NetWork | ZeroBOX

Network Analysis

IP Address Status Action
116.193.69.130 Active Moloch
164.124.101.2 Active Moloch
172.67.176.229 Active Moloch
198.185.159.145 Active Moloch
45.38.9.8 Active Moloch
GET 200 http://xwjhdjylqeypyltby.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-DC99786D69273EFAB2BE036B79EA07C9.html
REQUEST
RESPONSE
GET 404 http://www.xin-zong.com/hsd/?GVW8=l9NNfcs8gV38WLNdwwM4MrwWlwMPHZMgRluEmFVCm/U2i1JlW36Q4mMzDwS7eZqBb3yaC0Fn&uzuD=Zld0rPDHNj
REQUEST
RESPONSE
GET 400 http://www.riseinitiativellc.com/hsd/?GVW8=S7S7gnEF/SB8sQS1wIlqnp1Ofu7tBBDrW++s6v81ELS9tYHecr3PVg7JMS1bWvKVLvtxdrl4&uzuD=Zld0rPDHNj
REQUEST
RESPONSE
GET 404 http://www.chuyensuacuasat.com/hsd/?GVW8=dwSUQeNDSCch504RvWDP9MDBCdi0TMn6ht2P9jbHhkFz+AIKYC+Gjjsmw4VUd0oW1YuPBdDe&uzuD=Zld0rPDHNj
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53 2025106 ET INFO DNS Query for Suspicious .ml Domain Potentially Bad Traffic
TCP 192.168.56.101:49208 -> 116.193.69.130:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 116.193.69.130:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 116.193.69.130:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 198.185.159.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 198.185.159.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 198.185.159.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 45.38.9.8:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 45.38.9.8:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 45.38.9.8:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts