NetWork | ZeroBOX

Network Analysis

IP Address Status Action
185.215.113.100 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 200 http://185.215.113.100/
REQUEST
RESPONSE
POST 200 http://185.215.113.100/e2b1563c6670f193.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.100:80 -> 192.168.56.101:49161 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack
TCP 192.168.56.101:49161 -> 185.215.113.100:80 2044243 ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts