Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| imageupload.io | 104.21.83.102 |
GET
200
https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg
REQUEST
RESPONSE
BODY
GET /ib/ws8MAJ6eptiLfGu_1697738492.jpg HTTP/1.1
Host: imageupload.io
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 24 Oct 2023 00:38:21 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
x-powered-by: PHP/8.1.21
cache-control: no-cache, private
platform: hostinger
content-security-policy: upgrade-insecure-requests
vary: User-Agent
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: BYPASS
Set-Cookie: XSRF-TOKEN=eyJpdiI6IlZwcWZNbW92RktVVFdIbE1jcGRRYWc9PSIsInZhbHVlIjoiUkJGdVJQMmZ4VFlQVHdzUVA1bzAvSndEeWx2dHVKL3ZuOWlPNU1MM2NRbG9JYnhYV3haQmIyNHhINGhJZW5OOVhPUUw5U1RtUWh3VnVYTzA3MHcrL1lvWGVPRit6dzZCRkZ5enFRSzRoOEliSzJsL1dRUHdxdDlZOStnSDNRcmwiLCJtYWMiOiJhNzU2N2E4NmEzZjQ1ZDk0YjAwMTMyMmNmYjA1ZjQwY2NhMDQyNzcxY2IxNjM1YzRmN2M5NGIxYmNjODNlNWVhIiwidGFnIjoiIn0%3D; expires=Tue, 24 Oct 2023 02:39:20 GMT; Max-Age=7200; path=/; samesite=lax; secure
Set-Cookie: imgbob_user_session=eyJpdiI6IjA5VVFQdE5vMC8zUUs3cFkvNzhPMHc9PSIsInZhbHVlIjoidFJHV0p3SEUwTmlRaHdKMnNGeVJGeU1UYnJmSWc2U1BjUi81aUQ5L3ZLeVBtSFBWeURJZTROVlRTbmtUQmRIVWxMUi9qa3g5QlAwWkJ1bVVMeTQ1dmp5bGw0RHpseUJnbHNBODduU3AvQVVFZHBuSU5oMzZlTEV5TUY2MUxsM2wiLCJtYWMiOiI5MTVlNWYwMzdiZDIwOTk1ZmU4OTQ1Zjc5NTQzZmMyNTBjOGYzYTk3ZTM1NjMxNGYwOTI1ODE5NTc4ZDQyMmZmIiwidGFnIjoiIn0%3D; expires=Tue, 24 Oct 2023 02:39:20 GMT; Max-Age=7200; path=/; httponly; samesite=lax; secure
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6mOLIQx%2BUpNO6LG1eYV4XXDYns%2BWyfNBrV0PRyp%2BLIQKQHmXSS8zdnEG9KsQ2ECFBZQt3t2EJK5u80vSUD4G1Cb3ocKggYUFkvcGHfAHlXS09pe%2BzIRI%2B8naPG0zKPY9RQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 81ae280adfdd2095-NRT
alt-svc: h3=":443"; ma=86400
GET
200
http://95.214.27.121/mashilao.txt
REQUEST
RESPONSE
BODY
GET /mashilao.txt HTTP/1.1
Host: 95.214.27.121
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Mon, 23 Oct 2023 00:08:37 GMT
Accept-Ranges: bytes
ETag: "cf4b3212455da1:0"
Server: Microsoft-IIS/8.5
Date: Tue, 24 Oct 2023 00:38:44 GMT
Content-Length: 223916
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49165 -> 172.67.222.26:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 95.214.27.121:80 -> 192.168.56.101:49167 | 2020425 | ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 | Exploit Kit Activity Detected |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49165 172.67.222.26:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=imageupload.io | 7f:d3:2d:a3:40:e0:de:64:4d:f5:a5:0f:96:b0:ae:07:58:85:a8:85 |
Snort Alerts
No Snort Alerts