Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| imageupload.io | 172.67.222.26 |
- UDP Requests
-
-
192.168.56.102:63709 164.124.101.2:53
-
192.168.56.102:64513 164.124.101.2:53
-
192.168.56.102:137 192.168.56.103:137
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:63712 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
GET
200
https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg
REQUEST
RESPONSE
BODY
GET /ib/ws8MAJ6eptiLfGu_1697738492.jpg HTTP/1.1
Host: imageupload.io
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 23 Oct 2023 03:16:02 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
x-powered-by: PHP/8.1.21
cache-control: no-cache, private
platform: hostinger
content-security-policy: upgrade-insecure-requests
vary: User-Agent
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: BYPASS
Set-Cookie: XSRF-TOKEN=eyJpdiI6IjhSOFoxNUZMWFF4eDJzZFpKZSsrbHc9PSIsInZhbHVlIjoieTM5cmZxNlBLK3ZkTGtrR1hhemxqYnJXV1hKVjhxK2o0Vm9CeXVvdFRFNjVSZkNNV2ZyR3FUYnJVMnhHa3dyN2hKRmVodVBZcktVd28zTWxHeEY0VWFaZVRBSXBWT2ZOTEVpMUJlSEhyTHgzaGVwZVo2K3N2cGVuQ203by9NRlIiLCJtYWMiOiJhYzNlYTEzMjRhNjE5MTAxNmY3YTRlNjE1ZDIxNTJiODE5NzMwMWQ5MzAwMWQ0Mzc4NWY0NjAyNTM3YzdmODVmIiwidGFnIjoiIn0%3D; expires=Mon, 23 Oct 2023 05:17:01 GMT; Max-Age=7200; path=/; samesite=lax; secure
Set-Cookie: imgbob_user_session=eyJpdiI6ImdweEdUeVJud3NYaHAraGl6VTNRaXc9PSIsInZhbHVlIjoiUEhvMDhPTW5ub0hBMTJGb3lXRzNPVnFhUFUwODdlb09nMWJnZWdmUW4xa0JQb2ZTcHc4L0ZtaGxId0FoaXRmeVp1S1Q3czdRZXlvTEtvVjc4MEZVWVl4cTIxaWpPakNudVlBdEk3WXY0RVpkeU5RVC9QcGJoOVNWTWVlajZERzMiLCJtYWMiOiI5MmI5ZmJlYWI0M2EzNGIxYmRmZWZhZWNmZmY4NWMyNjViZWRjNjE4ZWFmOTMyMDlmNDkzYmU1NzA4YWRmYzk2IiwidGFnIjoiIn0%3D; expires=Mon, 23 Oct 2023 05:17:01 GMT; Max-Age=7200; path=/; httponly; samesite=lax; secure
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eDQPnvVv6iLXLNgZlAjhl3RnG361ASfvDI9p6wsfTKy2Jh2FckIArAlJmC7dOQncCV9SOXRucclYC6l9%2BJ6gxG7AIOA210d45B1N4fawSlEdJEyIlAOsk0hkTujzwDAj0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 81a6d1aa6ac22095-NRT
alt-svc: h3=":443"; ma=86400
GET
200
http://94.156.253.236/fridayyyyyy.txt
REQUEST
RESPONSE
BODY
GET /fridayyyyyy.txt HTTP/1.1
Host: 94.156.253.236
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Fri, 20 Oct 2023 14:46:31 GMT
Accept-Ranges: bytes
ETag: "f4a3e37643da1:0"
Server: Microsoft-IIS/10.0
Date: Mon, 23 Oct 2023 03:16:06 GMT
Content-Length: 322904
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49165 -> 172.67.222.26:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 94.156.253.236:80 -> 192.168.56.102:49166 | 2020425 | ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 | Exploit Kit Activity Detected |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49165 172.67.222.26:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=imageupload.io | 7f:d3:2d:a3:40:e0:de:64:4d:f5:a5:0f:96:b0:ae:07:58:85:a8:85 |
Snort Alerts
No Snort Alerts