Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
download2284.mediafire.com | 199.91.155.25 | |
www.mediafire.com | 104.16.203.237 |
- UDP Requests
-
-
192.168.56.102:56133 164.124.101.2:53
-
192.168.56.102:59606 164.124.101.2:53
-
192.168.56.102:60939 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:59609 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
GET
302
https://www.mediafire.com/file/p3ay4it08j1s7hp/0main.htm/file
REQUEST
RESPONSE
BODY
GET /file/p3ay4it08j1s7hp/0main.htm/file HTTP/1.1
Accept: */*
Accept-Language: ko-KR
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.mediafire.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Wed, 13 Apr 2022 04:32:41 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: ukey=um7evoz8mxeexmos5jfahegc79j8hy01; expires=Sun, 13-Apr-2042 04:32:40 GMT; Max-Age=631152000; path=/; domain=.mediafire.com; HttpOnly
Strict-Transport-Security: max-age=0
Access-Control-Allow-Origin: https://www.mediafire.com
Location: https://download2284.mediafire.com/q2junootgmfg/p3ay4it08j1s7hp/0main.htm
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Set-Cookie: __cf_bm=wSYg4WHCpc_tISq7blhPC46hhokKsXmpMBds2O2VN24-1649824361-0-Ae/6Z0bG+GQKulM77FxRyT61WKJ5XGGr/j/W8v4Tc76wYwbjeDcAJEE2qMO//EFyISfmzNGxOl8iLUBZY8UQJ2k=; path=/; expires=Wed, 13-Apr-22 05:02:41 GMT; domain=.mediafire.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 6fb17aadc969a7c5-ICN
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.102:49166 -> 199.91.155.25:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.102:49167 -> 199.91.155.25:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 199.91.155.25:443 -> 192.168.56.102:49168 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
TCP 192.168.56.102:49165 -> 104.16.202.237:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49165 104.16.202.237:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Organization Validation Secure Server CA | C=US, ST=Texas, O=MediaFire, OU=IT, CN=*.mediafire.com | 49:b6:4e:74:94:f0:7e:32:2b:c5:39:18:d0:a5:1e:69:4d:65:8f:b6 |
Snort Alerts
No Snort Alerts