Report - prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

Report Overview

URL

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141

ASN

#58224 Iran Telecommunication Company PJS
Submitted

2023-02-08T22:23:40Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

2
Threat Detection Systems

0

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org (9)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3042	7977	23.36.77.32
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2373	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
prof.khuisf.ac.ir (21)	unknown	2022-06-08T11:36:13Z	2023-01-27T15:52:13Z	9476	1236427	37.255.135.141
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	52.25.69.156
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	56587	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-08T22:24:25Z	medium	37.255.135.141	Client IP	ET POLICY PDF With Embedded File
2023-02-08T22:24:26Z	medium	37.255.135.141	Client IP	ET POLICY PDF With Embedded File

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

HTTP Transactions (41)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

dca68db7aea32f6683ce8d542c078f04

19c495238df74fca680e21f18627ff94de5dd2e5

35cab3987fc0e4a41b305cb208c1e33fa38ce8bdfd9f386c3dc0411dd4d5ac61

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "35CAB3987FC0E4A41B305CB208C1E33FA38CE8BDFD9F386C3DC0411DD4D5AC61"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14590
Expires: Thu, 09 Feb 2023 02:26:39 GMT
Date: Wed, 08 Feb 2023 22:23:29 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

565c1bbc5c1c40be1988b3bf6fd9dc1a

cfdba5bc597130461dd67bf6cda53183be592493

60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10809
Expires: Thu, 09 Feb 2023 01:23:38 GMT
Date: Wed, 08 Feb 2023 22:23:29 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

bf0c602d32b3c14606f22a86183b5e3c

6eabd8d83475eba731968abe1a05a8bfd272f160

6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Backoff, Alert, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 08 Feb 2023 21:36:44 GMT
content-type: application/json
age: 2805
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

cc14b0d2f7c451f6431dc87ba54d1d60

bab8bfda6fa3e2f17125353f5147211787dc25d0

b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12759
Expires: Thu, 09 Feb 2023 01:56:08 GMT
Date: Wed, 08 Feb 2023 22:23:29 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

e76071a28ee566dababb3834f46d68ed

aebb4e68c1ba2de0f90025283e8ed8470944fde0

78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: yHirCzDNevTsxCw9MuBSCqG0p9uqtF0TwywwakYqsOpkpXgTZqa8ktmkmgDFuEq4mNLfXZBV5rY=
x-amz-request-id: 2KDPBNEGR57EJ1TJ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 08 Feb 2023 21:46:07 GMT
age: 2242
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Wed, 08 Feb 2023 22:23:29 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

prof.khuisf.ac.ir/favicon.ico

37.255.135.141

404 Not Found

1245

URL HTTP/1.1

prof.khuisf.ac.ir/favicon.ico
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators

Size

1245
Hash

5343c1a8b203c162a3bf3870d9f50fd4

04b5b886c20d88b57eea6d8ff882624a4ac1e51d

dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prof.khuisf.ac.ir/

                                        HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Wed, 08 Feb 2023 22:23:31 GMT
Content-Length: 1245

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Retry-After, Content-Length, Content-Type, ETag, Cache-Control, Alert, Pragma, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 08 Feb 2023 22:14:52 GMT
age: 517
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

9b88bae61bca33aba8aa99f6128db8d9

a07b61fb2458917699613fcae68710941b595416

54915c2f79822732e06a592d027da421ad1e7a6458c545f98333db25612b3dea

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "54915C2F79822732E06A592D027DA421AD1E7A6458C545F98333DB25612B3DEA"
Last-Modified: Mon, 06 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3575
Expires: Wed, 08 Feb 2023 23:23:05 GMT
Date: Wed, 08 Feb 2023 22:23:30 GMT
Connection: keep-alive

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

49193

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

49193
Hash

64caaaa78f939a4ef3ea9cef17b9efd5

ec34df2e8413df1e35ef03d36248424741c51200

9d5d53f31d9f9e9abe353692979c88f73224c16945d14f96a9da7ce3dc3eb7ad

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3801088-3850280

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3801088-3850280/3850281
Date: Wed, 08 Feb 2023 22:23:31 GMT
Content-Length: 49193

push.services.mozilla.com/

52.25.69.156

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

52.25.69.156:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: EAOes6WnG5OR75F0pgDl5Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Q+gW8qGq9wj5dITsjb/yzIO9kOY=

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

8615c070f6e584549535018440d5c297

39e294581184a4ee09b3dd4645b54198af2c7351

e22ad35be87f4cb0e4f4e8a61b30687c6474f8a335720813ad589fa577921a72

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=1638400-1703935

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 1638400-1703935/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

7ac3b0b08f87bdea3ab0aeeab859386e

02c61d5c2165a1ff9a68dd6b2fef7bfe606eabd9

07c480f2d24983c6f6b59aa3b9060bdf25c80cbc32afa38fe7a840115d6a9345

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=1769472-1835007

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 1769472-1835007/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

30d089aa937a8c6a862860f238f01389

0a0d4f078dcf91ec0759b51bb0810f138d7fac11

d49a8a0e3c8b966ff88decdea51361f597b7e33141f9817530aff841fa5a11d2

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3014656-3080191

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3014656-3080191/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

057dcc3437e3ac18ee2b1dd7e5664e6c

08ff33ec42d2d3e8c7182b6b6eccf6576b938e93

4f078889841abbff8c050cf10064fd07514f5a0138580b5dbf90639cdce400b9

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3211264-3276799

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3211264-3276799/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

87dbe7c92bbd57ce6f8d195a01b33e51

73a6accb7c7e50f0b97b01f7a7116900871dd160

c9d23db8fe27127cfeedded5f1d2e4514232c5ab0612d2c1b64bbc68c87a2a35

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3342336-3407871

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3342336-3407871/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

bccc5462913531c9444e24568e870903

9bb31f7022babb9192c33edf73da62feb9a29adf

7e4175cf8424223517ebfa2c568866fa669736260a1cbdd14daefe4718beda5b

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=1703936-1769471

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 1703936-1769471/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

bf93754698ba50e4d9770533c9e7c1c8

a5645c85a4b7b2bd4a48a98716003811c6d90a99

852bb4c0c5293e956dc196790bc0fa41161f89b15271af9064d6d53678c93970

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=1900544-1966079

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 1900544-1966079/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

854f77d109ef17d110c72a01056b6285

7e514c1440738b6ad3711534a5f06f4b97eff218

55a4d509a12943202208fa028e5510542088f0d0ee42a3914ef692b92dc4948f

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3276800-3342335

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3276800-3342335/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

69495264092bec30629369b35c500d87

65e467981cafaaee910b88213cfb4eba130eb94d

222c319f763b9d1f75b1b46644725bde40ccf8063180d3a325cec0ee63340d41

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2097152-2162687

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2097152-2162687/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

c62bf8a7644e737b8dff62e22610f042

16b5e6f33da765365278965aa32587ef43526c33

57fbab00a836b4f941cef803c7bca7099fd86a7c546cbbcca88c41391d6d21bf

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3080192-3145727

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3080192-3145727/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

68273225f74fbf7493f395610d7a73fc

5a8779ef5656aeeba23b365aad60b7901c5dd7fc

c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2171
Expires: Wed, 08 Feb 2023 22:59:42 GMT
Date: Wed, 08 Feb 2023 22:23:31 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

68273225f74fbf7493f395610d7a73fc

5a8779ef5656aeeba23b365aad60b7901c5dd7fc

c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2171
Expires: Wed, 08 Feb 2023 22:59:42 GMT
Date: Wed, 08 Feb 2023 22:23:31 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

68273225f74fbf7493f395610d7a73fc

5a8779ef5656aeeba23b365aad60b7901c5dd7fc

c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2171
Expires: Wed, 08 Feb 2023 22:59:42 GMT
Date: Wed, 08 Feb 2023 22:23:31 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7f728fd1-646b-418a-ab1a-194a7bf42969.jpeg

34.120.237.76

200 OK

6805

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7f728fd1-646b-418a-ab1a-194a7bf42969.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6805
Hash

c8f31c82179856e39ee5fc43d7f0b685

5b37f807a19ffc80c0b9334e6d24d5bb717496ce

c099c91c6f2125a8a89ee6e9dc0e37e2c2c9914adadb2c8b77795063baa62037

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7f728fd1-646b-418a-ab1a-194a7bf42969.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6805
x-amzn-requestid: 9f067f0c-2991-41ae-8dd0-5719a5438abc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_PHwEn4IAMFvFg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c564-730d01807c13643373d64897;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:40:52 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: NsPkfWcoYkZE6ynP9nfRlkB-ZVNL2M5QLsL5nng7mUooHvoAUeMYKg==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 22:06:51 GMT
age: 1000
etag: "5b37f807a19ffc80c0b9334e6d24d5bb717496ce"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12401

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc93fe33d-3033-473c-8315-95eb00ba319e.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

12401
Hash

ed10868ea9554510e43f77dfb8c43877

df0d86c2c53bdec7b8935912e42dc7f82f87aa61

751e95e7dd20802cc4e0b6f208bf5559b0b73efd3ca22a9abafd86cf83ab6420

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc93fe33d-3033-473c-8315-95eb00ba319e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 12401
x-amzn-requestid: 7bfa8a84-c348-4f55-8e8e-befcdd24f026
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_OjPG-eIAMFccA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c47a-06eedb3c7396825f77360755;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:36:58 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ZHGp073QTcSjtcva36Y9sBKwRU6R8MdAxdTf8DQ_ugzAkDgWingxXg==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:50:14 GMT
age: 1997
etag: "df0d86c2c53bdec7b8935912e42dc7f82f87aa61"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6838

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5708e132-62b1-4b5b-aa88-fe22e522eb0e.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6838
Hash

4b327816bc2c6fd7291c75c693685d54

771070be61d0724b1c90ca86ea34c804bd7e501a

d45188239cacc7b228bc75ccc95afb48914aaa434c418cd5b786533e8b9cb983

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5708e132-62b1-4b5b-aa88-fe22e522eb0e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6838
x-amzn-requestid: 54fc5ae9-d37a-46cf-97e0-d05de1417cfb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7QEsCoAMFY1w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c514-40de6212468fcd0e78a93708;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:32 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: HKB4N2wyEkDOCHrcPmb2SW-T48udtqtgj-SITdLi1HxcsmUFDxERfA==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:52:43 GMT
age: 1848
etag: "771070be61d0724b1c90ca86ea34c804bd7e501a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6342

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb27041-48b2-474f-b9d5-f88e9e662723.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6342
Hash

d8a3fa4f1ec82d501942f9db3de2cb7d

b91c2aea7f2fb26131c8929b254c5596a1bb25ff

9d246eeab8ba04c775a03fd960c8859934a0accb737e845e89aba40bc573fdaa

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb27041-48b2-474f-b9d5-f88e9e662723.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6342
x-amzn-requestid: b2b61a71-5326-4fc6-baba-7baad29cf7c5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_OkbHfDIAMF5AQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c482-5cc4028d01d05305637af317;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:37:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Ladt7WYN7SIJ42nshsT0ewNBre8_C8DHi_-JbR37KM57MA9lkq5Anw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:52:28 GMT
age: 1863
etag: "b91c2aea7f2fb26131c8929b254c5596a1bb25ff"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

68273225f74fbf7493f395610d7a73fc

5a8779ef5656aeeba23b365aad60b7901c5dd7fc

c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2171
Expires: Wed, 08 Feb 2023 22:59:42 GMT
Date: Wed, 08 Feb 2023 22:23:31 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

68273225f74fbf7493f395610d7a73fc

5a8779ef5656aeeba23b365aad60b7901c5dd7fc

c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2171
Expires: Wed, 08 Feb 2023 22:59:42 GMT
Date: Wed, 08 Feb 2023 22:23:31 GMT
Connection: keep-alive

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

4bdbf094a358ef3012c8c75b7d1ca142

00634183582948f4ee5758ea6217d4401076b404

1a562079c1a509a4b58029afd24a1d109dde4ea845b1cf782ea88887ffdb536d

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3407872-3473407

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3407872-3473407/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

34.120.237.76

200 OK

6679

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5abcabc9-1cda-4d86-8630-67943159604b.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6679
Hash

4bb0e725719ac378134b01b6473a6581

a8a1780c88e8ae219048bed28ecfbd8019d9af35

187d4e83edc0af857334f84bd6853234193d4654d06c43367f39b4e125defe08

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5abcabc9-1cda-4d86-8630-67943159604b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6679
x-amzn-requestid: 97c19ad5-c127-4dc1-b529-1eca84645316
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f59MzHgloAMFwow=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e0a8b8-79d6b8d31b69153d4929b7b7;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 07:14:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: x_tr-xummuF51PvAM4y3DgvLWuJOwxgquKO8baQfcoN6ta5M3ll7ug==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 06:24:59 GMT
age: 57512
etag: "a8a1780c88e8ae219048bed28ecfbd8019d9af35"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11205

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe56753b9-ced9-4038-88f6-9ea3a7bc9f04.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

11205
Hash

aa6c416b3a87ded887c9dcf7c51e5dd0

45f4ef9e68591c00669043abe96959bead8f17ae

9e10394b387916e40c44d4e02fbc1ea72214d870df189ce16d24015de00682bf

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe56753b9-ced9-4038-88f6-9ea3a7bc9f04.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 11205
x-amzn-requestid: abdf9c40-a2b7-49ae-bea1-ff5abfcea781
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fvszZFOZoAMFkNg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dc8e7b-6e508da05ff6f33e691de130;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 04:33:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: c7epaBUnG5cmbx_dT8BnEXw8JEOHyEnVEavRV6dSAExVbmdYLRMUzA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:56:04 GMT
age: 1647
etag: "45f4ef9e68591c00669043abe96959bead8f17ae"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

d23ef9ae53e1830110434849d007df68

5101f0089c7f4dd1ebd798cbffd2f275cc32ac69

39b1e3e65e5e3972f357b4c3caeb986b7b28fb0507531c2d809bfe5c200490a7

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2293760-2359295

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2293760-2359295/3850281
Date: Wed, 08 Feb 2023 22:23:33 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

83c71a78f3f1290c6fbf9b7518819c25

04f99329a1861960b153e036bda8a4df26407dcd

4eb38b750c4d22fec4b87fcd9b8f4a911e5b9fd36f10f09a8f78389cd353ea67

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=3145728-3211263

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 3145728-3211263/3850281
Date: Wed, 08 Feb 2023 22:23:34 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

4d752b773c63140d321e631d54e23e64

67ee44594d8c9a09d51e99735c61fd5ec1919b7f

f3a4e5564996f8ce8c94fe7ac9a56f9ac346fc0b607f791760e148b9e83d7ffb

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2359296-2424831

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2359296-2424831/3850281
Date: Wed, 08 Feb 2023 22:23:34 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

c3fec645c1c84626349cd42cae4a2fb2

efedd67e0f318021c4b66ba6dfacda61b91a73a4

f55006a677ce44db455a2832308c444ab8f44563f92cdbfdb32199c19652a732

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2490368-2555903

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2490368-2555903/3850281
Date: Wed, 08 Feb 2023 22:23:34 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

8827e9f4fad4f6104cc229ca0f7aee54

571feda3f17df9c45129ed6be7eaa28001dff942

7243f13877c4f9e2106167a6c4a5b955bac64f43f40917537c595add8ab27a27

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2621440-2686975

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2621440-2686975/3850281
Date: Wed, 08 Feb 2023 22:23:34 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

data

Size

65536
Hash

fe99cdd61e03edda9b0f037310945ecb

a96e8a5695cb084f6fa42eb2814fc5856f884a01

5fb2eb1f491551ed7f3c51177e576b3e9a648072c070908bac56e290e07e766e

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2818048-2883583

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2818048-2883583/3850281
Date: Wed, 08 Feb 2023 22:23:34 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

206 Partial Content

65536

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

OpenPGP Public Key\012- data

Size

65536
Hash

60b3e74354656e144d02789643377290

a6f57ff5e3fe834c6bd0d7208c570a94ae9239f5

5e76c9a608a82b919980c7e1046c67cbe00314d070257dbce1de228f2e08353d

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Range: bytes=2949120-3014655

                                        HTTP/1.1 206 Partial Content
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Range: bytes 2949120-3014655/3850281
Date: Wed, 08 Feb 2023 22:23:35 GMT
Content-Length: 65536

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF

37.255.135.141

200 OK

URL HTTP/1.1

prof.khuisf.ac.ir/images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF
IP

37.255.135.141:0
ASN

#58224 Iran Telecommunication Company PJS

Magic

Size

0
Hash

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY PDF With Embedded File
suricata	medium	ET POLICY PDF With Embedded File

HTTP Headers

                                        GET /images/Uploaded_files/Modern%20Formal%20Methods%20and%20Applications[6845614].PDF HTTP/1.1
Host: prof.khuisf.ac.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 200 OK
Content-Type: application/pdf
Last-Modified: Sat, 11 Feb 2017 15:30:56 GMT
Accept-Ranges: bytes
ETag: "13ba7ad67b84d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Wed, 08 Feb 2023 22:23:31 GMT
Content-Length: 3850281

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

#1 JS:Script (size: 322330)

#2 JS:Script (size: 373484)

HTTP Transactions (41)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic