diff --git a/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml b/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml
index 033a1c48b1..981421ef1f 100644
--- a/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml
+++ b/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   attack_data:
   - file_name: splunk_zip_bomb_vulnerability.log
-    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log
     source: /opt/splunkforwarder/var/log/splunk/splunkd.log
     sourcetype: splunkd
     custom_index: _internal