Home
Result
Report
Detail Analysis

Network Analysis

Download pcap

Hosts 4 DNS 2 TCP 1 UDP 7 HTTP(S) 17 ICMP 0 IRC 0 Suricata Snort

IP Address	Status	Action
104.20.67.143	Active	Moloch
164.124.101.2	Active	Moloch
18.197.239.109	Active	Moloch
3.69.115.178	Active	Moloch

Name	Response	Post-Analysis Lookup
6.tcp.eu.ngrok.io	A 3.69.115.178 A 18.197.239.109	3.68.171.119
pastebin.com	A 104.20.67.143 A 172.67.34.170 A 104.20.68.143	172.67.34.170

TCP Requests
- 192.168.56.101:49164 104.20.67.143:443
  pastebin.com

UDP Requests

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com Connection: Keep-Alive

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:28 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9fed81be17cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:33 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 5 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9fefbaf427cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 10 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ff18f8fe7cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:42 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 14 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ff2fbb547cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:45 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 17 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ff452c937cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:49 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 21 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ff5edce17cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:56:56 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 28 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ff88ffd67cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:01 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 33 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ffa84a107cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:08 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 40 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ffd40ce37cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 44 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aa9ffef0b877cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:19 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 51 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa001668a57cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:23 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 55 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa0032b9407cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:27 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 59 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa004c7e727cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:31 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 63 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa00665d9d7cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 70 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa008e6df17cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:42 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 74 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa00a8bd987cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 https://pastebin.com/raw/x7kBE3DJ

REQUEST

GET /raw/x7kBE3DJ HTTP/1.1 User-Agent: <agent> Host: pastebin.com

RESPONSE

HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 00:57:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 80 Last-Modified: Mon, 20 Mar 2023 00:56:28 GMT Server: cloudflare CF-RAY: 7aaa00cf0fa07cc2-LAX

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 104.20.67.143:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.101:54148 -> 164.124.101.2:53	2022642	ET INFO DNS Query to a *.ngrok domain (ngrok.io)	Potential Corporate Privacy Violation
UDP 192.168.56.101:53004 -> 164.124.101.2:53	2022642	ET INFO DNS Query to a *.ngrok domain (ngrok.io)	Potential Corporate Privacy Violation

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49164 104.20.67.143:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	73:48:5b:25:de:05:30:ba:9f:20:ba:6f:57:3d:cb:35:e9:86:ab:a8

Snort Alerts

No Snort Alerts