Hello, Team.
For the past 24 hours, we have received roughly 7-8 alerts indicating internal machines/hosts/NAT IPs connecting to IP Address: 34.117.186.192 which do belong to ipinfo.io website (where this IP belongs to Google Cloud and has been reported to be malicious on forums).
Splunk's proxy logs reveal frequently visited websites under the field "http_referrer" and under "values (url)" we see that , ipinfo/json*, ipinfo.io/?urls been displayed. Below are my asks:
1) What to "values(http_referrer) and "values (url)" repesent in Splunk Logs and Diff. b/w them in Investigations Checks.
2) Secondly, User visiting normal websites but why we are seeing always ipinfo/json*, ipinfo.io/?urls and such under "values (url)" field which are not browsed or accessed by users. (This was triggered on a rule mentioning Internal IP's connected multiple times to IP 34.117.186.192 and domain ipinfo.io.
Could you please clarify on the ask why was ipinfo been seen here when users were not accessing it? Thank you!
