Overview

URLhttp://174.127.96.211/s/in.cgi?24&parameter=5767678&CS
IP174.127.96.211
ASNAS36351 SoftLayer Technologies Inc.
Location United States
Report completed2012-11-08 02:30:05 CET
StatusLoading report..
urlQuery Alerts Detected SutraTDS URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-08 02:29:26 174.127.96.211 urlQuery Client2ET CURRENT_EVENTS TDS Sutra - HTTP header redirecting to a SutraTDS
2012-11-08 02:29:26 174.127.96.211 urlQuery Client2ET CURRENT_EVENTS TDS Sutra - page redirecting to a SutraTDS
2012-11-08 02:29:26 174.127.96.211 urlQuery Client1ET CURRENT_EVENTS TDS Sutra - cookie set RULEZ
2012-11-08 02:29:26 urlQuery Client 174.127.96.2112ET CURRENT_EVENTS TDS Sutra - request in.cgi
2012-11-08 02:29:26 urlQuery Client 174.127.96.2111ET CURRENT_EVENTS TDS Sutra - cookie is set RULEZ
2012-11-08 02:29:26 174.127.96.211 urlQuery Client2ET CURRENT_EVENTS TDS Sutra - cookie set
2012-11-08 02:29:26 urlQuery Client 174.127.96.2111ET CURRENT_EVENTS TDS Sutra - cookie is set RULEZ
2012-11-08 02:29:26 urlQuery Client 174.127.96.2112ET CURRENT_EVENTS TDS Sutra - request in.cgi
2012-11-08 02:29:29 urlQuery Client 174.127.96.2111ET CURRENT_EVENTS TDS Sutra - cookie is set RULEZ
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-08 02:29:26 174.127.96.211 urlQuery Client1MALWARE-CNC TDS Sutra - HTTP header redirecting to a SutraTDS
2012-11-08 02:29:26 174.127.96.211 urlQuery Client1MALWARE-CNC TDS Sutra - page redirecting to a SutraTDS


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 174.127.96.211

Date Alerts / IDS URL IP
2013-01-14 21:48:401 / 2http://174.127.96.211/s/in.cgi?24&parameter=5767678&CS=1174.127.96.211
2013-01-14 16:32:121 / 3http://174.127.96.211/s/in.cgi?24174.127.96.211
2012-12-22 01:16:591 / 3http://174.127.96.211/s/in.cgi?24174.127.96.211
2012-12-19 22:10:281 / 2http://174.127.96.211/s/in.cgi?24&parameter=5767678&CS=1174.127.96.211
2012-12-19 15:50:531 / 3http://174.127.96.211/s/in.cgi?24174.127.96.211
2012-12-19 15:19:121 / 10http://174.127.96.211/banner.php?banner_id=24&affiliate_id=5767678174.127.96.211

Last 6 reports on ASN: AS36351 SoftLayer Technologies Inc.

Date Alerts / IDS URL IP
2013-02-17 19:08:580 / 3http://www.chelonia.co.uk/downloads/CPOD.exe184.173.200.163
2013-02-17 19:00:130 / 1http://maxcasanovastudio.tv108.167.174.108
2013-02-17 18:50:430 / 0http://184.173.181.54/irpc/?m=f257eb2d48374abbb2f55cfc861c65ab&z=7726&y=at8LvrtKPFqmTQf (...)184.173.181.54
2013-02-17 18:16:160 / 0http://salternssailingacademy.com216.172.171.88
2013-02-17 18:12:590 / 1http://meta-kit.com/images/logos.gif?1bde0=1141440119.81.13.148
2013-02-17 18:04:280 / 1http://meta-kit.com/images/logos.gif?1c884=701208119.81.13.148

Last 6 reports on domain: 174.127.96.211

Date Alerts / IDS URL IP
2013-01-14 21:48:401 / 2http://174.127.96.211/s/in.cgi?24&parameter=5767678&CS=1174.127.96.211
2013-01-14 16:32:121 / 3http://174.127.96.211/s/in.cgi?24174.127.96.211
2012-12-22 01:16:591 / 3http://174.127.96.211/s/in.cgi?24174.127.96.211
2012-12-19 22:10:281 / 2http://174.127.96.211/s/in.cgi?24&parameter=5767678&CS=1174.127.96.211
2012-12-19 15:50:531 / 3http://174.127.96.211/s/in.cgi?24174.127.96.211
2012-12-19 15:19:121 / 10http://174.127.96.211/banner.php?banner_id=24&affiliate_id=5767678174.127.96.211



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (4)


Request Response 
GET /s/in.cgi?24&parameter=5767678&CS HTTP/1.1

Host: 174.127.96.211
GET /s/in.cgi?24&parameter=5767678&CS HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 302 Found

Content-Type: text/html; charset=UTF-8

Date: Thu, 08 Nov 2012 01:29:25 GMT
Server: Apache
Set-Cookie: CS=1234567890sutraRULEZcookiessupport; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=174.127.96.211
Location: http://174.127.96.211/s/in.cgi?24&parameter=5767678&CS&CS=1
Connection: close
Transfer-Encoding: chunked
GET /s/in.cgi?24&parameter=5767678&CS&CS=1 HTTP/1.1

Host: 174.127.96.211
GET /s/in.cgi?24&parameter=5767678&CS&CS=1 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: CS=1234567890sutraRULEZcookiessupport
 
HTTP/1.1 200 OK

Content-Type: text/javascript

Date: Thu, 08 Nov 2012 01:29:26 GMT
Server: Apache
Set-Cookie: nbarb24=_3_; domain=174.127.96.211; path=/; expires=Sat, 10-Nov-2012 03:29:26 GMT
Connection: close
Transfer-Encoding: chunked
GET /favicon.ico HTTP/1.1

Host: 174.127.96.211

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: CS=1234567890sutraRULEZcookiessupport; nbarb24=_3_
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Date: Thu, 08 Nov 2012 01:29:26 GMT
Server: Apache
Content-Length: 209
Connection: close
GET /favicon.ico HTTP/1.1

Host: 174.127.96.211

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: CS=1234567890sutraRULEZcookiessupport; nbarb24=_3_
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Date: Thu, 08 Nov 2012 01:29:29 GMT
Server: Apache
Content-Length: 209
Connection: close