Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| quiltpet.xyz | 104.21.23.210 |
- TCP Requests
HEAD
200
https://quiltpet.xyz/pe/start/index.php?a=2927&p=4143&t=51166691
REQUEST
RESPONSE
BODY
HEAD /pe/start/index.php?a=2927&p=4143&t=51166691 HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: quiltpet.xyz
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01:56:47 GMT
Content-Type: application/octet-stream
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/7.2.7
Content-Description: File Transfer
Content-Disposition: attachment; filename="load.bat"
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=of%2F4KPTTGbKqiXI62LTRcIhOwBKWYm0zx744q14Q5%2FbSBOgX1gNURJR2fCZq2qLE5T7Xb6Yt3KUrSNSLnmx8OwcMkg%2FQcTvza3TOtTfsNh1OIiapVU1CsiK7NBgZWR8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8d3cac944e4dcba7-LAX
alt-svc: h3=":443"; ma=86400
GET
200
https://quiltpet.xyz/pe/start/index.php?a=2927&p=4143&t=51166691
REQUEST
RESPONSE
BODY
GET /pe/start/index.php?a=2927&p=4143&t=51166691 HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: quiltpet.xyz
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01:56:47 GMT
Content-Type: application/octet-stream
Content-Length: 15656
Connection: keep-alive
X-Powered-By: PHP/7.2.7
Content-Description: File Transfer
Content-Disposition: attachment; filename="load.bat"
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U6MlBWdtgdp02dvAnmGgoInkN2cP5HgvYZaagX3AX6TH%2FC2VIE1sKVTYnqr3dor%2Fn%2FCBQ4zyglgoS2TZPA%2B%2BGRzA6nOIT8%2B8z%2F7h8hObuVdYLBg%2FAP1jgwKUuSjCuhU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8d3cac96af1fcba7-LAX
alt-svc: h3=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49165 -> 104.21.23.210:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49165 104.21.23.210:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=quiltpet.xyz | 7d:03:e5:4e:c7:8c:1a:56:e6:75:4f:16:c1:1f:7c:3d:30:33:b1:08 |
Snort Alerts
No Snort Alerts