Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| gulf.moneroocean.stream |
CNAME
monerooceans.stream
|
5.104.84.79 |
POST
200
http://185.196.9.187/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 475
Content-Type: application/json
Host: 185.196.9.187
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Tue, 06 Aug 2024 00:19:09 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 17
Connection: close
Content-Type: text/html; charset=UTF-8
POST
200
http://185.196.9.187/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 490
Content-Type: application/json
Host: 185.196.9.187
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Tue, 06 Aug 2024 00:20:07 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 2
Connection: close
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 185.196.9.187:80 -> 192.168.56.101:49165 | 2400032 | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 | Misc Attack |
| TCP 192.168.56.101:49163 -> 5.104.84.79:10128 | 2024792 | ET POLICY Cryptocurrency Miner Checkin | Potential Corporate Privacy Violation |
| TCP 192.168.56.101:49164 -> 185.196.9.187:80 | 2051004 | ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request | Crypto Currency Mining Activity Detected |
| TCP 192.168.56.101:49165 -> 185.196.9.187:80 | 2051004 | ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request | Crypto Currency Mining Activity Detected |
| TCP 192.168.56.101:49163 -> 5.104.84.79:10128 | 2024792 | ET POLICY Cryptocurrency Miner Checkin | Potential Corporate Privacy Violation |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts