NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.14.60 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
172.67.158.27 Active Moloch
194.169.211.111 Active Moloch
46.102.106.151 Active Moloch
95.90.186.169 Active Moloch

GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-08D4450EE4EB09C734C93A8E8E91A909.html
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-59CA53825A30DDA8641228CFB3A1898A.html
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-08D4450EE4EB09C734C93A8E8E91A909.html
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-59CA53825A30DDA8641228CFB3A1898A.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://ni2748194-1.web16.nitrado.hosting/HostStartups.exe
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C311B505088D4AC5F97AC7A0C3EA6538.html
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C1900454F8C1F17DAFA268D4AC67120F.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C311B505088D4AC5F97AC7A0C3EA6538.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C311B505088D4AC5F97AC7A0C3EA6538.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C1900454F8C1F17DAFA268D4AC67120F.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://ni2748194-1.web16.nitrado.hosting/Server.exe
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-B8A00046C7A941058E012A87473EB342.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-153E31DBDD1ACDF382491ECDBE37689C.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-B8A00046C7A941058E012A87473EB342.html
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-153E31DBDD1ACDF382491ECDBE37689C.html
REQUEST
RESPONSE
POST 200 http://46.102.106.151/panel/index.php
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-B8A00046C7A941058E012A87473EB342.html
REQUEST
RESPONSE
GET 200 http://apdocroto.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-153E31DBDD1ACDF382491ECDBE37689C.html
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
95.90.186.169 192.168.56.102 3
95.90.186.169 192.168.56.102 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:57660 -> 164.124.101.2:53 2025104 ET INFO DNS Query for Suspicious .gq Domain Potentially Bad Traffic
TCP 192.168.56.102:49806 -> 104.21.14.60:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49806 -> 104.21.14.60:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49842 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.102.106.151:80 -> 192.168.56.102:49842 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49842 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 46.102.106.151:80 -> 192.168.56.102:49855 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.102.106.151:80 -> 192.168.56.102:49855 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49855 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49863 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49863 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49861 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.102.106.151:80 -> 192.168.56.102:49861 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49861 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49806 -> 104.21.14.60:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49806 -> 104.21.14.60:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49853 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.102.106.151:80 -> 192.168.56.102:49853 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49853 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49823 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49823 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 192.168.56.102:49873 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49873 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49874 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.102.106.151:80 -> 192.168.56.102:49874 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49874 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 46.102.106.151:80 -> 192.168.56.102:49872 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.102.106.151:80 -> 192.168.56.102:49872 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.102.106.151:80 -> 192.168.56.102:49872 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49823 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49823 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 194.169.211.111:80 -> 192.168.56.102:49897 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49900 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49900 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 192.168.56.102:49873 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49873 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
UDP 192.168.56.102:54660 -> 164.124.101.2:53 2028675 ET POLICY DNS Query to DynDNS Domain *.ddns .net Potentially Bad Traffic
TCP 192.168.56.102:49913 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49913 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 194.169.211.111:80 -> 192.168.56.102:49837 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49846 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49846 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 192.168.56.102:49900 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49900 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 192.168.56.102:49928 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49928 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 192.168.56.102:49846 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49846 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
TCP 192.168.56.102:49913 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49913 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic
UDP 192.168.56.102:61998 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 192.168.56.102:49928 -> 172.67.158.27:80 2221034 SURICATA HTTP Request unrecognized authorization method Generic Protocol Command Decode
TCP 192.168.56.102:49928 -> 172.67.158.27:80 2032989 ET INFO HTTP Request to a *.gq domain Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts