Home
Result
Report
Detail Analysis

Network Analysis

Download pcap

Hosts 5 DNS 5 TCP 3 UDP 12 HTTP(S) 10 ICMP 0 IRC 0 Suricata Snort

IP Address	Status	Action
104.21.21.221	Active	Moloch
104.21.78.28	Active	Moloch
164.124.101.2	Active	Moloch
208.95.112.1	Active	Moloch
34.97.69.225	Active	Moloch

Name	Response	Post-Analysis Lookup
by.dirfgame.com	A 104.21.78.28 A 172.67.215.92	104.21.78.28
ol.gamegame.info	A 104.21.21.221 A 172.67.200.215	172.67.200.215
google.vrthcobj.com	A 34.97.69.225	34.97.69.225
google.vrthcobj.com		34.97.69.225
ip-api.com	A 208.95.112.1	208.95.112.1

TCP Requests

UDP Requests

GET 200 http://ip-api.com/json/?fields=8198

REQUEST

GET /json/?fields=8198 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Host: ip-api.com Connection: Keep-Alive Cache-Control: no-cache

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 60 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

POST 200 http://by.dirfgame.com/report7.4.php

REQUEST

POST /report7.4.php HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Host: by.dirfgame.com Content-Length: 278 Connection: Keep-Alive Cache-Control: no-cache

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:08 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cAuKG6W%2FwhBNCmBIqxjmyOnzlqQR2vDTJy3%2BSExPM1sXF5EYuaUMFA6uICkg0Ds%2FvyX2UlIUSLg8PmVxd1ZKNxn2i1j84WS7NUkG6ZVOIipqEIHxm5U0MTqoxZHT04SNdSQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67104a9f7abd0d28-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 http://ip-api.com/json/?fields=8198

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 60 Access-Control-Allow-Origin: * X-Ttl: 59 X-Rl: 43

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

POST 200 http://ol.gamegame.info/report7.4.php

REQUEST

POST /report7.4.php HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Host: ol.gamegame.info Content-Length: 278 Connection: Keep-Alive Cache-Control: no-cache

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:09 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gXYk0VBHik%2Fal6wlYfzoFwasIQ56%2FEqhhKsvi4oTdBVivnMttnsvve5MnffQEDklOL3N37ZuqHTklhoFJiTVAgH1NRgrE2jPGO6kaec1jWLgzBiBNvWt%2B9aFyr6ascZ6Le%2Fp"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67104aa66d23eae7-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 http://ip-api.com/json/?fields=8198

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 60 Access-Control-Allow-Origin: * X-Ttl: 57 X-Rl: 42

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

POST 200 http://by.dirfgame.com/report7.4.php

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:10 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HXHlhD4rpZVIXBQ9MxOdM7bi6pmQNbJfdSAa9Mi3uIV79C%2B9DtcyWOln1ZTvu%2B7%2Bl6%2B7C5D5lWHgsIi3mweFKMGIgmT7UF9ePfacF0ezCyo4KFymtVauVDcxETyM7cEACs8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67104aa9af170d28-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 http://ip-api.com/json/?fields=8198

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 60 Access-Control-Allow-Origin: * X-Ttl: 57 X-Rl: 41

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

POST 200 http://by.dirfgame.com/report7.4.php

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:10 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fT0qdHnP7qt%2FJyCkfouhwqy%2BQlJAHEDbr6iYGgS2qdY0B7UaoChj0xpdGTxf5wfsOGBu21yKDoV0cVLBTYel%2BqwfaZfQG01%2Bwk9uYHQDFhTgSAyL4IjNLzipll6aZpfbUKk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67104aad3e0d0d28-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 http://ip-api.com/json/?fields=8198

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 60 Access-Control-Allow-Origin: * X-Ttl: 56 X-Rl: 40

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

POST 200 http://by.dirfgame.com/report7.4.php

REQUEST

RESPONSE

HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 01:49:11 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j3RtyINFuzLiM88WcjOLAFWXdonLJQ9pFRo2Flqq9%2FBbqHG99F3zKUAVKTLiqdSBNHmUFkCJre%2F8qZdoHedccHLbTgeRvKJQEcq2oTm1vHkjuZ3aZ5%2BGl%2BU7S2GPCI%2F62WA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67104ab08cb30d28-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts