Feedback
Got feedback? We want it! Submit your comments and suggestions for our community here.

Splunk_Ask

Naveen_4025
New Member

Hello, Team.
For the past 24 hours, we have received roughly 7-8 alerts indicating internal machines/hosts/NAT IPs connecting to IP Address: 34.117.186.192 which do belong to ipinfo.io website (where this IP belongs to Google Cloud and has been reported to be malicious on forums).

Splunk's proxy logs reveal frequently visited websites under the field "http_referrer" and under "values (url)" we see that , ipinfo/json*, ipinfo.io/?urls been displayed. Below are my asks:

1) What to "values(http_referrer) and "values (url)" repesent in Splunk Logs and Diff. b/w them in Investigations Checks.

2) Secondly, User visiting normal websites but why we are seeing always ipinfo/json*, ipinfo.io/?urls and such under "values (url)" field which are not browsed or accessed by users. (This was triggered on a rule mentioning Internal IP's connected multiple times to IP 34.117.186.192 and domain ipinfo.io.

Could you please clarify on the ask why was ipinfo been seen here when users were not accessing it? Thank you!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...