Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.goliathstoneindustries.com | 103.26.41.24 | |
| schwellenwertdaten.de | ||
| goliathstoneindustries.com | 103.26.41.24 | |
| sherylbro.net |
- UDP Requests
-
-
192.168.56.102:50839 164.124.101.2:53
-
192.168.56.102:54660 164.124.101.2:53
-
192.168.56.102:57660 164.124.101.2:53
-
192.168.56.102:61459 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:54661 239.255.255.250:3702
-
192.168.56.102:54663 239.255.255.250:3702
-
192.168.56.102:56752 239.255.255.250:1900
-
192.168.56.102:57661 239.255.255.250:3702
-
GET
301
http://goliathstoneindustries.com/873gfhi3f3r??YhkGTDta=YhkGTDta
REQUEST
RESPONSE
BODY
GET /873gfhi3f3r??YhkGTDta=YhkGTDta HTTP/1.1
Accept: */*
Accept-Language: ko
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept-Encoding: gzip, deflate
Host: goliathstoneindustries.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 25 Jun 2021 04:28:15 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: http://www.goliathstoneindustries.com/873gfhi3f3r??YhkGTDta=YhkGTDta
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49805 -> 103.26.41.24:80 | 2016879 | ET POLICY Unsupported/Fake Windows NT Version 5.0 | Potential Corporate Privacy Violation |
| TCP 192.168.56.102:49805 -> 103.26.41.24:80 | 2024508 | ET MALWARE Nemucod JS Downloader Aug 01 2017 | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts