| pkg-store.dl.mail.ru/packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll |  188.93.63.73 | 403 Forbidden | 153 B |
URL User Request GET HTTP/1.1pkg-store.dl.mail.ru/packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll IP188.93.63.73:80
File typeHTML document, ASCII text, with CRLF line terminators Hash7d6137132ff4e08f6848aee8c3ea20e8 911aff2cab5257318e3cb5474800451c8bd97184 58b8f5272e34abba64c14fcb6822083ff2a5ce6ef5a3a7a9ad591cfb22f89953
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING HTTP GET Request for newtonsoft.json.dll - Possible Infostealer Activity |
GET /packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll HTTP/1.1
Host: pkg-store.dl.mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
server: nginx/1.18.0
date: Fri, 18 Oct 2024 10:13:23 GMT
content-type: text/html
content-length: 153
X-Firefox-Spdy: h2
|
| pkg-store.dl.mail.ru/packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll | 188.93.63.73 | 403 Forbidden | 153 B |
URL User Request GET HTTP/1.1pkg-store.dl.mail.ru/packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll IP188.93.63.73:80
File typeHTML document, ASCII text, with CRLF line terminators Hash7d6137132ff4e08f6848aee8c3ea20e8 911aff2cab5257318e3cb5474800451c8bd97184 58b8f5272e34abba64c14fcb6822083ff2a5ce6ef5a3a7a9ad591cfb22f89953
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING HTTP GET Request for newtonsoft.json.dll - Possible Infostealer Activity |
GET /packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll HTTP/1.1
Host: pkg-store.dl.mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: nginx/1.18.0
Date: Fri, 18 Oct 2024 10:13:23 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive
|
| pkg-store.dl.mail.ru/favicon.ico | 188.93.63.73 | 404 Not Found | 265 B |
URL GET HTTP/1.1pkg-store.dl.mail.ru/favicon.ico IP188.93.63.73:80
Requested byhttp://pkg-store.dl.mail.ru/packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll
File typeHTML document, ASCII text Hash0326eb837e660f8a849f26a0b0d1d4dd 33e86ab54e1aa1b0454e2a8e0e0a2ba5e8e330a4 00fcdef2ad978ae5d653c537fdfd8dfeca8616667eea927a129f7238a7fc9122
GET /favicon.ico HTTP/1.1
Host: pkg-store.dl.mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://pkg-store.dl.mail.ru/packages/shop/0_2000257distrib1/BountyTrain_Data/Managed/Newtonsoft.Json.dll
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.18.0
Date: Fri, 18 Oct 2024 10:13:24 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 265
Connection: keep-alive
|