Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 185.172.128.90 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
- TCP Requests
GET
0
http://185.172.128.90/cpa/name.php
REQUEST
RESPONSE
BODY
GET /cpa/name.php HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: 1
Host: 185.172.128.90
Connection: Keep-Alive
Cache-Control: no-cache
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 185.172.128.90:80 -> 192.168.56.101:49163 | 2400032 | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 | Misc Attack |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts