Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 141.255.162.34 | Active | Moloch |
| 162.247.74.201 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 185.215.113.93 | Active | Moloch |
| 193.11.164.243 | Active | Moloch |
| 195.201.103.59 | Active | Moloch |
| 212.83.168.196 | Active | Moloch |
| 213.32.71.116 | Active | Moloch |
| 23.129.64.201 | Active | Moloch |
| 45.66.156.176 | Active | Moloch |
| 86.59.21.38 | Active | Moloch |
| 95.143.193.125 | Active | Moloch |
| 95.217.229.211 | Active | Moloch |
| 95.217.42.50 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| api.wipmania.com | 212.83.168.196 |
- TCP Requests
-
-
192.168.56.101:49211 162.247.74.201:443
-
192.168.56.101:49208 185.215.113.93:80
-
192.168.56.101:49215 185.215.113.93:80
-
192.168.56.101:49213 193.11.164.243:9030
-
192.168.56.101:49212 195.201.103.59:3333
-
192.168.56.101:49200 212.83.168.196:80api.wipmania.com
-
192.168.56.101:49203 212.83.168.196:80api.wipmania.com
-
192.168.56.101:49218 212.83.168.196:80api.wipmania.com
-
192.168.56.101:49209 23.129.64.201:80
-
192.168.56.101:49214 86.59.21.38:80
-
192.168.56.101:49207 95.143.193.125:80
-
192.168.56.101:49210 95.217.229.211:9001
-
- UDP Requests
-
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:61480 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
http://api.wipmania.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: api.wipmania.com
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 May 2021 08:04:32 GMT
Content-Type: text/html
Content-Length: 21
Connection: keep-alive
Keep-Alive: timeout=20
GET
200
http://api.wipmania.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: api.wipmania.com
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 May 2021 08:04:45 GMT
Content-Type: text/html
Content-Length: 21
Connection: keep-alive
Keep-Alive: timeout=20
GET
200
http://95.143.193.125/tor/status-vote/current/consensus.z
REQUEST
RESPONSE
BODY
GET /tor/status-vote/current/consensus.z HTTP/1.1
Cache-Control: no-cache
Accept-Encoding: gzip
Host: 95.143.193.125
Connection: Close
HTTP/1.0 200 OK
Date: Mon, 03 May 2021 08:04:54 GMT
Content-Type: application/octet-stream
X-Your-Address-Is: 175.208.134.150
Content-Encoding: deflate
Pragma: no-cache
Vary: X-Or-Diff-From-Consensus
GET
200
http://185.215.113.93/cc11
REQUEST
RESPONSE
BODY
GET /cc11 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: 185.215.113.93
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 May 2021 08:04:55 GMT
Content-Type: application/octet-stream
Content-Length: 103432
Last-Modified: Sun, 02 May 2021 18:15:21 GMT
Connection: keep-alive
ETag: "608eec39-19408"
Accept-Ranges: bytes
GET
200
http://23.129.64.201/tor/server/fp/0011bd2485ad45d984ec4159c88fc066e5e3300e+005079a42356183cea5a3add239303f44f12e7ea+00cc4ac22501360c541185ee7e4466efb7032cae+00cce6a84e6d63a1a42e105839bc8ed5d4b16669+00e1649e69ff91d7f01e74a5e62ef14f7d9915e4+019feb22ce04cbd0489b7f24be038518b64fa223+034168fa4180b8662439fc714e4bdd7c6b39f5df+041646640ab306ea74b001966e86169b04cc88d2+05051aa95fb65c64e6a99fc0963cedeb211c88ba+05499507da8b381370e0858a784c3afe13dc927f+0a3c9ebb64ee062aa170bb9bf2b84ffb02da88c9+0a4ed4c74020740a904f3a9936030b7a4c6170bb+0b19bbfdc498ccea23027b1d7bd8e20121b95e60+0b37ec8be844f5c20e5b84a885608de0c7dbea47+0c93559d6d7e95b41561424345b0b176fbe66f00+0d2d4b1d27468806bb1edfb02715eee91e1ab94e.z
REQUEST
RESPONSE
BODY
GET /tor/server/fp/0011bd2485ad45d984ec4159c88fc066e5e3300e+005079a42356183cea5a3add239303f44f12e7ea+00cc4ac22501360c541185ee7e4466efb7032cae+00cce6a84e6d63a1a42e105839bc8ed5d4b16669+00e1649e69ff91d7f01e74a5e62ef14f7d9915e4+019feb22ce04cbd0489b7f24be038518b64fa223+034168fa4180b8662439fc714e4bdd7c6b39f5df+041646640ab306ea74b001966e86169b04cc88d2+05051aa95fb65c64e6a99fc0963cedeb211c88ba+05499507da8b381370e0858a784c3afe13dc927f+0a3c9ebb64ee062aa170bb9bf2b84ffb02da88c9+0a4ed4c74020740a904f3a9936030b7a4c6170bb+0b19bbfdc498ccea23027b1d7bd8e20121b95e60+0b37ec8be844f5c20e5b84a885608de0c7dbea47+0c93559d6d7e95b41561424345b0b176fbe66f00+0d2d4b1d27468806bb1edfb02715eee91e1ab94e.z HTTP/1.1
Cache-Control: no-cache
Accept-Encoding: gzip
Host: 23.129.64.201
Connection: Close
HTTP/1.0 200 OK
Date: Mon, 03 May 2021 08:05:08 GMT
Content-Type: text/plain
X-Your-Address-Is: 175.208.134.150
Content-Encoding: deflate
Pragma: no-cache
GET
200
http://86.59.21.38/tor/server/fp/d5f09497548a39071d14ac9e9aa926a0f8a748f2+d5f5502c1762a0b737a81a6bdb78ddbf7efc7725+d60c2d85ead93d23f1c00874d334bbf8a96cd529.z
REQUEST
RESPONSE
BODY
GET /tor/server/fp/d5f09497548a39071d14ac9e9aa926a0f8a748f2+d5f5502c1762a0b737a81a6bdb78ddbf7efc7725+d60c2d85ead93d23f1c00874d334bbf8a96cd529.z HTTP/1.1
Cache-Control: no-cache
Accept-Encoding: gzip
Host: 86.59.21.38
Connection: Close
HTTP/1.0 200 OK
Date: Mon, 03 May 2021 08:05:17 GMT
Content-Type: text/plain
X-Your-Address-Is: 175.208.134.150
Content-Encoding: deflate
Pragma: no-cache
GET
200
http://185.215.113.93/cc11
REQUEST
RESPONSE
BODY
GET /cc11 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: 185.215.113.93
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 May 2021 08:05:22 GMT
Content-Type: application/octet-stream
Content-Length: 103432
Last-Modified: Sun, 02 May 2021 18:15:21 GMT
Connection: keep-alive
ETag: "608eec39-19408"
Accept-Ranges: bytes
GET
200
http://185.215.113.93/cc22
REQUEST
RESPONSE
BODY
GET /cc22 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: 185.215.113.93
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 May 2021 08:05:30 GMT
Content-Type: application/octet-stream
Content-Length: 103432
Last-Modified: Sun, 02 May 2021 18:20:42 GMT
Connection: keep-alive
ETag: "608eed7a-19408"
Accept-Ranges: bytes
GET
200
http://api.wipmania.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: api.wipmania.com
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 May 2021 08:05:31 GMT
Content-Type: text/html
Content-Length: 21
Connection: keep-alive
Keep-Alive: timeout=20
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 95.217.42.50 | 192.168.56.101 | 3 | |
| 95.217.42.50 | 192.168.56.101 | 3 | |
| 95.217.42.50 | 192.168.56.101 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49212 195.201.103.59:3333 |
CN=www.3gg2v7jrf2gop4.com | CN=www.gzazujcdd6f7t.net | 35:7f:f1:a8:7a:9a:d2:0a:54:ec:b7:21:3e:eb:ba:d6:9d:08:cd:7a |
|
TLSv1 192.168.56.101:49211 162.247.74.201:443 |
CN=www.adxrs6re5yxnwldtusi.com | CN=www.j4utjsuqj6osi2monp.net | bc:69:b9:d5:4d:1c:ca:2e:9d:67:fc:2e:21:c5:68:92:dc:10:0e:6f |
Snort Alerts
No Snort Alerts