Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.67.53.27 |
joshua6440.nitrosoftwares.shop | 104.21.41.247 |
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:53673 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:50803 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.103:123
-
GET
200
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
GET /gate HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Host: joshua6440.nitrosoftwares.shop
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 13 Sep 2023 22:56:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.1
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=klmgneeaphevvm2qo18ajv97p3; path=/
Set-Cookie: CSRF-TOKEN=1b3c3b5f999f57a4eb452470f25845c49bc08cacc4c59b9aefa3af52e420ed1d; expires=Thu, 14-Sep-2023 00:57:01 GMT; Max-Age=7200; path=/
Vary: User-Agent
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rrd%2F64zwNiiaiIbeHWY1JLv0adffstJ0DMU%2F6gnV%2FoxmI%2FfsXzGVuXarHgiaAXhoOHTvGJ5w07R4Y3D0SDoj4Pk%2BomJiyfSl58lET82KUIFJJt3nV69WKkDZRt6f3CDYaoFGP7wJefFjfHKsG7N8sTU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8063fb93298a266a-NRT
alt-svc: h3=":443"; ma=86400
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 40dd7974-884a-4240-bcf8-6efde5b31fbd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 402
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 448d96e1-4bbb-4706-a59f-b4b3d6486862
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 182
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 1691e674-49ea-4765-a6b3-07873520eff8
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 190
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 1b7af3a6-5e32-4fd1-86e5-fcf47155bb5a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 174
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: e5eeb8c8-9d93-4f30-ad93-ff9ff6641150
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 956
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 1b718719-5a57-47c9-93be-8f599d524f7c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 170
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 552c81c4-78cb-41b9-a709-2ab256f6e268
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 412
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 636b0f73-63fa-486e-afd4-4e5a8d314a5d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 406
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 2c105d0f-b89b-4532-a2c1-d4f3f0160ecc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 414
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 1e07a345-6725-43ae-8a8f-0b9c3e68a1d1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 406
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: f13ef70b-0fac-46de-bc59-be22385167ab
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 406
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: c8689ee2-f24f-4a89-96bb-ef69981b82b5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 416
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 5e5b0a96-9ad4-4323-9f69-e7b1726505ef
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 406
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: 21a0b126-e495-4e49-ade8-a24a1ead37d9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 402
Expect: 100-continue
HTTP/1.1 100 Continue
POST
100
https://joshua6440.nitrosoftwares.shop/gate
REQUEST
RESPONSE
BODY
POST /gate HTTP/1.1
x-key: d3b05463-8e35-4a91-ac10-788b5d33923d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Type: application/x-www-form-urlencoded
Host: joshua6440.nitrosoftwares.shop
Content-Length: 412
Expect: 100-continue
HTTP/1.1 100 Continue
GET
200
http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
BODY
GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: apps.identrust.com
HTTP/1.1 200 OK
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex
Referrer-Policy: same-origin
Last-Modified: Mon, 21 Aug 2023 22:08:28 GMT
ETag: "37d-603761e33cf00"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Wed, 13 Sep 2023 23:56:18 GMT
Date: Wed, 13 Sep 2023 22:56:18 GMT
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.103:49169 -> 104.21.41.247:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLS 1.2 192.168.56.103:49169 104.21.41.247:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=nitrosoftwares.shop | 55:16:8c:37:8b:81:1a:5e:02:c1:77:19:5c:d1:66:2f:51:be:a7:33 |
Snort Alerts
No Snort Alerts