Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| google.com | 172.217.175.238 | |
| freightmgmt.duckdns.org | 194.5.98.207 | |
| dreamwatchevent.com | 144.208.125.220 |
- UDP Requests
-
-
192.168.56.103:53498 164.124.101.2:53
-
192.168.56.103:53893 164.124.101.2:53
-
192.168.56.103:56357 164.124.101.2:53
-
192.168.56.103:58465 164.124.101.2:53
-
192.168.56.103:63128 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:49152 239.255.255.250:3702
-
192.168.56.103:49168 239.255.255.250:1900
-
192.168.56.103:49170 239.255.255.250:3702
-
192.168.56.103:49172 239.255.255.250:3702
-
192.168.56.103:63129 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.103:123
-
GET
200
http://dreamwatchevent.com/.well-known/pki-validation/Protected%20Client.js
REQUEST
RESPONSE
BODY
GET /.well-known/pki-validation/Protected%20Client.js HTTP/1.1
Host: dreamwatchevent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Fri, 09 Sep 2022 23:58:25 GMT
content-type: application/x-javascript
last-modified: Mon, 30 Aug 2021 22:35:24 GMT
etag: "473a-612d5d2c-0;;;"
accept-ranges: bytes
content-length: 18234
date: Thu, 09 Sep 2021 23:58:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
GET
200
http://dreamwatchevent.com/.well-known/pki-validation/Attack.jpg
REQUEST
RESPONSE
BODY
GET /.well-known/pki-validation/Attack.jpg HTTP/1.1
Host: dreamwatchevent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Fri, 09 Sep 2022 23:58:28 GMT
content-type: image/jpeg
last-modified: Mon, 30 Aug 2021 22:12:00 GMT
etag: "1fb27d-612d57b0-0;;;"
accept-ranges: bytes
content-length: 2077309
date: Thu, 09 Sep 2021 23:58:28 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.103 | 142.250.207.78 | 8 | abcdefghijklmnopqrstuvwabcdefghi |
| 142.250.207.78 | 192.168.56.103 | 0 | abcdefghijklmnopqrstuvwabcdefghi |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.103:49186 194.5.98.207:691 |
None | None | None |
Snort Alerts
No Snort Alerts