Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| ip-api.com | 208.95.112.1 | |
| www.microsoft.com | 23.40.45.184 |
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:53673 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:53676 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.103:123
-
GET
200
http://www.microsoft.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: www.microsoft.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
ETag: "6082151bd56ea922e1357f5896a90d0a:1425454794"
Last-Modified: Wed, 04 Mar 2015 07:39:54 GMT
Server: AkamaiNetStorage
Content-Length: 1020
Date: Thu, 22 Jun 2023 02:10:30 GMT
Connection: keep-alive
GET
200
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
REQUEST
RESPONSE
BODY
GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1
Content-Type: application/json
User-Agent: Cat
Host: ip-api.com
HTTP/1.1 200 OK
Date: Thu, 22 Jun 2023 02:10:30 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 108
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
PUT
200
http://185.159.129.168/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys
REQUEST
RESPONSE
BODY
PUT /clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys HTTP/1.1
Content-Type: application/json
User-Agent: Cat
Host: 185.159.129.168
Content-Length: 611
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 22 Jun 2023 02:10:31 GMT
Content-Type: application/json
Content-Length: 2302
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X2hz0p2xKiTOFh1WM8ttORqz8prEjq0VuZUW4Qd1JIGpEUj2hzwZpt8FG5O1SNTD24voLHN77Et3xIEyNjSabUKdJZf6r17V1fAQmx7vNSwciwXHfunHKT0Cns8jtLVULQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 7db0f4922883fe4c-HEL
alt-svc: h3=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49165 -> 208.95.112.1:80 | 2022082 | ET POLICY External IP Lookup ip-api.com | Device Retrieving External IP Address Detected |
| TCP 23.40.45.184:80 -> 192.168.56.103:49164 | 2012692 | ET POLICY Microsoft user-agent automated process response to automated request | Misc activity |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts