Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 103.91.244.102 | Active | Moloch |
| 111.235.66.83 | Active | Moloch |
| 117.212.193.62 | Active | Moloch |
| 172.217.25.14 | Active | Moloch |
| 187.190.116.59 | Active | Moloch |
| 201.184.190.59 | Active | Moloch |
| 202.142.151.190 | Active | Moloch |
| 36.94.202.131 | Active | Moloch |
| 79.122.166.236 | Active | Moloch |
| 80.78.77.116 | Active | Moloch |
| 85.159.214.61 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
GET
200
https://85.159.214.61/rob28/TEST22-PC_W617601.51FA6B3783F19317BB7F3DB0B3BF6733/5/kps/
REQUEST
RESPONSE
BODY
GET /rob28/TEST22-PC_W617601.51FA6B3783F19317BB7F3DB0B3BF6733/5/kps/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.72.0
Host: 85.159.214.61
HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Disposition: Content-Disposition
Content-Length: 25902
Content-Type: text/html
Etag: 5facd2d0-264
Last-Modified: Thu, 12 Nov 2020 06:14:40 GMT
Pragma: private
Server: GoAhead-http
Set-Cookie: SESSID=da122263a2bd; webvpnLang=webvpnLang
Www-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="N2UyNjgxMjA6NjQ1MWZiOTA6IDJlNjI5NDA=", qop="auth", algorithm=MD5
X-Cache: MISS from Hello
X-Cache-Lookup: MISS from Hello:8080
X-Content-Powered-By: K2 v2.8.0 (by JoomlaWor
X-Drupal-Cache: xHIT
X-Drupal-Dynamic-Cache: MISS
X-Generator: Drupal 8 (https://www.drupal.org)
X-Jenkins: 2.121.3
X-Jenkins-Session: f72d6619
X-Powered-By: PHP/5.6.40
Date: Fri, 12 Mar 2021 09:45:25 GMT
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49816 117.212.193.62:449 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 81:c4:f0:b6:a7:40:f0:09:2b:ab:2a:1c:df:80:a0:30:da:d8:93:79 |
|
TLSv1 192.168.56.102:49814 201.184.190.59:449 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 81:c4:f0:b6:a7:40:f0:09:2b:ab:2a:1c:df:80:a0:30:da:d8:93:79 |
|
TLSv1 192.168.56.102:49819 79.122.166.236:449 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 81:c4:f0:b6:a7:40:f0:09:2b:ab:2a:1c:df:80:a0:30:da:d8:93:79 |
|
TLSv1 192.168.56.102:49820 80.78.77.116:449 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 81:c4:f0:b6:a7:40:f0:09:2b:ab:2a:1c:df:80:a0:30:da:d8:93:79 |
|
TLSv1 192.168.56.102:49815 202.142.151.190:449 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 81:c4:f0:b6:a7:40:f0:09:2b:ab:2a:1c:df:80:a0:30:da:d8:93:79 |
|
TLSv1 192.168.56.102:49818 85.159.214.61:443 |
C=CN, O=NL, OU=XD, CN=nxdefi.com | C=CN, O=NL, OU=XD, CN=nxdefi.com | 97:f4:02:43:96:a4:a4:0e:c8:c3:be:6f:dc:73:6f:3a:2d:35:a5:dc |
Snort Alerts
No Snort Alerts