Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 104.245.241.157 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
GET
404
http://104.245.241.157/documents/files/zip/devops.pdf
REQUEST
RESPONSE
BODY
GET /documents/files/zip/devops.pdf HTTP/1.1
Host: 104.245.241.157
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 02 Apr 2025 01:05:04 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET
200
http://104.245.241.157/documents/files/zip/KursorResourcesV2.zip
REQUEST
RESPONSE
BODY
GET /documents/files/zip/KursorResourcesV2.zip HTTP/1.1
Host: 104.245.241.157
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 02 Apr 2025 01:05:04 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 31 Mar 2025 13:58:32 GMT
ETag: "a63d97-631a3d0ca91a8"
Accept-Ranges: bytes
Content-Length: 10894743
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/zip
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 104.245.241.157:80 -> 192.168.56.103:49166 | 2400016 | ET DROP Spamhaus DROP Listed Traffic Inbound group 17 | Misc Attack |
| TCP 192.168.56.103:49166 -> 104.245.241.157:80 | 2027262 | ET INFO Dotted Quad Host ZIP Request | Potentially Bad Traffic |
| TCP 192.168.56.103:49166 -> 104.245.241.157:80 | 2044121 | ET HUNTING Terse Request for Zip File (GET) | Potentially Bad Traffic |
| TCP 192.168.56.103:49165 -> 104.245.241.157:80 | 2027265 | ET INFO Dotted Quad Host PDF Request | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts