IP 192.229.221.95:0
Hash461f91e8bfd6c4e5cbf41562e3745973 6cd2f9d0cf873d9e2531fc190260ebfd4ce79fd5 05004ba719f9267b9f78ff9dfa45ce9f6e826a6202f8726bd2efc679a4c8f659
POST / HTTP/1.1
Host: status.rapidssl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Thu, 30 Nov 2023 08:11:43 GMT
Server: ECAcc (amb/6B43)
Content-Length: 471
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml | 35.244.181.201 | | 444 B |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml IP35.244.181.201:0
File typeXML 1.0 document text\012- XML document, ASCII text, with very long lines (332) Hash3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463
GET /update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2023-12-29-19-51-25.chain; p384ecdsa=Y9s-Q_BqD6jdHzRzZDMs4-it3PaFQn54YMDC2yQvaxv8lkXcFG3cbu0dNJHntkykJoBaC4nxnkejKEg1tt4WYDFicvQVc2d1IboOeEpurx3saCG2QlZdkXrXyPuBs8c-
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Thu, 30 Nov 2023 08:11:05 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 57
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|
| ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip |  62.115.252.115 | | 512 kB |
URL ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip IP62.115.252.115:0 ASN#1299 Telia Company AB
File typeZip archive data, at least v2.0 to extract, compression method=deflate\012- data Size512 kB (511815 bytes) Hash152eda253e242e18443ef3282495bc7c ff0fa85565f21ec4931baad4573b4c0bd08c4019 8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48
GET /openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1
Host: ciscobinary.openh264.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Last-Modified: Thu, 16 Nov 2023 07:38:15 GMT
ETag: 152eda253e242e18443ef3282495bc7c
Content-Length: 511815
Accept-Ranges: bytes
X-Timestamp: 1700120294.87662
Content-Type: application/zip
X-Trans-Id: tx15b69f172b404fa58b2bb-006555fb11dfw1
Cache-Control: public, max-age=223421
Expires: Sat, 02 Dec 2023 22:15:43 GMT
Date: Thu, 30 Nov 2023 08:12:02 GMT
Connection: keep-alive
|
| cdn.jms.fwxgx.com/3.8.590.4285/GSCSetup.exe |  0.0.0.0 | | 68 MB |
URL User Request GET cdn.jms.fwxgx.com/3.8.590.4285/GSCSetup.exe IP0.0.0.0:0
Size68 MB (68309960 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| NIDS | Severity | Alert |
|---|
| suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP |
GET /3.8.590.4285/GSCSetup.exe HTTP/1.1
Host: cdn.jms.fwxgx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Byte-nginx
Content-Type: application/x-msdownload
Content-Length: 68309960
Connection: keep-alive
Accept-Ranges: bytes
Age: 544049
Etag: "EC4A777BF65B5B76DE2E708F7E193CC5"
Last-Modified: Tue, 30 Jul 2019 08:35:26 GMT
Via: cache27.czmp,cache05.cqct02
X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT
X-Oss-Hash-Crc64ecma: 4094537110651772540
X-Oss-Object-Type: Normal
X-Oss-Request-Id: 655FF6905E8AFF3339F13500
X-Oss-Server-Time: 106
X-Oss-Storage-Class: Standard
X-Request-Id: e30b5447de53815f645a81c0d8dd4101
X-Request-Ip: 91.90.42.154
X-Response-Cache: parent_hit
X-Response-Cinfo: 91.90.42.154
X-Tt-Trace-Tag: id=5
Date: Thu, 30 Nov 2023 08:11:44 GMT
Cache-Control: max-age=2592000
|
125.64.35.198