Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| filtaferamoza.com | 128.199.3.164 |
GET
403
http://filtaferamoza.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
Cookie: __gads=1561373935:1:106:39; _gid=A4FE497CB1CB; _u=5445535432322D5043:746573743232:44463734394441434445423041334641; __io=21_3832866432_4053218753_3017428901; _ga=1.591594.2020557398.110; _gat=6.1.7601.64
Host: filtaferamoza.com
HTTP/1.1 403 Forbidden
Server: nginx
Date: Wed, 26 Jul 2023 08:25:24 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
GET
403
http://filtaferamoza.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
Cookie: __gads=1561373935:1:106:39; _gid=A4FE497CB1CB; _u=5445535432322D5043:746573743232:44463734394441434445423041334641; __io=21_3832866432_4053218753_3017428901; _ga=1.591594.2020557398.110; _gat=6.1.7601.64
Host: filtaferamoza.com
HTTP/1.1 403 Forbidden
Server: nginx
Date: Wed, 26 Jul 2023 08:26:24 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49163 -> 128.199.3.164:80 | 2032086 | ET MALWARE Win32/IcedID Request Cookie | A Network Trojan was detected |
| UDP 192.168.56.102:63709 -> 164.124.101.2:53 | 2046894 | ET MALWARE DNS Query for IcedID Domain (filtaferamoza .com) | A Network Trojan was detected |
| TCP 192.168.56.102:49163 -> 128.199.3.164:80 | 2032086 | ET MALWARE Win32/IcedID Request Cookie | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts