NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
188.241.58.142 Active Moloch
78.142.209.253 Active Moloch
Name Response Post-Analysis Lookup
ck7.mooo.com 188.241.58.142
POST 302 http://ck7.mooo.com/6.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE
POST 302 http://ck7.mooo.com/1.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE
POST 302 http://ck7.mooo.com/2.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE
POST 302 http://ck7.mooo.com/3.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE
POST 302 http://ck7.mooo.com/4.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE
POST 302 http://ck7.mooo.com/5.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE
POST 302 http://ck7.mooo.com/7.jpg
REQUEST
RESPONSE
GET 200 http://ck7.mooo.com/cgi-sys/suspendedpage.cgi
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53 2015633 ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com Misc activity
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 188.241.58.142:80 2015634 ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts