Source substitution

[KirillEPM]

Good day! I will try to describe the situation. So I am making an https request for the malware page - migtime.xyz

CP successfully blocks

 

Which is confirmed in the CP logs

But if you go into the event, you can see that I was accessing another resource

I am trying to contact 1abcnews.xyz

CP is blocking me

But in the logs

And in the details, again, it is no coincidence.

I will try to continue

[_Val_]

How do all those domain resolve with DNS? It might be, they are sitting on the same IP