NetWork | ZeroBOX

IP Address	Status	Action
103.56.98.73	Active	Moloch
104.18.27.58	Active	Moloch
104.21.75.49	Active	Moloch
143.95.1.174	Active	Moloch
164.124.101.2	Active	Moloch
165.32.109.217	Active	Moloch
185.210.145.38	Active	Moloch
188.166.46.127	Active	Moloch
209.99.40.222	Active	Moloch
34.251.91.168	Active	Moloch
34.98.99.30	Active	Moloch
35.213.169.61	Active	Moloch
52.37.245.235	Active	Moloch
88.214.207.96	Active	Moloch

Name	Response	Post-Analysis Lookup
www.smartgadgetscompare.com	CNAME smartgadgetscompare.com A 185.210.145.38	185.210.145.38
www.corvusexpeditii.xyz	A 88.214.207.96	88.214.207.96
www.digitaldreamcloud.net	A 52.214.224.110 CNAME home.portfolioboxdns.com A 34.251.91.168 A 52.213.55.157	52.214.224.110
www.5559913.win	CNAME 5559913.win A 188.166.46.127	188.166.46.127
www.onlinewritingjobs.net	A 35.213.169.61	35.213.169.61
www.garageair.agency	A 172.67.213.197 A 104.21.75.49	172.67.213.197
www.necesryaou.com	A 104.18.27.58 A 104.18.26.58 CNAME shops.myfunpinpin.com	104.18.26.58
www.baohiemtv24h.com	A 209.99.40.222	209.99.40.222
www.nobodybutgod.com	A 34.98.99.30 CNAME nobodybutgod.com	34.98.99.30
www.tangerineinit.com	A 44.238.240.115 A 52.37.245.235	44.238.240.115
www.egyptian-museum.com	CNAME egyptian-museum.com A 143.95.1.174	143.95.1.174
www.ara7z.com	A 103.56.98.73	103.56.98.73
www.maviesurdvd.com
www.era636.com	A 165.32.109.217	165.32.109.217

TCP Requests

UDP Requests

GET 404 http://www.garageair.agency/ga6b/?DVEl=d08S4xcN/NMsorWpXwRlyCCH66HZh3etKhFBY5TZ8MkBXXhOwsqcJfUvANfm4lRK3xvcJJRx&1bO8Ax=pFNTGZ90snzLa4C0

GET 302 http://www.5559913.win/ga6b/?DVEl=BsLI4B+bmIypp6VG9i1mvBr3FbP6MnOeaOpeEVRsQMY9+2loXlkdnmFwfncWgaUkhHBh2x3h&1bO8Ax=pFNTGZ90snzLa4C0

GET 409 http://www.necesryaou.com/ga6b/?DVEl=Z3o6N93v6CU4m7XtA/lbT1e4xE/jsIueflbFRezDyVtxMYEukOv94ScBegi/ZpW+oVO0nzHV&1bO8Ax=pFNTGZ90snzLa4C0

GET 500 http://www.egyptian-museum.com/ga6b/?DVEl=CYKd0A9ffzzmh+HMixfnmJt+Ibe3PgwQT1IowcrJSMkSzDwRXwABXy8G05QumwrEDOfj2gVO&1bO8Ax=pFNTGZ90snzLa4C0

GET 301 http://www.onlinewritingjobs.net/ga6b/?DVEl=PI3t5I/vLPjLEXSAiMassyghn8jG+EohIXjBFkJ1Bgr3IKLvgafQ0xYRNHrG7F5KwDP0G4jF&1bO8Ax=pFNTGZ90snzLa4C0

GET 307 http://www.tangerineinit.com/ga6b/?DVEl=CgQkCL4kNOXVaMWaW+W+7tG2VuScNWe1RIrYKb/ikW2Nwi/NJBz1hnm9GQ2J2lMDdzGUFZgw&1bO8Ax=pFNTGZ90snzLa4C0

GET 444 http://www.digitaldreamcloud.net/ga6b/?DVEl=5WGPHl4VPD01j8M9M+tOINDYD63xyRqqO/w0s3LW3P/Qu5xC80vS+vfuMtj60mCVXiqL9STg&1bO8Ax=pFNTGZ90snzLa4C0

GET 200 http://www.baohiemtv24h.com/ga6b/?DVEl=6dQVu8UHcZgaj0y03GzvAhfNwH0MHXa5ZY8rhbUdbCaY8PlbGz89x08imuD5bjryCUUXVHy+&1bO8Ax=pFNTGZ90snzLa4C0

GET 200 http://www.ara7z.com/ga6b/?DVEl=f8p3ixvuysstkVkbxkSLsyQ08m5iiUSHUSQ+dEucd72/naUGjvA4vd8t8r7qlazlF5SpiXNT&1bO8Ax=pFNTGZ90snzLa4C0

GET 403 http://www.nobodybutgod.com/ga6b/?DVEl=BS+Mkr60hnaz2VUqn6F4jElENEwbATWztr1txOlCDy4YTJ8rldrX7GuvTHEqc04l9LT0WVoV&1bO8Ax=pFNTGZ90snzLa4C0

GET 302 http://www.corvusexpeditii.xyz/ga6b/?DVEl=7T8vebYEf2GnHvqeOh/0TgFFgNzfckxTcBNzZeSGzjlNLlbJ9NDPNSTqSdLNqh5j9wLWy4Dd&1bO8Ax=pFNTGZ90snzLa4C0

GET 404 http://www.smartgadgetscompare.com/ga6b/?DVEl=vDaGXYd6gjLCQTqwOPGPy5LvomfttahAahHE85Q1VhlijdJF30llx7sZQyFNH9wmHXEWSldG&1bO8Ax=pFNTGZ90snzLa4C0

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 104.21.75.49:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 104.21.75.49:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 104.21.75.49:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 103.56.98.73:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 103.56.98.73:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 103.56.98.73:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 104.18.27.58:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 104.18.27.58:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 104.18.27.58:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.210.145.38:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.210.145.38:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.210.145.38:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.98.99.30:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.98.99.30:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.98.99.30:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 143.95.1.174:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 143.95.1.174:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 188.166.46.127:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 143.95.1.174:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 188.166.46.127:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 188.166.46.127:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 52.37.245.235:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 52.37.245.235:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 52.37.245.235:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 209.99.40.222:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 209.99.40.222:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 209.99.40.222:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 88.214.207.96:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 88.214.207.96:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 88.214.207.96:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 88.214.207.96:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 34.251.91.168:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.251.91.168:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.251.91.168:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.213.169.61:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.213.169.61:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.213.169.61:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts