| download.trafficland.com/ |  16.182.101.69 | | 107 B |
URL download.trafficland.com/ IP16.182.101.69:0
File typeHTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hash9d2a751959d3379e658a785c065ac6b8 17c2d5e472c321b524a3f63052aa6822bd4f8440 b4ce3f27ed2279663959e0ed5388d44fe6d5978862a27da0ad90a6c26589243e
GET / HTTP/1.1
Host: download.trafficland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: jttUXQCRmoxODpgVxDfreGZaIwH7Ozzg6Lwh+Gnj3bcZBzl2SmV7SyqdzNcKeYj0kzv3oKv6jBI=
x-amz-request-id: 5X72ZWJAJE284BPE
Date: Sat, 02 Dec 2023 13:25:56 GMT
Last-Modified: Thu, 19 Nov 2015 16:55:42 GMT
ETag: "9d2a751959d3379e658a785c065ac6b8"
Content-Type: text/html
Server: AmazonS3
Content-Length: 107
|
| GET download.trafficland.com/vmc/admin/install/Application%20Files/Vmc_4_01_05_00/Common.dll.deploy | 54.231.196.13 | 200 OK | 211 kB |
URL User Request GET HTTP/1.1download.trafficland.com/vmc/admin/install/Application%20Files/Vmc_4_01_05_00/Common.dll.deploy IP54.231.196.13:80
File typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows\012- data Size211 kB (210944 bytes) Hashf1c8bd2c2e522faf956b32d9aef9d6e8 3d7180bbaf7c0750191845a26c1d569308996db8 4b40f52e6f52baa72c05b294988337827cd55b5393a077c2dfccceeb4a95ca5f
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET POLICY Executable served from Amazon S3 | | suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP |
GET /vmc/admin/install/Application%20Files/Vmc_4_01_05_00/Common.dll.deploy HTTP/1.1
Host: download.trafficland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: u1yfzuhs4aR+2DHFjjpCUzJDEvbQEGI3B7QWgPiByCOw6YVCxGDKK0GLKbSCYKUw3a/8ZjD2VL8=
x-amz-request-id: GPA3WCNE7QE61V2B
Date: Sat, 02 Dec 2023 13:25:57 GMT
Cache-Control: public, max-age=864000
x-amz-meta-hashtag: f1c8bd2c2e522faf956b32d9aef9d6e8
Last-Modified: Sat, 02 Dec 2023 04:45:22 GMT
ETag: "f1c8bd2c2e522faf956b32d9aef9d6e8"
Content-Type: application/octet-stream
Server: AmazonS3
Content-Length: 210944
|