{"report_id":"bc6f9323-c106-4e8a-86ea-b2489433aa0d","version":6,"status":"done","tags":[],"date":"2025-06-08T21:42:03Z","url":{"schema":"http","addr":"server9.cdneurop.cloud/","fqdn":"server9.cdneurop.cloud","domain":"cdneurop.cloud","tld":"cloud"},"ip":{"addr":"52.11.240.239","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-17T21:42:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"server9.cdneurop.cloud","ip":{"addr":"52.11.240.239","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2022-10-27","domain_rank":0,"first_seen":"2022-10-29T00:16:02Z","last_seen":"2023-06-01T12:22:39Z","alert_count":0,"request_count":1,"received_data":148,"sent_data":491,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"","description":"","date":"2025-06-08T21:41:41Z","timestamp":1749418901,"ip_dst":{"addr":"52.11.240.239","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.3","port":35758,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"high","alert":"ET MALWARE Observed Glupteba CnC Domain (cdneurop .cloud in TLS SNI)","source":"{\"timestamp\":\"2025-06-08T21:41:41.436026+0000\",\"flow_id\":1496478335165796,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":35758,\"dest_ip\":\"52.11.240.239\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2043038,\"rev\":1,\"signature\":\"ET MALWARE Observed Glupteba CnC Domain (cdneurop .cloud in TLS SNI)\",\"category\":\"Domain Observed Used for C2 Detected\",\"severity\":1,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2022_12_28\"],\"deployment\":[\"Perimeter\"],\"malware_family\":[\"Glupteba\"],\"mitre_tactic_id\":[\"TA0011\"],\"mitre_tactic_name\":[\"Command_And_Control\"],\"mitre_technique_id\":[\"T1071\"],\"mitre_technique_name\":[\"Application_Layer_Protocol\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_12_12\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2022_12_28\"]}},\"tls\":{\"sni\":\"server9.cdneurop.cloud\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3640,\"start\":\"2025-06-08T21:41:40.976228+0000\"}}"}]}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"server9.cdneurop.cloud/","fqdn":"server9.cdneurop.cloud","domain":"cdneurop.cloud","tld":"cloud"},"ip":{"addr":"52.11.240.239","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-06-08T21:41:40.855Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"server8.cdneurops.shop","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 May 2025 23:04:36 GMT","end":"Tue, 19 Aug 2025 23:04:35 GMT"},"fingerprint":{"sha1":"09:28:25:E3:3D:82:94:F3:43:E9:7F:69:40:DB:BC:0C:2F:48:94:81","sha256":"DD:4F:F0:9D:B4:EC:5A:7F:A5:E6:28:EC:04:A1:E6:A3:1B:06:B6:6C:F5:1D:45:04:DE:4B:B3:34:87:2A:C3:B5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: server9.cdneurop.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET","post_data":{"size":2180,"data":"{\"sensor_data\":\"3;0;1;0;4339253;2BnBse7ChZ3lkLwjyZWVSGm9ahkz9CkE+l1z++AL5VY=;42,109,0,1,13,385;F4$p\\\"QD;%\\\"8OB7Bf#R=\\\"Qx\\\"e\\\"\\\"j\\\"!Nd\\\"^M*F|\\\"l`\\\"Xs83..N!\\\"7k\\\"uO+G_\u0026H\\\"Y2MY4xNb3tUq^i_LIMsT|iv:KO%}N)M!3DJ~A/^po,;`\\\"j\\\"n$R\\\"vU6.\u0026\\\"H9-A\\\"E8joqK1\\\"\\\"L\\\"EKO\\\"4\\\"\\\"h\\\"@:~\\\"-*isP\\\"]y-\\\"8\\\"lZio*5O^mag\\\"`w{\\\"ydJ\\\"s\\\"_sOO\\\"I\\\"N+r\\\"1=2cm\\\"5;\u003e\\\"M}x5i\\\"3 I\\\"Z\\\"upzMUPIHLcuHC\\\"Bvq\\\"/4i\\\":\\\"2ah[9:[*0!2M#GRp#;9G3Ka9;2*KaRrx3kpm}!Q/J94FbqJ7wY[\\\"A\\\"fQ^\\\"nz^Rr8~UeX\\\"q/L\\\",\\\"45luQv#20hV/W\\\"b#4\\\"v~^\\\"e^[#.\\\"^dn\\\"B\\\"[+\u0026x\\\"3r5\\\"4mG\\\"K[],}SF3~43\\\"YuHQaMG|FQNb~d(z?:V?Myr{D{pd+1o{Uh=Uu\\\"`\\\"Q]T\\\"dGqD5\u0026Y7VUX8k\\\",@F\\\"x8!\\\"?HwqyS/;B[%_\\\"{`L$\\\"U{+7x^IQw\\\"Z*S\\\"0:cBCW-\u003cT#?bo\\\"~y^\\\"Not4b\\\"TT,E\\\"lMxc{2QL\\\"j \\\";\\\"\\\"3\\\"b]?\\\"/]n\u0026tFh^\\\"S?r\\\"U,8!#\\\"gNp\\\"?jgDK?J wZ8_wL?N\\\"0TL\\\"4\\\"SrQk(r`%\\\"oYF\\\":u1\\\"Nyj,J$!;\\\"*E@\\\"=\\\"b\\\"b\u0026:\\\"\u0026\u003cT\\\"]\\\"$=8\u003e\u003ec\\\"\\\"3pa\\\"mvl\\\"c\\\"3\\\"d;y\\\"ECO\\\"o\\\"3I7PB]MgH4f\\\"+1H\\\"Pu%\\\"6\\\"\\\"L\\\"FVp\\\"k\\\"\\\"m\\\"Kvi\\\"]\\\"\\\"C\\\"z$5\\\"Q?rs]\\\"EF3\\\"m\\\"8\u003c\\\"::+\\\"6N[\\\"E\\\"\\\"\u003c\\\".5H\\\"o]PSGB\u003c/\\\"Y5{\\\"M\\\"W\\\"\u003eDr\\\"2(\\\"F3~s9\\\"O+cO\\\" \\\"!\\\"s\u003e^N\\\"\\\"4{Y\\\"@j!\\\"|\\\"rQ:^m\\\"Of@\\\"Z^jcI\\\"Yk\u003c\\\"@R%c\\\"s\\\"\\\"G\\\"rCh\\\"K%.\\\"~=x\\\"0\\\"NxB3OSGPDY{cE,L}/c9d($2oo^{B7kJ^pDot|m: {%8.DUdxIx\\\"Y+]k\\\"@*ItV\\\"IK[w\\\"|,\\\"2tn\\\".\\\"\\\"x6Z\\\"Q2f\\\":8_(|bR\\\"\\\"=\\\"[a1\\\"A\\\"VD=rH?8TyU{`2\\\"A\\\"+\u003eJ\\\"AoZ\u003cU_[\\\"`2Yw=\\\"6 C\\\"-dx\\\"bC|7#N n\\\"=)xL:\\\"A{,\\\"o@m\\\"L\\\",\\\"]o,\\\"-_S\\\"PtW{\u003e\\\"T8f\\\"2Pn7d4\\\"#@.\\\"J\\\"\\\"b\\\"9I@\\\"C\\\"\\\"D\\\"@/z\\\"L\\\"62\\\"s`w\\\" [gK\\\"+j\u003ccY\\\"`G\\\"X\u003e!m[\\\"N`0f\\\"08p(jFqR1\\\"t.;|;\\\"gpb\\\"8;$\\\"?\\\"^\\\"TqU\\\"Wr)\\\"pE$pF\\\"6ElV\\\":\\\"\\\"P:L\\\"9C-\\\"(\\\",Pyg2@FOHuF$AkHgLD!O uIG\u0026H+Q\u0026Rlyuf4VX;SQ!*e`/9\\\"3eR\\\"i0s\\\"\u003e\\\"\\\"-\\\"#-\\\"3Xp k\\\"U-\\\"6upDW1,@jVLmsaOKCP(\\\"6J0%W0/9\\\" \\\"7,z\\\"@\\\"\\\"d\\\"MFV\\\"+HZ\\\"Ut5\\\"y\\\"*yU.ACoF7!!n}{xhZ+iq\\\"H\\\"bdp\\\"s\\\"\\\"?dP\\\"xEi\\\"w\\\"@3\\\"xF \\\"ffJ\\\"c\\\"K(=/M@}\u003efx6{;udx+\\\"A\\\"n|}\\\"`d]f?n-2\\\"]gf\\\"a7L|=YQoS5Sp`B$\u0026:\\\"EDk\\\"0\\\"}@SOAiFz$l7#}?Ph_\\\"!\\\"dLe\\\"G\\\"an05\u003c p=QM4OY\\\"8y=\\\"~[.\\\";.Pq`7`O\\\"_4J\\\"?\\\".\\\"3sS\\\"_dQ\\\"xCy+tq\\\"$sJk\\\"{4:Sl0\\\"[k|uX7r\\\"$CR\\\"Lz_\\\"2\\\"\\\"I\\\"{]y\\\"?Ogs6f/@TnXe,u0o:[XhT:{=0D1p%b37LThF}8U|~XOg?dhQ-@,gj0$ePq~xu[%$/RpI IDOe\u003c,?{^]lAt{D?xd\u003c+cC1Y.#UCEt]/n%y#Yi5M;ZlL/N216{w[8^x/vYd0a~Wa[~i5tf)tZvnBfb:3%+gZD$iXFAVe`w\\\"@\\\"I/q\\\"s.xv34#Y\\\"1+z\\\"G\\\"u\\\"m8~\\\"z6o\\\"[\\\"-l\\\"y[d\\\"t[1T\\\"JG2@=I704?[72Mf\u0026eA\u003e|nX:;D`\u0026yyP9\u0026mpk}\\\"w!v\\\"G|5\\\"j\\\"wsB@^\\\"@8v^\\\"@\\\"tV,\\\"8=5KP`ak\\\"DY/\\\"\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 08 Jun 2025 21:41:41 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T08:24:35.506294Z","times_seen":18439249,"resource_available":true,"data":null}},"time_used":1406,"timings":{"blocked":589,"dns":121,"connect":227,"send":0,"wait":227,"receive":0,"ssl":238},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}