Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 154.58.23.192 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 185.56.76.108 | Active | Moloch |
| 185.56.76.28 | Active | Moloch |
| 204.138.26.60 | Active | Moloch |
| 24.162.214.166 | Active | Moloch |
| 38.110.100.104 | Active | Moloch |
| 38.110.103.113 | Active | Moloch |
| 38.110.103.124 | Active | Moloch |
| 45.36.99.184 | Active | Moloch |
| 60.51.47.65 | Active | Moloch |
| 68.69.26.182 | Active | Moloch |
| 80.15.2.105 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
- TCP Requests
-
-
192.168.56.101:49542 154.58.23.192:443
-
192.168.56.101:49536 185.56.76.108:443
-
192.168.56.101:49528 185.56.76.28:443
-
192.168.56.101:49533 185.56.76.28:443
-
192.168.56.101:49541 185.56.76.28:443
-
192.168.56.101:49525 204.138.26.60:443
-
192.168.56.101:49534 204.138.26.60:443
-
192.168.56.101:49540 24.162.214.166:443
-
192.168.56.101:49530 38.110.100.104:443
-
192.168.56.101:49539 38.110.103.113:443
-
192.168.56.101:49529 38.110.103.124:443
-
192.168.56.101:49531 38.110.103.124:443
-
192.168.56.101:49521 45.36.99.184:443
-
192.168.56.101:49537 60.51.47.65:443
-
192.168.56.101:49543 80.15.2.105:443
-
- UDP Requests
-
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
https://45.36.99.184/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 45.36.99.184
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sat, 03 Jul 2021 09:30:23 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
404
https://204.138.26.60/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 204.138.26.60
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Wed, 01 Jul 2020 10:16:32 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.28/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
HTTP/1.1 302 Found
Set-Cookie: AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333; Path=/; Version=1
Location: /cookiechecker?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
Content-Length: 0
Date: Fri, 17 Jul 2020 13:06:10 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.28/cookiechecker?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /cookiechecker?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 302 Found
Location: /index.html
Content-Length: 0
Date: Fri, 17 Jul 2020 13:06:10 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.28/index.html
REQUEST
RESPONSE
BODY
GET /index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 302 Found
Location: /login.cgi?uri=/index.html
Content-Length: 0
Date: Fri, 17 Jul 2020 13:06:11 GMT
Server: lighttpd/1.4.39
GET
200
https://185.56.76.28/login.cgi?uri=/index.html
REQUEST
RESPONSE
BODY
GET /login.cgi?uri=/index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 200 OK
Set-Cookie: ui_language=en_US; Path=/; Expires=Tuesday, 1-Jan-38 00:00:00 GMT; HttpOnly
Content-Type: text/html
Transfer-Encoding: chunked
Date: Fri, 17 Jul 2020 13:06:12 GMT
Server: lighttpd/1.4.39
GET
404
https://38.110.103.124/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.124
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 27 Jun 2020 03:21:15 GMT
Server: lighttpd/1.4.39
GET
200
https://38.110.100.104/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.100.104
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sat, 03 Jul 2021 09:30:42 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
404
https://38.110.103.124/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.124
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 27 Jun 2020 03:21:20 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.28/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: ui_language=en_US; AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 302 Found
Location: /login.cgi?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
Content-Length: 0
Date: Fri, 17 Jul 2020 13:06:27 GMT
Server: lighttpd/1.4.39
GET
200
https://185.56.76.28/login.cgi?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /login.cgi?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: ui_language=en_US; AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 200 OK
Set-Cookie: ui_language=en_US; Path=/; Expires=Tuesday, 1-Jan-38 00:00:00 GMT; HttpOnly
Content-Type: text/html
Transfer-Encoding: chunked
Date: Fri, 17 Jul 2020 13:06:28 GMT
Server: lighttpd/1.4.39
GET
404
https://204.138.26.60/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 204.138.26.60
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Wed, 01 Jul 2020 10:17:02 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.108/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.108
HTTP/1.1 302 Found
Set-Cookie: AIROS_788A20CC5247=0c397b9fca85df48f9565149dbdcda0a; Path=/; Version=1
Location: /cookiechecker?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
Content-Length: 0
Date: Tue, 21 Jul 2020 16:28:05 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.108/cookiechecker?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /cookiechecker?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.108
Cookie: AIROS_788A20CC5247=0c397b9fca85df48f9565149dbdcda0a
HTTP/1.1 302 Found
Location: /index.html
Content-Length: 0
Date: Tue, 21 Jul 2020 16:28:06 GMT
Server: lighttpd/1.4.39
GET
302
https://185.56.76.108/index.html
REQUEST
RESPONSE
BODY
GET /index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.108
Cookie: AIROS_788A20CC5247=0c397b9fca85df48f9565149dbdcda0a
HTTP/1.1 302 Found
Location: /login.cgi?uri=/index.html
Content-Length: 0
Date: Tue, 21 Jul 2020 16:28:06 GMT
Server: lighttpd/1.4.39
GET
200
https://185.56.76.108/login.cgi?uri=/index.html
REQUEST
RESPONSE
BODY
GET /login.cgi?uri=/index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.108
Cookie: AIROS_788A20CC5247=0c397b9fca85df48f9565149dbdcda0a
HTTP/1.1 200 OK
Set-Cookie: ui_language=en_US; Path=/; Expires=Tuesday, 1-Jan-38 00:00:00 GMT; HttpOnly
Content-Type: text/html
Transfer-Encoding: chunked
Date: Tue, 21 Jul 2020 16:28:07 GMT
Server: lighttpd/1.4.39
GET
200
https://60.51.47.65/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 60.51.47.65
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Sat, 03 Jul 2021 09:31:03 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
404
https://38.110.103.113/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.113
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 27 Jun 2020 03:21:41 GMT
Server: lighttpd/1.4.39
GET
200
https://24.162.214.166/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 24.162.214.166
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sat, 03 Jul 2021 09:31:07 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
302
https://185.56.76.28/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: ui_language=en_US; AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 302 Found
Location: /login.cgi?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
Content-Length: 0
Date: Fri, 17 Jul 2020 13:06:49 GMT
Server: lighttpd/1.4.39
GET
200
https://185.56.76.28/login.cgi?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /login.cgi?uri=/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.76.28
Cookie: ui_language=en_US; AIROS_0418D660A958=e6ef808bd8a3bc06c058b82d3d20a333
HTTP/1.1 200 OK
Set-Cookie: ui_language=en_US; Path=/; Expires=Tuesday, 1-Jan-38 00:00:00 GMT; HttpOnly
Content-Type: text/html
Transfer-Encoding: chunked
Date: Fri, 17 Jul 2020 13:06:50 GMT
Server: lighttpd/1.4.39
GET
200
https://154.58.23.192/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 154.58.23.192
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Sat, 03 Jul 2021 09:31:18 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://80.15.2.105/rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/
REQUEST
RESPONSE
BODY
GET /rob102/TEST22-PC_W617601.33715B34B330B01BAE9FB711D913F2BB/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 80.15.2.105
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Sat, 03 Jul 2021 09:31:20 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49536 185.56.76.108:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:CC:52:47/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:CC:52:47/emailAddress=support@ubnt.com | d6:b9:fb:f6:d3:46:bd:b4:fb:8e:3e:15:46:aa:1d:93:85:15:ad:74 |
|
TLSv1 192.168.56.101:49529 38.110.103.124:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:EC:48:A1/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:EC:48:A1/emailAddress=support@ubnt.com | e6:60:4a:40:4a:b9:63:85:da:e8:fc:ec:75:e2:1a:7e:85:1f:49:1e |
|
TLSv1 192.168.56.101:49530 38.110.100.104:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49539 38.110.103.113:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:10:C4:5A/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:10:C4:5A/emailAddress=support@ubnt.com | f8:a6:1d:83:c7:74:cb:aa:74:13:1b:31:74:93:a5:b4:a4:1b:bd:c5 |
|
TLSv1 192.168.56.101:49541 185.56.76.28:443 |
None | None | None |
|
TLSv1 192.168.56.101:49540 24.162.214.166:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49537 60.51.47.65:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
|
TLSv1 192.168.56.101:49525 204.138.26.60:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-80:2A:A8:FE:3F:A4/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-80:2A:A8:FE:3F:A4/emailAddress=support@ubnt.com | bd:6e:61:62:17:19:85:a8:d5:cd:95:e9:df:f4:e6:cf:e0:a6:2a:b6 |
|
TLSv1 192.168.56.101:49531 38.110.103.124:443 |
None | None | None |
|
TLSv1 192.168.56.101:49521 45.36.99.184:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49528 185.56.76.28:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-04:18:D6:60:A9:58/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-04:18:D6:60:A9:58/emailAddress=support@ubnt.com | d5:f6:fc:d3:3f:5a:28:7b:3e:ab:0b:d8:e8:cf:3e:cc:3f:85:7a:af |
|
TLSv1 192.168.56.101:49543 80.15.2.105:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
|
TLSv1 192.168.56.101:49533 185.56.76.28:443 |
None | None | None |
|
TLSv1 192.168.56.101:49534 204.138.26.60:443 |
None | None | None |
|
TLSv1 192.168.56.101:49542 154.58.23.192:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
Snort Alerts
No Snort Alerts