Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 91.92.255.73 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
GET
200
http://91.92.255.73/v9/qlmz.php?mfgb=6
REQUEST
RESPONSE
BODY
GET /v9/qlmz.php?mfgb=6 HTTP/1.1
Accept: text/*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 ( .NET CLR 3.5.30729; .NET4.0E)
Host: 91.92.255.73
HTTP/1.1 200 OK
Date: Fri, 02 Aug 2024 00:32:48 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 4
Content-Type: text/html; charset=UTF-8
GET
200
http://91.92.255.73/v9/qlmz.php?mfgb=5
REQUEST
RESPONSE
BODY
GET /v9/qlmz.php?mfgb=5 HTTP/1.1
Accept: text/*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 ( .NET CLR 3.5.30729; .NET4.0E)
Host: 91.92.255.73
HTTP/1.1 200 OK
Date: Fri, 02 Aug 2024 00:32:49 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 0
Content-Type: text/html; charset=UTF-8
GET
200
http://91.92.255.73/v9/qlmz.php?mfgb=6
REQUEST
RESPONSE
BODY
GET /v9/qlmz.php?mfgb=6 HTTP/1.1
Accept: text/*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 ( .NET CLR 3.5.30729; .NET4.0E)
Host: 91.92.255.73
HTTP/1.1 200 OK
Date: Fri, 02 Aug 2024 00:32:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 4
Content-Type: text/html; charset=UTF-8
GET
200
http://91.92.255.73/v9/qlmz.php?mfgb=6
REQUEST
RESPONSE
BODY
GET /v9/qlmz.php?mfgb=6 HTTP/1.1
Accept: text/*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 ( .NET CLR 3.5.30729; .NET4.0E)
Host: 91.92.255.73
HTTP/1.1 200 OK
Date: Fri, 02 Aug 2024 00:32:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 4
Content-Type: text/html; charset=UTF-8
GET
0
http://91.92.255.73/v9/qlmz.php?mfgb=35&yjhl=a2VkYi5leGU%3D
REQUEST
RESPONSE
BODY
GET /v9/qlmz.php?mfgb=35&yjhl=a2VkYi5leGU%3D HTTP/1.1
Accept: text/*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 ( .NET CLR 3.5.30729; .NET4.0E)
Host: 91.92.255.73
HTTP/1.1 200 OK
Date: Fri, 02 Aug 2024 00:32:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-store, no-cache, must-revalidate
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 91.92.255.73:80 -> 192.168.56.101:49192 | 2400012 | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 | Misc Attack |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts