Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| email.yg9.me | 198.13.62.186 | |
| www.facebook.com | 157.240.215.35 | |
| ol.gamegame.info | 104.21.21.221 | |
| uyg5wye.2ihsfa.com | 88.218.92.148 | |
| iw.gamegame.info | 172.67.200.215 | |
| email.yg9.me | 198.13.62.186 | |
| ip-api.com | 208.95.112.1 |
- TCP Requests
-
-
192.168.56.102:49826 104.21.21.221:80iw.gamegame.info
-
192.168.56.102:49823 157.240.215.35:443www.facebook.com
-
192.168.56.102:49797 172.217.25.14:443
-
192.168.56.102:49825 172.67.200.215:80iw.gamegame.info
-
192.168.56.102:49815 208.95.112.1:80ip-api.com
-
192.168.56.102:49824 208.95.112.1:80ip-api.com
-
192.168.56.102:49830 88.218.92.148:80uyg5wye.2ihsfa.com
-
- UDP Requests
-
-
192.168.56.102:50839 164.124.101.2:53
-
192.168.56.102:54221 164.124.101.2:53
-
192.168.56.102:54660 164.124.101.2:53
-
192.168.56.102:57660 164.124.101.2:53
-
192.168.56.102:61459 164.124.101.2:53
-
192.168.56.102:61998 164.124.101.2:53
-
192.168.56.102:62461 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
198.13.62.186:53 192.168.56.102:50840
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:50841 239.255.255.250:3702
-
192.168.56.102:56752 239.255.255.250:1900
-
192.168.56.102:56754 239.255.255.250:3702
-
192.168.56.102:56756 239.255.255.250:3702
-
GET
200
https://www.facebook.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
viewport-width: 1920
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
Host: www.facebook.com
HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
X-Frame-Options: DENY
X-XSS-Protection: 0
Strict-Transport-Security: max-age=15552000; preload
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Set-Cookie: fr=1EshvmakFznglBG7J..BgoweC.gt.AAA.0.0.BgoweC.AWVScn9uvzI; expires=Mon, 16-Aug-2021 00:17:05 GMT; Max-Age=7775999; path=/; domain=.facebook.com; secure; httponly; SameSite=None
Set-Cookie: sb=ggejYJP9QQQ3qysQPA9RhLGk; expires=Thu, 18-May-2023 00:17:06 GMT; Max-Age=63072000; path=/; domain=.facebook.com; secure; httponly; SameSite=None
X-Content-Type-Options: nosniff
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Pragma: no-cache
x-fb-rlafr: 0
Content-Type: text/html; charset="utf-8"
X-FB-Debug: gimcXM28nIUHx15DFQbqGbPjpJw4zygNsNp4za4lCRoRzg7XMqtZMSdZjEvvNXtgmSTR8HYnfAgTslt71LhjwQ==
Date: Tue, 18 May 2021 00:17:06 GMT
Transfer-Encoding: chunked
Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
Connection: keep-alive
GET
200
https://www.facebook.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
viewport-width: 1920
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
Host: www.facebook.com
HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
X-Frame-Options: DENY
X-XSS-Protection: 0
Strict-Transport-Security: max-age=15552000; preload
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Set-Cookie: fr=162b8ZMSRX3LKQFrm..BgoweO.0L.AAA.0.0.BgoweO.AWUCsJuYDpc; expires=Mon, 16-Aug-2021 00:17:17 GMT; Max-Age=7775999; path=/; domain=.facebook.com; secure; httponly; SameSite=None
Set-Cookie: sb=jgejYOhA8GVKieZ5h0hw2eaJ; expires=Thu, 18-May-2023 00:17:18 GMT; Max-Age=63072000; path=/; domain=.facebook.com; secure; httponly; SameSite=None
X-Content-Type-Options: nosniff
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Pragma: no-cache
x-fb-rlafr: 0
Content-Type: text/html; charset="utf-8"
X-FB-Debug: aiYJcHIfJnD+H1Dr3Eluz3/ACRd1HSqCx7Pozdy1rT7I91f4TV1b7bx4YyPUSQ2rBFzXF2k9qW70I5E9jzdZWg==
Date: Tue, 18 May 2021 00:17:18 GMT
Priority: u=3,i
Transfer-Encoding: chunked
Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
Connection: keep-alive
GET
200
http://ip-api.com/json/
REQUEST
RESPONSE
BODY
GET /json/ HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
viewport-width: 1920
Host: ip-api.com
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:16:59 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 275
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
GET
200
http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
BODY
GET /json/?fields=8198 HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:12 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 60
Access-Control-Allow-Origin: *
X-Ttl: 47
X-Rl: 43
POST
200
http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE
BODY
POST /report7.4.php HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: iw.gamegame.info
Content-Length: 282
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:13 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
cf-request-id: 0a1e6e86c000000d1065115000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GPLb1UL8iMQFfJRnRv%2FrJpiLxb9iXzx1mZd3r%2FMhqKW0iyCk5qyG2jupsrRsmfczVa1N9LdpbobxdnIslzjaGkslB6kJgvfDwUEKQvrf%2FEgd"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6510e6b799900d10-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
200
http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
BODY
GET /json/?fields=8198 HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:13 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 60
Access-Control-Allow-Origin: *
X-Ttl: 46
X-Rl: 42
POST
200
http://ol.gamegame.info/report7.4.php
REQUEST
RESPONSE
BODY
POST /report7.4.php HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: ol.gamegame.info
Content-Length: 282
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:14 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
cf-request-id: 0a1e6e8cae0000360355a5b000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6pg35EwvtmTnV%2BvixzXqYxOC2ICfHFc0Zn68VbQX8ch3Axcl%2FHA29MDYWn2qGdbO2%2Ft0zFRw%2FyBlmB1Wli9nBTQJYPQRTimL4P3LQgV7dVMh"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6510e6c11bed3603-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
200
http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
BODY
GET /json/?fields=8198 HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:15 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 60
Access-Control-Allow-Origin: *
X-Ttl: 44
X-Rl: 41
POST
200
http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE
BODY
POST /report7.4.php HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: iw.gamegame.info
Content-Length: 282
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:16 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
cf-request-id: 0a1e6e922000000d104c2a8000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2SqkOsZgrAa8Y%2FHkZy29GRq4Ddv06ub8ABKP7jgkrrtBu%2FHdJbArjtjxyUpqer685xJ8sbP2flIA3xKG5zqOkcSA0%2Bd7HByEDKCwSQlTOj3l"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6510e6c9ccc70d10-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
200
http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
BODY
GET /json/?fields=8198 HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:15 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 60
Access-Control-Allow-Origin: *
X-Ttl: 43
X-Rl: 40
POST
200
http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE
BODY
POST /report7.4.php HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: iw.gamegame.info
Content-Length: 710
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:16 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
cf-request-id: 0a1e6e946100000d1028be4000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sStRiPQauGBR34JVn6i2oaG3EtPyhn0XrWREPOIfMi1WpildIu%2BDR8I3Yl1iNC1qI3iUk1FzH2DKD7TfiluGrStF3qq0CD0gse5e64Gg0Nvb"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6510e6cd6d1b0d10-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
200
http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
BODY
GET /json/?fields=8198 HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:16 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 60
Access-Control-Allow-Origin: *
X-Ttl: 43
X-Rl: 39
POST
200
http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE
BODY
POST /report7.4.php HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Host: iw.gamegame.info
Content-Length: 254
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 18 May 2021 00:17:17 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
cf-request-id: 0a1e6e969b00000d1067885000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kTf%2F9VyFVeRdrQlDvRo3T7Ui6G7BAr5eGdTsKfefT48ARcz6Ki5ZnMCGsnBWn%2By4YJbgyXvajWiQQjIC154aZl47uPRDIEDRpO7IlU4%2BqrpN"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6510e6d0fe0f0d10-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
200
http://uyg5wye.2ihsfa.com/api/fbtime
REQUEST
RESPONSE
BODY
GET /api/fbtime HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
Host: uyg5wye.2ihsfa.com
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 18 May 2021 00:17:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.21
POST
200
http://uyg5wye.2ihsfa.com/api/?sid=293289&key=0b72a8497029bcfa3fd924f33ac1d264
REQUEST
RESPONSE
BODY
POST /api/?sid=293289&key=0b72a8497029bcfa3fd924f33ac1d264 HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
Content-Length: 268
Host: uyg5wye.2ihsfa.com
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 18 May 2021 00:17:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.21
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49823 157.240.215.35:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA | C=US, ST=California, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com | 8a:d5:51:89:8f:00:98:8e:5b:0f:b8:07:6d:0d:43:18:89:c2:bb:d0 |
Snort Alerts
No Snort Alerts