Ftp: Cdn1discovery

Discovery Inc. utilizes various CDN infrastructures to handle its massive library of content (Discovery Channel, TLC, HGTV, etc.). An FTP server associated with this domain is generally a used for:

Unfortunately, threat actors also love discovery services. The string cdn1discovery ftp appearing unexpectedly on your network could indicate one of several malicious activities. cdn1discovery ftp

| Attribute | Finding | | :--- | :--- | | | cdn1discovery ftp | | Risk Assessment | High Risk (Suspicious/Malicious) | | Typical Behavior | Attempts to bypass firewalls by mimicking CDN traffic over FTP ports (21, 990, 2121). Often indicates data exfiltration or downloading of secondary stages. | | Protocol Anomaly | FTP over port 80/443, or anomalous FTP commands sent to a web server. | | Indicators (IOCs) | Look for processes spawning ftp.exe connecting to a host containing "discovery" or "cdn1". | | Recommendation | Block the domain pattern *cdn1discovery* at the DNS layer. Investigate the source IP attempting this connection. | Discovery Inc