Four Oh Four
Company: Altyn Stroy LLP
Briefing
Altyn Stroy LLP is a construction company. The site administrator noticed the daily 404 counter had risen many times over and handed you the access log.
The log also holds ordinary visitors: they browse existing pages and get 200. Your job is to find the client behaving differently and describe it well enough that access can be closed.
Fields follow Elastic naming: source.ip, url.path, http.response.status_code, user_agent.original. Timestamps are UTC.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | source.ip | http.request.method | http.response.bytes | http.response.status_code | url.path |
|---|---|---|---|---|---|
| 2026-03-03T02:35:00Z | 203.0.113.212 | GET | 1240 | 404 | /old/ |
| 2026-03-03T02:35:01Z | 203.0.113.212 | GET | 1240 | 404 | /backup/ |
| 2026-03-03T02:35:03Z | 203.0.113.212 | GET | 1240 | 404 | /test/ |
| 2026-03-03T02:35:04Z | 203.0.113.212 | GET | 1240 | 404 | /dev/ |
| 2026-03-03T02:35:05Z | 203.0.113.212 | GET | 1240 | 404 | /tmp/ |
| 2026-03-03T02:35:07Z | 203.0.113.212 | GET | 1240 | 404 | /files/ |
| 2026-03-03T02:35:08Z | 203.0.113.212 | GET | 1240 | 404 | /docs/ |
| 2026-03-03T02:35:10Z | 203.0.113.212 | GET | 1240 | 404 | /uploads/ |
| 2026-03-03T02:35:11Z | 203.0.113.212 | GET | 1240 | 404 | /archive/ |
| 2026-03-03T02:35:12Z | 203.0.113.212 | GET | 1240 | 404 | /portal/ |
| 2026-03-03T02:35:14Z | 203.0.113.212 | GET | 1240 | 404 | /app/ |
| 2026-03-03T02:35:15Z | 203.0.113.212 | GET | 1240 | 404 | /api/ |
| 2026-03-03T02:35:16Z | 203.0.113.212 | GET | 1240 | 404 | /old-1/ |
| 2026-03-03T02:35:18Z | 203.0.113.212 | GET | 1240 | 404 | /backup-1/ |
| 2026-03-03T02:35:19Z | 203.0.113.212 | GET | 1240 | 404 | /test-1/ |
| 2026-03-03T02:35:21Z | 203.0.113.212 | GET | 1240 | 404 | /dev-1/ |
| 2026-03-03T02:35:22Z | 203.0.113.212 | GET | 1240 | 404 | /tmp-1/ |
| 2026-03-03T02:35:23Z | 203.0.113.212 | GET | 1240 | 404 | /files-1/ |
| 2026-03-03T02:35:25Z | 203.0.113.212 | GET | 1240 | 404 | /docs-1/ |
| 2026-03-03T02:35:26Z | 203.0.113.212 | GET | 1240 | 404 | /uploads-1/ |
| 2026-03-03T02:35:28Z | 203.0.113.212 | GET | 1240 | 404 | /archive-1/ |
| 2026-03-03T02:35:29Z | 203.0.113.212 | GET | 1240 | 404 | /portal-1/ |
| 2026-03-03T02:35:30Z | 203.0.113.212 | GET | 1240 | 404 | /app-1/ |
| 2026-03-03T02:35:32Z | 203.0.113.212 | GET | 1240 | 404 | /api-1/ |
| 2026-03-03T02:35:33Z | 203.0.113.212 | GET | 1240 | 404 | /old-2/ |
| 2026-03-03T02:35:35Z | 203.0.113.212 | GET | 1240 | 404 | /backup-2/ |
| 2026-03-03T02:35:36Z | 203.0.113.212 | GET | 1240 | 404 | /test-2/ |
| 2026-03-03T02:35:37Z | 203.0.113.212 | GET | 1240 | 404 | /dev-2/ |
| 2026-03-03T02:35:39Z | 203.0.113.212 | GET | 1240 | 404 | /tmp-2/ |
| 2026-03-03T02:35:40Z | 203.0.113.212 | GET | 1240 | 404 | /files-2/ |
| 2026-03-03T02:35:42Z | 203.0.113.212 | GET | 1240 | 404 | /docs-2/ |
| 2026-03-03T02:35:43Z | 203.0.113.212 | GET | 1240 | 404 | /uploads-2/ |
| 2026-03-03T02:35:45Z | 203.0.113.212 | GET | 1240 | 404 | /archive-2/ |
| 2026-03-03T02:35:46Z | 203.0.113.212 | GET | 1240 | 404 | /portal-2/ |
| 2026-03-03T02:35:47Z | 203.0.113.212 | GET | 1240 | 404 | /app-2/ |
| 2026-03-03T02:35:49Z | 203.0.113.212 | GET | 1240 | 404 | /api-2/ |
| 2026-03-03T02:35:50Z | 203.0.113.212 | GET | 1240 | 404 | /old-3/ |
| 2026-03-03T02:35:52Z | 203.0.113.212 | GET | 1240 | 404 | /backup-3/ |
| 2026-03-03T02:35:53Z | 203.0.113.212 | GET | 1240 | 404 | /test-3/ |
| 2026-03-03T02:35:54Z | 203.0.113.212 | GET | 1240 | 404 | /dev-3/ |
| 2026-03-03T02:35:56Z | 203.0.113.212 | GET | 1240 | 404 | /tmp-3/ |
| 2026-03-03T02:35:57Z | 203.0.113.212 | GET | 1240 | 404 | /files-3/ |
| 2026-03-03T02:35:58Z | 203.0.113.212 | GET | 5720 | 200 | /static/app.js |
| 2026-03-03T02:35:59Z | 203.0.113.212 | GET | 1240 | 404 | /docs-3/ |
| 2026-03-03T02:36:00Z | 203.0.113.212 | GET | 1240 | 404 | /uploads-3/ |
| 2026-03-03T02:36:01Z | 203.0.113.212 | GET | 1240 | 404 | /archive-3/ |
| 2026-03-03T02:36:03Z | 203.0.113.212 | GET | 1240 | 404 | /portal-3/ |
| 2026-03-03T02:36:04Z | 203.0.113.212 | GET | 1240 | 404 | /app-3/ |
| 2026-03-03T02:36:05Z | 203.0.113.212 | GET | 1240 | 404 | /api-3/ |
| 2026-03-03T02:36:07Z | 203.0.113.212 | GET | 1240 | 404 | /old-4/ |
| 2026-03-03T02:36:08Z | 203.0.113.212 | GET | 1240 | 404 | /backup-4/ |
| 2026-03-03T02:36:10Z | 203.0.113.212 | GET | 1240 | 404 | /test-4/ |
| 2026-03-03T02:36:11Z | 203.0.113.212 | GET | 1240 | 404 | /dev-4/ |
| 2026-03-03T02:36:12Z | 203.0.113.212 | GET | 1240 | 404 | /tmp-4/ |
| 2026-03-03T02:36:14Z | 203.0.113.212 | GET | 1240 | 404 | /files-4/ |
| 2026-03-03T02:36:15Z | 203.0.113.212 | GET | 1240 | 404 | /docs-4/ |
| 2026-03-03T02:36:17Z | 203.0.113.212 | GET | 1240 | 404 | /uploads-4/ |
| 2026-03-03T02:36:18Z | 203.0.113.212 | GET | 1240 | 404 | /archive-4/ |
| 2026-03-03T02:36:19Z | 203.0.113.212 | GET | 1240 | 404 | /portal-4/ |
| 2026-03-03T02:36:21Z | 203.0.113.212 | GET | 1240 | 404 | /app-4/ |
Questions
0/7 · 0/100 points
Log in to save your progress and appear on the leaderboard.
Which address produced the bulk of the 'not found' responses?
Format: IPv4 address · 10 points
How many 404 responses came from that address?
Format: Whole number · 20 points
Which client do those requests identify as?
Format: The full user-agent string · 15 points
When did the first such request arrive? UTC.
Format: YYYY-MM-DD HH:MM:SS · 15 points
And the last one?
Format: YYYY-MM-DD HH:MM:SS · 15 points
How many requests came from that address in total, successful ones included?
Format: Whole number · 15 points
Which MITRE ATT&CK technique covers directory probing on a website?
Format: Identifier like T1234.003 · 10 points