Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 138.34.28.219 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 185.56.76.28 | Active | Moloch |
| 185.56.76.94 | Active | Moloch |
| 204.138.26.60 | Active | Moloch |
| 217.115.240.248 | Active | Moloch |
| 24.162.214.166 | Active | Moloch |
| 38.110.100.104 | Active | Moloch |
| 38.110.100.142 | Active | Moloch |
| 38.110.103.124 | Active | Moloch |
| 38.110.103.136 | Active | Moloch |
| 38.110.103.18 | Active | Moloch |
| 60.51.47.65 | Active | Moloch |
| 68.69.26.182 | Active | Moloch |
| 97.83.40.67 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
- TCP Requests
-
-
192.168.56.101:49208 138.34.28.219:443
-
192.168.56.101:49205 204.138.26.60:443
-
192.168.56.101:49214 204.138.26.60:443
-
192.168.56.101:49215 217.115.240.248:443
-
192.168.56.101:49217 24.162.214.166:443
-
192.168.56.101:49203 38.110.100.104:443
-
192.168.56.101:49206 38.110.100.142:443
-
192.168.56.101:49209 38.110.103.124:443
-
192.168.56.101:49213 38.110.103.124:443
-
192.168.56.101:49216 38.110.103.136:443
-
192.168.56.101:49207 38.110.103.18:443
-
192.168.56.101:49220 60.51.47.65:443
-
192.168.56.101:49204 97.83.40.67:443
-
- UDP Requests
-
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62327 239.255.255.250:1900
-
192.168.56.101:62329 239.255.255.250:3702
-
192.168.56.101:62331 239.255.255.250:3702
-
192.168.56.101:62333 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
https://38.110.100.104/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.100.104
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Tue, 27 Jul 2021 08:58:24 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://97.83.40.67/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 97.83.40.67
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Tue, 27 Jul 2021 08:58:26 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
404
https://204.138.26.60/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 204.138.26.60
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 27 Jun 2020 19:23:06 GMT
Server: lighttpd/1.4.39
GET
302
https://38.110.100.142/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.100.142
HTTP/1.1 302 Found
Set-Cookie: AIROS_BB5A8520CDA9=e6872b4a8367747a3b6c972652e368ab; Path=/; Version=1
Location: /cookiechecker?uri=/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
Content-Length: 0
Date: Tue, 27 Jul 2021 08:58:30 GMT
Server: lighttpd/1.4.39
GET
302
https://38.110.100.142/cookiechecker?uri=/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /cookiechecker?uri=/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.100.142
Cookie: AIROS_BB5A8520CDA9=e6872b4a8367747a3b6c972652e368ab
HTTP/1.1 302 Found
Location: /index.html
Content-Length: 0
Date: Tue, 27 Jul 2021 08:58:30 GMT
Server: lighttpd/1.4.39
GET
200
https://38.110.100.142/index.html
REQUEST
RESPONSE
BODY
GET /index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.100.142
Cookie: AIROS_BB5A8520CDA9=e6872b4a8367747a3b6c972652e368ab
HTTP/1.1 200 OK
Content-Type: text/html
Accept-Ranges: bytes
ETag: "659265186"
Last-Modified: Tue, 28 Jul 2020 11:14:16 GMT
Content-Length: 2549
Date: Tue, 27 Jul 2021 08:58:30 GMT
Server: lighttpd/1.4.39
GET
404
https://38.110.103.18/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.18
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Tue, 27 Jul 2021 08:58:32 GMT
Server: lighttpd/1.4.39
GET
302
https://138.34.28.219/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 138.34.28.219
HTTP/1.1 302 Found
Set-Cookie: AIROS_F492BFD61C49=2043d4e2181efc137aefdf251ac9969b; Path=/; Version=1
Location: /cookiechecker?uri=/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
Content-Length: 0
Date: Tue, 27 Jul 2021 08:58:34 GMT
Server: lighttpd/1.4.39
GET
302
https://138.34.28.219/cookiechecker?uri=/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /cookiechecker?uri=/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 138.34.28.219
Cookie: AIROS_F492BFD61C49=2043d4e2181efc137aefdf251ac9969b
HTTP/1.1 302 Found
Location: /index.html
Content-Length: 0
Date: Tue, 27 Jul 2021 08:58:34 GMT
Server: lighttpd/1.4.39
GET
302
https://138.34.28.219/index.html
REQUEST
RESPONSE
BODY
GET /index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 138.34.28.219
Cookie: AIROS_F492BFD61C49=2043d4e2181efc137aefdf251ac9969b
HTTP/1.1 302 Found
Location: /login.cgi?uri=/index.html
Content-Length: 0
Date: Tue, 27 Jul 2021 08:58:34 GMT
Server: lighttpd/1.4.39
GET
200
https://138.34.28.219/login.cgi?uri=/index.html
REQUEST
RESPONSE
BODY
GET /login.cgi?uri=/index.html HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 138.34.28.219
Cookie: AIROS_F492BFD61C49=2043d4e2181efc137aefdf251ac9969b
HTTP/1.1 200 OK
Set-Cookie: ui_language=en_US; Path=/; Expires=Tuesday, 1-Jan-38 00:00:00 GMT; HttpOnly
Content-Type: text/html
Transfer-Encoding: chunked
Date: Tue, 27 Jul 2021 08:58:35 GMT
Server: lighttpd/1.4.39
GET
404
https://38.110.103.124/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.124
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Mon, 06 Jul 2020 01:18:39 GMT
Server: lighttpd/1.4.39
GET
200
https://97.83.40.67/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 97.83.40.67
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Tue, 27 Jul 2021 08:59:01 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://38.110.100.104/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.100.104
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Tue, 27 Jul 2021 08:59:02 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
404
https://38.110.103.124/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.124
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Mon, 06 Jul 2020 01:19:06 GMT
Server: lighttpd/1.4.39
GET
404
https://204.138.26.60/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 204.138.26.60
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 27 Jun 2020 19:23:43 GMT
Server: lighttpd/1.4.39
GET
404
https://217.115.240.248/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 217.115.240.248
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Content-Length: 284
Content-Type: text/html
Date: Wed, 22 Nov 2017 18:31:15 GMT
Server: Xavante 2.2.0 embeded
GET
404
https://38.110.103.136/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 38.110.103.136
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Mon, 06 Jul 2020 13:37:19 GMT
Server: lighttpd/1.4.39
GET
200
https://24.162.214.166/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 24.162.214.166
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Tue, 27 Jul 2021 08:59:11 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://60.51.47.65/rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/
REQUEST
RESPONSE
BODY
GET /rob112/TEST22-PC_W617601.BBA6BBFC307B02B331A6BB3F9DB5CC1F/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 60.51.47.65
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Tue, 27 Jul 2021 08:59:43 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 204.101.4.146 | 192.168.56.101 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49203 38.110.100.104:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49207 38.110.103.18:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-B4:FB:E4:B8:30:7E/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-B4:FB:E4:B8:30:7E/emailAddress=support@ubnt.com | 2e:0f:ca:9b:3e:95:2e:8f:f6:42:a6:1e:7a:21:66:83:0d:31:cb:c1 |
|
TLSv1 192.168.56.101:49204 97.83.40.67:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49208 138.34.28.219:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-F4:92:BF:D6:1C:49/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-F4:92:BF:D6:1C:49/emailAddress=support@ubnt.com | 0f:6c:9c:c8:a9:10:1e:c8:98:3f:01:df:32:ad:f1:7f:5d:d0:4c:54 |
|
TLSv1 192.168.56.101:49205 204.138.26.60:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-80:2A:A8:FE:3F:A4/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-80:2A:A8:FE:3F:A4/emailAddress=support@ubnt.com | bd:6e:61:62:17:19:85:a8:d5:cd:95:e9:df:f4:e6:cf:e0:a6:2a:b6 |
|
TLSv1 192.168.56.101:49206 38.110.100.142:443 |
C=US, ST=NY, L=New York, O=Ubiquiti Inc., OU=Technical Support, CN=UBNT-18:E8:29:1F:F2:01/emailAddress=support@ui.com | C=US, ST=NY, L=New York, O=Ubiquiti Inc., OU=Technical Support, CN=UBNT-18:E8:29:1F:F2:01/emailAddress=support@ui.com | f1:bf:98:64:45:62:e6:de:5f:a4:b5:d9:2a:11:e4:6f:21:99:7b:61 |
|
TLSv1 192.168.56.101:49214 204.138.26.60:443 |
None | None | None |
|
TLSv1 192.168.56.101:49213 38.110.103.124:443 |
None | None | None |
|
TLSv1 192.168.56.101:49209 38.110.103.124:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:EC:48:A1/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:EC:48:A1/emailAddress=support@ubnt.com | e6:60:4a:40:4a:b9:63:85:da:e8:fc:ec:75:e2:1a:7e:85:1f:49:1e |
|
TLSv1 192.168.56.101:49217 24.162.214.166:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49220 60.51.47.65:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
|
TLSv1 192.168.56.101:49215 217.115.240.248:443 |
C=US, ST=GA, L=Canton, O=LigoWave LLC, OU=R&D, CN=LigoWave SSL CA | C=US, ST=GA, L=Canton, O=LigoWave LLC, OU=R&D, CN=LigoWave SSL CA | d3:39:ab:71:76:bb:9c:d2:1c:3e:b1:17:92:c7:3f:25:1f:25:f8:88 |
|
TLSv1 192.168.56.101:49216 38.110.103.136:443 |
C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:6C:22:98/emailAddress=support@ubnt.com | C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:6C:22:98/emailAddress=support@ubnt.com | ba:d7:95:38:aa:e6:8c:48:3e:83:06:69:20:ec:3a:a2:9c:0c:61:47 |
Snort Alerts
No Snort Alerts