Network Analysis
IP Address | Status | Action |
---|---|---|
161.97.163.8 | Active | Moloch |
164.124.101.2 | Active | Moloch |
192.187.111.222 | Active | Moloch |
199.192.30.147 | Active | Moloch |
213.145.228.111 | Active | Moloch |
45.33.6.223 | Active | Moloch |
72.14.178.174 | Active | Moloch |
78.141.192.145 | Active | Moloch |
85.187.128.34 | Active | Moloch |
91.195.240.94 | Active | Moloch |
94.176.104.86 | Active | Moloch |
- TCP Requests
-
-
192.168.56.101:49171 161.97.163.8:80www.bitservicesltd.com
-
192.168.56.101:49172 161.97.163.8:80www.bitservicesltd.com
-
192.168.56.101:49177 192.187.111.222:80www.younrock.com
-
192.168.56.101:49178 192.187.111.222:80www.younrock.com
-
192.168.56.101:49181 199.192.30.147:80www.shapshit.xyz
-
192.168.56.101:49182 199.192.30.147:80www.shapshit.xyz
-
192.168.56.101:49175 213.145.228.111:80www.energyservicestation.com
-
192.168.56.101:49176 213.145.228.111:80www.energyservicestation.com
-
192.168.56.101:49168 45.33.6.223:80www.sqlite.org
-
192.168.56.101:49179 72.14.178.174:80www.thewildphotographer.co.uk
-
192.168.56.101:49180 72.14.178.174:80www.thewildphotographer.co.uk
-
192.168.56.101:49169 78.141.192.145:80www.gritslab.com
-
192.168.56.101:49170 78.141.192.145:80www.gritslab.com
-
192.168.56.101:49183 85.187.128.34:80www.thedivinerudraksha.com
-
192.168.56.101:49184 85.187.128.34:80www.thedivinerudraksha.com
-
192.168.56.101:49173 91.195.240.94:80www.222ambking.org
-
192.168.56.101:49174 91.195.240.94:80www.222ambking.org
-
192.168.56.101:49167 94.176.104.86:80www.white-hat.uk
-
- UDP Requests
-
-
192.168.56.101:52797 164.124.101.2:53
-
192.168.56.101:52815 164.124.101.2:53
-
192.168.56.101:53004 164.124.101.2:53
-
192.168.56.101:53850 164.124.101.2:53
-
192.168.56.101:54148 164.124.101.2:53
-
192.168.56.101:54883 164.124.101.2:53
-
192.168.56.101:55146 164.124.101.2:53
-
192.168.56.101:58297 164.124.101.2:53
-
192.168.56.101:59002 164.124.101.2:53
-
192.168.56.101:61950 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:55149 239.255.255.250:1900
-
8.8.8.8:53 192.168.56.101:53850
-
GET
301
http://www.white-hat.uk/u2kb/?zT=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.white-hat.uk
Connection: close
HTTP/1.1 301 Moved Permanently
Connection: close
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
x-redirect-by: WordPress
location: http://white-hat.uk/u2kb/?zT=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&DcmN_=UH29gni5kTv7LF
x-litespeed-cache: miss
content-length: 0
date: Thu, 20 Apr 2023 08:38:13 GMT
server: LiteSpeed
GET
200
http://www.sqlite.org/2018/sqlite-dll-win32-x86-3260000.zip
REQUEST
RESPONSE
BODY
GET /2018/sqlite-dll-win32-x86-3260000.zip HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E)
Host: www.sqlite.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: keep-alive
Date: Thu, 20 Apr 2023 08:38:16 GMT
Last-Modified: Tue, 05 Feb 2019 16:46:41 GMT
Cache-Control: max-age=120
ETag: "m5c59bdf1s747df"
Content-type: application/zip; charset=utf-8
Content-length: 477151
POST
404
http://www.gritslab.com/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.gritslab.com
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.gritslab.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.gritslab.com/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Server: nginx/1.18.0
Date: Thu, 20 Apr 2023 08:38:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Content-Encoding: gzip
GET
404
http://www.gritslab.com/u2kb/?zT=ydCzFiH7iMWnz6xHMKiyYVGDKfWH5+fYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNezbHZCh47jo+mhlV2uXG5eH60=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=ydCzFiH7iMWnz6xHMKiyYVGDKfWH5+fYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNezbHZCh47jo+mhlV2uXG5eH60=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.gritslab.com
Connection: close
HTTP/1.1 404 Not Found
Server: nginx/1.18.0
Date: Thu, 20 Apr 2023 08:38:31 GMT
Content-Type: text/html
Content-Length: 153
Connection: close
POST
404
http://www.bitservicesltd.com/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.bitservicesltd.com
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.bitservicesltd.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.bitservicesltd.com/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 20 Apr 2023 08:38:37 GMT
Content-Type: text/html
Content-Length: 199
Connection: close
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
GET
404
http://www.bitservicesltd.com/u2kb/?zT=rr+sOBvEXsBdGevUk44F/k+BAr88zC1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXz4UaWEmNABCelIWOCZ3yhH4Z4=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=rr+sOBvEXsBdGevUk44F/k+BAr88zC1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXz4UaWEmNABCelIWOCZ3yhH4Z4=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.bitservicesltd.com
Connection: close
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 20 Apr 2023 08:38:39 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
POST
403
http://www.222ambking.org/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.222ambking.org
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.222ambking.org
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.222ambking.org/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 403 Forbidden
date: Thu, 20 Apr 2023 08:38:45 GMT
content-type: text/html
transfer-encoding: chunked
vary: Accept-Encoding
server: NginX
content-encoding: gzip
connection: close
GET
200
http://www.222ambking.org/u2kb/?zT=IEUpLmGg2fqLmrhwD8IHX/zhiiNjbOQDFcodV2ACJcW4bHSQscR3Nc4uRx31p3m0gGv03uToPch8hDrce1eNAdUBSmpSNalx6DQXGQo=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=IEUpLmGg2fqLmrhwD8IHX/zhiiNjbOQDFcodV2ACJcW4bHSQscR3Nc4uRx31p3m0gGv03uToPch8hDrce1eNAdUBSmpSNalx6DQXGQo=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.222ambking.org
Connection: close
HTTP/1.1 200 OK
date: Thu, 20 Apr 2023 08:38:48 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.17
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_zpxZYka9mNYeKPhgyXUOqiecgIaTKOEZT7xtnrCpk5y/rn/z/0FBgZw/Z66qlRrhpGf5DNtmNO0Jv2xDguoLbA==
last-modified: Thu, 20 Apr 2023 08:38:48 GMT
x-cache-miss-from: parking-7486c947f4-5vgs7
server: NginX
connection: close
POST
404
http://www.energyservicestation.com/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.energyservicestation.com
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.energyservicestation.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.energyservicestation.com/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Thu, 20 Apr 2023 08:38:54 GMT
Server: Apache/2.4.56 (Debian)
X-Powered-By: PHP/7.4.33
Strict-Transport-Security: max-age=63072000; preload
Connection: Upgrade, close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET
404
http://www.energyservicestation.com/u2kb/?zT=IK59b/MdFRha+CUVM3V2TqbXgrTjD6F66TLC1fPPNwLnZq29gpb1hRWNlrDr258EhEsSnFmalKQEmudxTrusBmUmj2xyJgahFTdaUmU=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=IK59b/MdFRha+CUVM3V2TqbXgrTjD6F66TLC1fPPNwLnZq29gpb1hRWNlrDr258EhEsSnFmalKQEmudxTrusBmUmj2xyJgahFTdaUmU=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.energyservicestation.com
Connection: close
HTTP/1.1 404 Not Found
Date: Thu, 20 Apr 2023 08:38:57 GMT
Server: Apache/2.4.56 (Debian)
X-Powered-By: PHP/7.4.33
Strict-Transport-Security: max-age=63072000; preload
Connection: Upgrade, close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
POST
302
http://www.younrock.com/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.younrock.com
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.younrock.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.younrock.com/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Thu, 20 Apr 2023 08:39:02 GMT
location: http://survey-smiles.com
server: nginx
set-cookie: sid=cdee95e2-df56-11ed-a9fa-d32dfbd958f4; path=/; domain=.younrock.com; expires=Tue, 08 May 2091 11:53:10 GMT; max-age=2147483647; HttpOnly
GET
200
