Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| google.com | 172.217.175.238 | |
| freightmgmt.duckdns.org | 194.5.98.207 | |
| dreamwatchevent.com | 144.208.125.220 |
- UDP Requests
-
-
192.168.56.102:52062 164.124.101.2:53
-
192.168.56.102:52336 164.124.101.2:53
-
192.168.56.102:58838 164.124.101.2:53
-
192.168.56.102:64034 164.124.101.2:53
-
192.168.56.102:64995 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:49164 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
GET
200
http://dreamwatchevent.com/.well-known/pki-validation/Attack.jpg
REQUEST
RESPONSE
BODY
GET /.well-known/pki-validation/Attack.jpg HTTP/1.1
Host: dreamwatchevent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Fri, 09 Sep 2022 11:00:48 GMT
content-type: image/jpeg
last-modified: Mon, 30 Aug 2021 22:12:00 GMT
etag: "1fb27d-612d57b0-0;;;"
accept-ranges: bytes
content-length: 2077309
date: Thu, 09 Sep 2021 11:00:48 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.102 | 216.58.200.78 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 216.58.200.78 | 192.168.56.102 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.102:49174 194.5.98.207:691 |
None | None | None |
Snort Alerts
No Snort Alerts