Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.theplantgranny.net |
CNAME
theplantgranny.net
|
192.185.60.72 |
| www.longpostaltubes.co.uk | 45.8.225.141 |
GET
0
http://www.longpostaltubes.co.uk/dv22/?FFQL=QehU5v/fQhEMx9PnYXmuGQy2yulTqSF4FEw+gzdq1rqRDbor2eELTz6NcN54kNr6vv9fe2xg&Rb=VtxXE
REQUEST
RESPONSE
BODY
GET /dv22/?FFQL=QehU5v/fQhEMx9PnYXmuGQy2yulTqSF4FEw+gzdq1rqRDbor2eELTz6NcN54kNr6vv9fe2xg&Rb=VtxXE HTTP/1.1
Host: www.longpostaltubes.co.uk
Connection: close
HTTP/1.1 404 Not Found
Date: Mon, 05 Dec 2022 08:04:06 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://www.longpostaltubes.co.uk/wp-json/>; rel="https://api.w.org/"
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET
301
http://www.theplantgranny.net/dv22/?FFQL=eYdgt7I7vhFKcy7r5qfDCH2+TYsM6wqkdqwrIsTBKIeZJgk/012iFxiRM98z/2Lbn/fB5hWY&Rb=VtxXE
REQUEST
RESPONSE
BODY
GET /dv22/?FFQL=eYdgt7I7vhFKcy7r5qfDCH2+TYsM6wqkdqwrIsTBKIeZJgk/012iFxiRM98z/2Lbn/fB5hWY&Rb=VtxXE HTTP/1.1
Host: www.theplantgranny.net
Connection: close
HTTP/1.1 301 Moved Permanently
Date: Mon, 05 Dec 2022 08:04:27 GMT
Server: nginx/1.23.2
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Redirect-By: WordPress
Location: http://theplantgranny.net/dv22/?FFQL=eYdgt7I7vhFKcy7r5qfDCH2+TYsM6wqkdqwrIsTBKIeZJgk/012iFxiRM98z/2Lbn/fB5hWY&Rb=VtxXE
X-Endurance-Cache-Level: 2
X-nginx-cache: WordPress
X-Server-Cache: true
X-Proxy-Cache: MISS
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49168 -> 192.185.60.72:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49168 -> 192.185.60.72:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49168 -> 192.185.60.72:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49165 -> 45.8.225.141:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49165 -> 45.8.225.141:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49165 -> 45.8.225.141:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts