Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| robyngraphs.com.au | 192.185.198.10 | |
| checkip.dyndns.org |
CNAME
checkip.dyndns.com
|
216.146.43.71 |
- UDP Requests
-
-
192.168.56.102:57660 164.124.101.2:53
-
192.168.56.102:61459 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:56752 239.255.255.250:1900
-
192.168.56.102:56754 239.255.255.250:3702
-
192.168.56.102:56756 239.255.255.250:3702
-
192.168.56.102:56758 239.255.255.250:3702
-
GET
200
http://checkip.dyndns.org/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: checkip.dyndns.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Server: DynDNS-CheckIP/1.0.1
Connection: close
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 107
POST
302
http://robyngraphs.com.au/WP/api.php
REQUEST
RESPONSE
BODY
POST /WP/api.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/4.0 (.NET CLR 3.5.30729)
Content-Type: application/x-www-form-urlencoded
Host: robyngraphs.com.au
Content-Length: 230
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Mon, 14 Jun 2021 11:17:18 GMT
Server: Apache
Location: http://robyngraphs.com.au/cgi-sys/suspendedpage.cgi
Content-Length: 235
Connection: close
Content-Type: text/html; charset=iso-8859-1
POST
302
http://robyngraphs.com.au/WP/api.php
REQUEST
RESPONSE
BODY
POST /WP/api.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/4.0 (.NET CLR 3.5.30729)
Content-Type: application/x-www-form-urlencoded
Host: robyngraphs.com.au
Content-Length: 282
Expect: 100-continue
HTTP/1.1 302 Found
Date: Mon, 14 Jun 2021 11:17:28 GMT
Server: Apache
Location: http://robyngraphs.com.au/cgi-sys/suspendedpage.cgi
Content-Length: 235
Connection: close
Content-Type: text/html; charset=iso-8859-1
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.102:57660 -> 164.124.101.2:53 | 2012758 | ET INFO DYNAMIC_DNS Query to *.dyndns. Domain | Misc activity |
| TCP 192.168.56.102:49810 -> 131.186.161.70:80 | 2021378 | ET POLICY External IP Lookup - checkip.dyndns.org | Device Retrieving External IP Address Detected |
| TCP 131.186.161.70:80 -> 192.168.56.102:49810 | 2014932 | ET POLICY DynDNS CheckIp External IP Address Server Response | Device Retrieving External IP Address Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts