1796693477176475,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58740,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.603291+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58748,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.022761+0000\",\"flow_id\":2194029491677118,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58748,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:42.812990+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58762,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.409147+0000\",\"flow_id\":622221785235813,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58762,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.196965+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58772,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.620876+0000\",\"flow_id\":133239758601933,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58772,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.409293+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:43Z","timestamp":1774996603,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58782,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:43.834818+0000\",\"flow_id\":1402235090860599,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58782,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.621111+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58786,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.047050+0000\",\"flow_id\":186667004313063,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58786,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:43.835047+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58792,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.258876+0000\",\"flow_id\":422428496672871,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58792,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.047207+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58800,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.471292+0000\",\"flow_id\":1935642111833104,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58800,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.259088+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58806,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.683363+0000\",\"flow_id\":1233445023658480,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58806,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.471536+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:44Z","timestamp":1774996604,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58822,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:44.895802+0000\",\"flow_id\":564177449807433,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58822,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.683593+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:45Z","timestamp":1774996605,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58824,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:45.108510+0000\",\"flow_id\":1207265050536987,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58824,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:44.896027+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-31T22:36:45Z","timestamp":1774996605,"ip_dst":{"addr":"172.237.146.25","port":80,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.9","port":58826,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-03-31T22:36:45.318287+0000\",\"flow_id\":1320353686988942,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":58826,\"dest_ip\":\"172.237.146.25\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029711,\"rev\":3,\"signature\":\"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_11\"]}},\"http\":{\"hostname\":\"cdek.ozon.blablacar.covid19.mitrasbf.com\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_refer\":\"http://cdek.ozon.blablacar.covid19.mitrasbf.com/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":677,\"bytes_toclient\":206,\"start\":\"2026-03-31T22:36:45.108686+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"cdek.ozon.blablacar.covid19.mitrasbf.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"parking3.parklogic.com/page/enhance.js?pcId=53\u0026domain=mitrasbf.com\u0026poll=true","fqdn":"parking3.parklogic.com","domain":"parklogic.com","tld":"com"},"ip":{"addr":"172.232.7.47","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://cdek.ozon.blablacar.covid19.mitrasbf.com/","date":"2026-03-31T22:36:50.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"parking3.parklogic.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 23:43:52 GMT","end":"Wed, 24 Jun 2026 23:43:51 GMT"},"fingerprint":{"sha1":"86:93:C9:4C:86:52:54:6E:D3:EF:5C:51:6C:42:D8:F9:03:F5:07:A7","sha256":"0A:F2:DB:FB:D6:09:74:EA:D5:99:C2:15:71:B4:FA:4A:F1:42:38:BB:B6:61:E4:37:4D:A9:DD:B6:E6:A2:50:64"}}},"request":{"raw":"GET /page/enhance.js?pcId=53\u0026domain=mitrasbf.com\u0026poll=true HTTP/1.1\r\nHost: parking3.parklogic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://cdek.ozon.blablacar.covid19.mitrasbf.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://cdek.ozon.blablacar.covid19.mitrasbf.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 31 Mar 2026 22:36:50 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T14:47:06.668895Z","times_seen":13379084,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}