Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 107.190.140.178 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 177.72.160.55 | Active | Moloch |
| 186.233.148.33 | Active | Moloch |
| 188.225.225.70 | Active | Moloch |
| 192.185.123.100 | Active | Moloch |
| 192.185.217.211 | Active | Moloch |
| 192.185.36.231 | Active | Moloch |
| 192.196.158.90 | Active | Moloch |
| 74.220.219.123 | Active | Moloch |
| 95.217.60.220 | Active | Moloch |
- TCP Requests
-
-
192.168.56.101:49205 107.190.140.178:443ciatran.com.co
-
192.168.56.101:49206 107.190.140.178:443ciatran.com.co
-
192.168.56.101:49207 107.190.140.178:443ciatran.com.co
-
192.168.56.101:49209 177.72.160.55:443clodoaldofernandes.com.br
-
192.168.56.101:49210 177.72.160.55:443clodoaldofernandes.com.br
-
192.168.56.101:49211 177.72.160.55:443clodoaldofernandes.com.br
-
192.168.56.101:49231 186.233.148.33:443notificacao.acessoeduk.com.br
-
192.168.56.101:49232 186.233.148.33:443notificacao.acessoeduk.com.br
-
192.168.56.101:49233 186.233.148.33:443notificacao.acessoeduk.com.br
-
192.168.56.101:49239 188.225.225.70:443aims1.ezicodes.com
-
192.168.56.101:49240 188.225.225.70:443aims1.ezicodes.com
-
192.168.56.101:49241 188.225.225.70:443aims1.ezicodes.com
-
192.168.56.101:49227 192.185.123.100:443canteraspalomino.com
-
192.168.56.101:49228 192.185.123.100:443canteraspalomino.com
-
192.168.56.101:49229 192.185.123.100:443canteraspalomino.com
-
192.168.56.101:49219 192.185.217.211:443proterra.med.br
-
192.168.56.101:49220 192.185.217.211:443proterra.med.br
-
192.168.56.101:49221 192.185.217.211:443proterra.med.br
-
192.168.56.101:49223 192.185.36.231:443agentsv2.ivm.mv
-
192.168.56.101:49224 192.185.36.231:443agentsv2.ivm.mv
-
192.168.56.101:49225 192.185.36.231:443agentsv2.ivm.mv
-
192.168.56.101:49235 192.196.158.90:443fate.sa
-
192.168.56.101:49236 192.196.158.90:443fate.sa
-
192.168.56.101:49237 192.196.158.90:443fate.sa
-
192.168.56.101:49213 74.220.219.123:443mail-call.us
-
192.168.56.101:49214 74.220.219.123:443mail-call.us
-
192.168.56.101:49215 74.220.219.123:443mail-call.us
-
192.168.56.101:49204 95.217.60.220:443www.ktateeb.vision-building.com
-
- UDP Requests
-
-
192.168.56.101:50851 164.124.101.2:53
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:55450 164.124.101.2:53
-
192.168.56.101:56887 164.124.101.2:53
-
192.168.56.101:56977 164.124.101.2:53
-
192.168.56.101:57460 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:62902 164.124.101.2:53
-
192.168.56.101:65329 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
8.8.8.8:53 192.168.56.101:54056
-
8.8.8.8:53 192.168.56.101:62902
-
8.8.8.8:53 192.168.56.101:65329
-
GET
200
https://www.ktateeb.vision-building.com/public/graph/uploads/200x300/content_images/CByVubhIO51.php
REQUEST
RESPONSE
BODY
GET /public/graph/uploads/200x300/content_images/CByVubhIO51.php HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E)
Host: www.ktateeb.vision-building.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 20 May 2021 00:31:20 GMT
Content-Type: application/octet-stream
Content-Length: 12
Connection: keep-alive
Content-Transfer-Encoding: Binary
X-User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E)
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Upstream-Cache-Status: BYPASS
X-Server-Powered-By: Engintron
Accept-Ranges: bytes
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49204 95.217.60.220:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=*.vision-building.com | 09:de:ea:e1:cb:07:99:99:e2:9f:a7:a6:66:23:ee:4a:b6:f4:17:48 |
Snort Alerts
No Snort Alerts