Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
WHOIS.APNIC.NET | 172.104.79.63 | |
whois.iana.org |
CNAME
ianawhois.vip.icann.org
|
192.0.32.59 |
iplogger.org | 88.99.66.31 | |
api.ip.sb | 104.26.13.31 |
- TCP Requests
-
-
192.168.56.101:49230 104.26.12.31:443api.ip.sb
-
192.168.56.101:49240 117.18.232.200:80
-
192.168.56.101:49232 172.104.79.63:43WHOIS.APNIC.NET
-
192.168.56.101:49231 192.0.32.59:43whois.iana.org
-
192.168.56.101:49227 74.119.193.164:3214
-
192.168.56.101:49219 88.99.66.31:443iplogger.org
-
192.168.56.101:49222 88.99.66.31:443iplogger.org
-
192.168.56.101:49223 88.99.66.31:443iplogger.org
-
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:55450 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:65329 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
https://iplogger.org/1rst77
REQUEST
RESPONSE
BODY
GET /1rst77 HTTP/1.1
User-Agent: CPU: Intel(R) Core(TM) i5-8400 CPU @ 2.80GHz | OS: Windows 7 Professional N | Name: TEST22-PC
Host: iplogger.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 08 Mar 2021 02:35:19 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=evk5nnepdr2ngmvagv3spikqf1; path=/; HttpOnly
Pragma: no-cache
Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=263877272; path=/
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Answers:
whoami: a5256e691f905af127b79d0431bbffef6031df10ebea85efc7bd272c304ef3ea
Strict-Transport-Security: max-age=31536000; preload
X-Frame-Options: DENY
GET
200
https://iplogger.org/1aSny7
REQUEST
RESPONSE
BODY
GET /1aSny7 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: iplogger.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 08 Mar 2021 02:35:21 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=eqmi6oqs9j0mp6uvfo7pohfdu0; path=/; HttpOnly
Pragma: no-cache
Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=263877270; path=/
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Answers:
whoami: 21d1bae8c0546c680eefc0aec657209580c4a4eed0fb956496eb50a2dfb729aa
Strict-Transport-Security: max-age=31536000; preload
X-Frame-Options: DENY
GET
200
https://iplogger.org/favicon.ico
REQUEST
RESPONSE
BODY
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: iplogger.org
Connection: Keep-Alive
Cookie: PHPSESSID=eqmi6oqs9j0mp6uvfo7pohfdu0; clhf03028ja=175.208.134.150
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 08 Mar 2021 02:35:21 GMT
Content-Type: image/x-icon
Content-Length: 588
Last-Modified: Sat, 28 Oct 2017 19:07:32 GMT
Connection: keep-alive
ETag: "59f4d574-24c"
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; preload
X-Frame-Options: DENY
Accept-Ranges: bytes
GET
200
https://api.ip.sb/geoip
REQUEST
RESPONSE
BODY
GET /geoip HTTP/1.1
Host: api.ip.sb
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Mar 2021 02:35:24 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 345
Connection: keep-alive
Set-Cookie: __cfduid=de848ca91f595d5036c02c71c07bd2ed51615170924; expires=Wed, 07-Apr-21 02:35:24 GMT; path=/; domain=.ip.sb; HttpOnly; SameSite=Lax
Vary: Accept-Encoding
Vary: Accept-Encoding
Cache-Control: no-cache
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
cf-request-id: 08b14987ea000005a2873fa000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=odnE6RtfE2%2Bx9sjmb5of1s%2FkE7KWHDac0PthhnEsjMomMWlWxFpnaQFYRqZ%2F79YWCXzTZVlzf4HnYM83TkOtOQd7mlHVZFCmldg%3D"}]}
NEL: {"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 62c8ab8649f205a2-LAX
GET
200
http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE
BODY
GET /IE9CompatViewList.xml HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: ie9cvlist.ie.microsoft.com
If-Modified-Since: Thu, 21 Nov 2019 19:37:08 GMT
If-None-Match: 0x8D76EBA32AF0BC3
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Age: 362
Cache-Control: max-age=21600
Content-MD5: wjbjFuG5rGDOFdrHvLiy3g==
Content-Type: text/xml
Date: Mon, 08 Mar 2021 02:36:18 GMT
Etag: 0x8D871FC7BDF491D
Last-Modified: Fri, 16 Oct 2020 17:54:09 GMT
Server: ECAcc (tka/897A)
Vary: Accept-Encoding
X-Cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: bdd2b816-c01e-00bf-55c2-13f974000000
x-ms-version: 2009-09-19
Content-Length: 13718
ICMP traffic
Source | Destination | ICMP Type | Data |
---|---|---|---|
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 | |
185.248.101.50 | 192.168.56.101 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49219 -> 88.99.66.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49222 -> 88.99.66.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49223 -> 88.99.66.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49230 -> 104.26.12.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 74.119.193.164:3214 -> 192.168.56.101:49227 | 2221010 | SURICATA HTTP unable to match response to request | Generic Protocol Command Decode |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49219 88.99.66.31:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA | CN=*.iplogger.org | 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb |
TLSv1 192.168.56.101:49222 88.99.66.31:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA | CN=*.iplogger.org | 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb |
TLSv1 192.168.56.101:49223 88.99.66.31:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA | CN=*.iplogger.org | 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb |
TLSv1 192.168.56.101:49230 104.26.12.31:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e |
Snort Alerts
No Snort Alerts