Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 102.68.85.100 | Active | Moloch |
| 103.26.205.122 | Active | Moloch |
| 117.20.41.198 | Active | Moloch |
| 142.215.208.235 | Active | Moloch |
| 147.139.41.121 | Active | Moloch |
| 147.75.48.214 | Active | Moloch |
| 147.75.92.40 | Active | Moloch |
| 156.38.206.18 | Active | Moloch |
| 156.38.206.21 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 177.154.156.125 | Active | Moloch |
| 195.201.80.82 | Active | Moloch |
| 27.111.161.150 | Active | Moloch |
| 27.111.161.152 | Active | Moloch |
| 47.74.84.54 | Active | Moloch |
| 47.91.24.164 | Active | Moloch |
| 78.140.180.43 | Active | Moloch |
| 88.212.232.132 | Active | Moloch |
| 91.199.212.52 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| download.mql5.com | 27.111.161.152 | |
| content.mql5.com | 27.111.161.150 | |
| api9.mql5.net | 147.75.92.40 | |
| api14.mql5.net |
A
0.0.0.0
|
0.0.0.0 |
| crt.usertrust.com |
CNAME
crt.comodoca.com
|
91.199.212.52 |
- TCP Requests
-
-
192.168.56.101:49233 102.68.85.100:443
-
192.168.56.101:49244 103.26.205.122:443
-
192.168.56.101:49224 117.20.41.198:443
-
192.168.56.101:49228 142.215.208.235:443
-
192.168.56.101:49245 147.75.48.214:443
-
192.168.56.101:49240 147.75.92.40:443api9.mql5.net
-
192.168.56.101:49248 147.75.92.40:443api9.mql5.net
-
192.168.56.101:49251 147.75.92.40:443api9.mql5.net
-
192.168.56.101:49247 156.38.206.18:443
-
192.168.56.101:49250 156.38.206.18:443
-
192.168.56.101:49232 177.154.156.125:443
-
192.168.56.101:49231 195.201.80.82:443
-
192.168.56.101:49162 27.111.161.150:443content.mql5.com
-
192.168.56.101:49170 27.111.161.152:443download.mql5.com
-
192.168.56.101:49234 27.111.161.152:443download.mql5.com
-
192.168.56.101:49223 78.140.180.43:443
-
192.168.56.101:49226 88.212.232.132:443
-
192.168.56.101:49235 91.199.212.52:80crt.usertrust.com
-
192.168.56.101:49237 91.199.212.52:80crt.usertrust.com
-
192.168.56.101:49238 91.199.212.52:80crt.usertrust.com
-
192.168.56.101:49239 91.199.212.52:80crt.usertrust.com
-
- UDP Requests
-
-
192.168.56.101:53258 164.124.101.2:53
-
192.168.56.101:55871 164.124.101.2:53
-
192.168.56.101:57609 164.124.101.2:53
-
192.168.56.101:59417 164.124.101.2:53
-
192.168.56.101:60131 164.124.101.2:53
-
192.168.56.101:61681 164.124.101.2:53
-
192.168.56.101:62062 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
8.8.8.8:53 192.168.56.101:57609
-
GET
200
http://crt.usertrust.com/USERTrustECCAddTrustCA.crt
REQUEST
RESPONSE
BODY
GET /USERTrustECCAddTrustCA.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crt.usertrust.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Nov 2021 03:53:12 GMT
Content-Type: application/pkix-cert
Content-Length: 983
Connection: keep-alive
Last-Modified: Tue, 12 Mar 2019 00:00:00 GMT
ETag: "5c86f680-3d7"
X-CCACDN-Mirror-ID: sscrl1
Cache-Control: max-age=14400, s-maxage=3600
X-CCACDN-Proxy-ID: scdpinlb4
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
GET
200
http://crt.usertrust.com/USERTrustECCAddTrustCA.crt
REQUEST
RESPONSE
BODY
GET /USERTrustECCAddTrustCA.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crt.usertrust.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Nov 2021 03:53:12 GMT
Content-Type: application/pkix-cert
Content-Length: 983
Connection: keep-alive
Last-Modified: Tue, 12 Mar 2019 00:00:00 GMT
ETag: "5c86f680-3d7"
X-CCACDN-Mirror-ID: sscrl1
Cache-Control: max-age=14400, s-maxage=3600
X-CCACDN-Proxy-ID: scdpinlb3
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
GET
200
http://crt.usertrust.com/USERTrustECCAddTrustCA.crt
REQUEST
RESPONSE
BODY
GET /USERTrustECCAddTrustCA.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crt.usertrust.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Nov 2021 03:53:12 GMT
Content-Type: application/pkix-cert
Content-Length: 983
Connection: keep-alive
Last-Modified: Tue, 12 Mar 2019 00:00:00 GMT
ETag: "5c86f680-3d7"
X-CCACDN-Mirror-ID: sscrl1
Cache-Control: max-age=14400, s-maxage=3600
X-CCACDN-Proxy-ID: scdpinlb4
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
GET
200
http://crt.usertrust.com/USERTrustECCAddTrustCA.crt
REQUEST
RESPONSE
BODY
GET /USERTrustECCAddTrustCA.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crt.usertrust.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Nov 2021 03:53:12 GMT
Content-Type: application/pkix-cert
Content-Length: 983
Connection: keep-alive
Last-Modified: Tue, 12 Mar 2019 00:00:00 GMT
ETag: "5c86f680-3d7"
X-CCACDN-Mirror-ID: sscrl1
Cache-Control: max-age=14400, s-maxage=3600
X-CCACDN-Proxy-ID: scdpinlb4
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.2 192.168.56.101:49223 78.140.180.43:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49170 27.111.161.152:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.com | 11:c6:6f:e9:03:73:a1:89:6a:e8:05:1b:7a:8a:e2:f6:bc:94:09:61 |
|
TLS 1.2 192.168.56.101:49224 117.20.41.198:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49233 102.68.85.100:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49231 195.201.80.82:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49248 147.75.92.40:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49245 147.75.48.214:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49234 27.111.161.152:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49240 147.75.92.40:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49228 142.215.208.235:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49226 88.212.232.132:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49244 103.26.205.122:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49162 27.111.161.150:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.com | 11:c6:6f:e9:03:73:a1:89:6a:e8:05:1b:7a:8a:e2:f6:bc:94:09:61 |
|
TLS 1.2 192.168.56.101:49251 147.75.92.40:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49247 156.38.206.18:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49232 177.154.156.125:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
|
TLS 1.2 192.168.56.101:49250 156.38.206.18:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA | CN=*.mql5.net | 2b:27:bf:69:5f:ae:13:cd:07:b9:0a:d1:5a:b0:51:f3:7b:ab:69:0d |
Snort Alerts
No Snort Alerts