Source substitution

KirillEPM — Tue, 21 Dec 2021 07:07:35 GMT

Good day! I will try to describe the situation. So I am making an https request for the malware page - migtime.xyz

CP successfully blocks

Which is confirmed in the CP logs

But if you go into the event, you can see that I was accessing another resource

I am trying to contact 1abcnews.xyz

CP is blocking me

But in the logs

And in the details, again, it is no coincidence.

I will try to continue

Re: Source substitution

_Val_ — Thu, 23 Dec 2021 08:10:43 GMT

How do all those domain resolve with DNS? It might be, they are sitting on the same IP