http://www.younrock.com/u2kb/?zT=05tPwqSdqXO2xf32BmsnsHpgCfZIa2c80hhB3sQ3FFDNPs5AZDU6TyUQmX911UO6Ssjq2b6k9nBD4uDOZrqd7XHQTF+IIpbM/DoOhU4=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=05tPwqSdqXO2xf32BmsnsHpgCfZIa2c80hhB3sQ3FFDNPs5AZDU6TyUQmX911UO6Ssjq2b6k9nBD4uDOZrqd7XHQTF+IIpbM/DoOhU4=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.younrock.com
Connection: close
HTTP/1.1 200 OK
accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 615
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 08:39:05 GMT
server: nginx
set-cookie: sid=cf8532d0-df56-11ed-b9f3-d32d613ad0fd; path=/; domain=.younrock.com; expires=Tue, 08 May 2091 11:53:13 GMT; max-age=2147483647; HttpOnly
POST
200
http://www.thewildphotographer.co.uk/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.thewildphotographer.co.uk
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.thewildphotographer.co.uk
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.thewildphotographer.co.uk/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Thu, 20 Apr 2023 08:39:11 GMT
content-type: text/html
transfer-encoding: chunked
content-encoding: gzip
connection: close
GET
404
http://www.thewildphotographer.co.uk/u2kb/?zT=pn+zaWXo7szcfRSxp4kAcR5iap+7ulP+x3705F5u21IqvN9WG9kcDL2FxdXl2W/5MjovaUotkmG6JgF/Eyaa9PeBR2yUVivPQ+uGbEI=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=pn+zaWXo7szcfRSxp4kAcR5iap+7ulP+x3705F5u21IqvN9WG9kcDL2FxdXl2W/5MjovaUotkmG6JgF/Eyaa9PeBR2yUVivPQ+uGbEI=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.thewildphotographer.co.uk
Connection: close
HTTP/1.1 404 Not Found
server: openresty/1.13.6.1
date: Thu, 20 Apr 2023 08:39:14 GMT
content-type: text/html
content-length: 175
connection: close
POST
404
http://www.shapshit.xyz/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.shapshit.xyz
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.shapshit.xyz
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.shapshit.xyz/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Thu, 20 Apr 2023 08:39:19 GMT
Server: Apache
Content-Length: 4406
Connection: close
Content-Type: text/html
GET
404
http://www.shapshit.xyz/u2kb/?zT=Yd5Rzn4EVOpL1Cl/eY8jjeGdoEKZlYBpl8BtE0ZhlgLGbR5cH1Fn7sihS3XP3GCDon1xi4vL0lQ4XtydV6BMyXIOMzObAfzgUMU2ykM=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=Yd5Rzn4EVOpL1Cl/eY8jjeGdoEKZlYBpl8BtE0ZhlgLGbR5cH1Fn7sihS3XP3GCDon1xi4vL0lQ4XtydV6BMyXIOMzObAfzgUMU2ykM=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.shapshit.xyz
Connection: close
HTTP/1.1 404 Not Found
Date: Thu, 20 Apr 2023 08:39:22 GMT
Server: Apache
Content-Length: 4406
Connection: close
Content-Type: text/html; charset=utf-8
POST
404
http://www.thedivinerudraksha.com/u2kb/
REQUEST
RESPONSE
BODY
POST /u2kb/ HTTP/1.1
Host: www.thedivinerudraksha.com
Connection: close
Content-Length: 184
Cache-Control: no-cache
Origin: http://www.thedivinerudraksha.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.thedivinerudraksha.com/u2kb/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Connection: close
x-powered-by: PHP/8.0.28
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://thedivinerudraksha.com/wp-json/>; rel="https://api.w.org/"
transfer-encoding: chunked
content-encoding: gzip
vary: Accept-Encoding
date: Thu, 20 Apr 2023 08:39:28 GMT
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
GET
301
http://www.thedivinerudraksha.com/u2kb/?zT=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&DcmN_=UH29gni5kTv7LF
REQUEST
RESPONSE
BODY
GET /u2kb/?zT=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&DcmN_=UH29gni5kTv7LF HTTP/1.1
Host: www.thedivinerudraksha.com
Connection: close
HTTP/1.1 301 Moved Permanently
Connection: close
x-powered-by: PHP/8.0.28
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
x-redirect-by: WordPress
location: http://thedivinerudraksha.com/u2kb/?zT=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&DcmN_=UH29gni5kTv7LF
content-length: 0
date: Thu, 20 Apr 2023 08:39:31 GMT
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49182 -> 199.192.30.147:80 | 2031088 | ET HUNTING Request to .XYZ Domain with Minimal Headers | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts