Overview

URLhttp://ccubetutorials.com/EqQLkAZK/index.html
IP66.40.66.201
ASNAS11388 Peer 1 Dedicated Hosting
Location United Kingdom
Report completed2012-11-08 14:51:32 CET
StatusLoading report..
urlQuery Alerts Detected BlackHole v2.0 exploit kit URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-08 14:50:58 urlQuery Client 66.40.66.2012ET CURRENT_EVENTS Possible Blackhole Landing to 7-8 chr folder plus index.htm or index.html
2012-11-08 14:50:59 urlQuery Client 176.31.240.1242ET CURRENT_EVENTS Possible Blackhole Landing to 8 chr folder plus js.js
2012-11-08 14:50:59 urlQuery Client 89.188.144.62ET CURRENT_EVENTS Possible Blackhole Landing to 8 chr folder plus js.js
2012-11-08 14:50:59 urlQuery Client 204.62.12.361ET CURRENT_EVENTS Blackhole 2 Landing Page
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-08 14:50:58 urlQuery Client 176.31.240.1241EXPLOIT-KIT Blackhole Exploit Kit javascript service method
2012-11-08 14:50:58 urlQuery Client 89.188.144.61EXPLOIT-KIT Blackhole Exploit Kit javascript service method


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 66.40.66.201

Date Alerts / IDS URL IP
2012-12-07 05:57:551 / 0http://wakeforestmontessori.com/66.40.66.201
2012-12-07 05:57:541 / 0http://www.wakeforestmontessori.com/66.40.66.201
2012-12-05 23:44:492 / 0http://wakeforestmontessori.com/66.40.66.201
2012-12-03 18:09:221 / 1http://www.wakeforestmontessori.com/66.40.66.201
2012-12-03 18:09:211 / 0http://wakeforestmontessori.com/66.40.66.201
2012-11-25 16:14:291 / 1http://www.vdental.gr/66.40.66.201

Last 6 reports on ASN: AS11388 Peer 1 Dedicated Hosting

Date Alerts / IDS URL IP
2013-04-05 21:27:030 / 0http://www.mb38.com/getimage.asp?m=2894&o=5394&i=61347.dat66.40.15.30
2013-04-05 17:26:150 / 0http://www.hyperionics.com/hc/66.40.33.130
2013-04-05 07:48:310 / 1http://de.hyperionics.com/downloads/Lang/HC2SetDE.exe66.40.33.130
2013-04-05 07:48:300 / 1http://de.hyperionics.com/downloads/Lang/HS6SetDE.exe66.40.33.130
2013-04-05 06:42:350 / 1http://fr.hyperionics.com/downloads/Lang/HS6SetFR.exe66.40.33.130
2013-04-05 06:41:580 / 1http://fr.hyperionics.com/downloads/Lang/HC2SetFR.exe66.40.33.130

Last 1 reports on domain: ccubetutorials.com

Date Alerts / IDS URL IP
2012-11-07 19:50:000 / 2http://ccubetutorials.com/3uD3RT/index.html66.40.66.201



JavaScript

Executed Scripts (1)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (9)


Request Response 
GET /EqQLkAZK/index.html HTTP/1.1

Host: ccubetutorials.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Date: Thu, 08 Nov 2012 13:46:44 GMT
Server: Apache/2.2.11
Last-Modified: Thu, 08 Nov 2012 05:27:40 GMT
Etag: "f074a8c3-1b0-4cdf5180b8e40"
Accept-Ranges: bytes
Content-Length: 432
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
GET /HPwyXEjV/js.js HTTP/1.1

Host: crucerosporelcaribe.com.ve

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ccubetutorials.com/EqQLkAZK/index.html
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Date: Thu, 08 Nov 2012 13:50:59 GMT
Server: Apache
Last-Modified: Thu, 08 Nov 2012 13:50:26 GMT
Accept-Ranges: bytes
Content-Length: 84
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
GET /WidUb6ge/js.js HTTP/1.1

Host: abcsoldi.net

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ccubetutorials.com/EqQLkAZK/index.html
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 84
Last-Modified: Thu, 08 Nov 2012 13:50:10 GMT
Accept-Ranges: bytes
Etag: W/"b42b6ff8b7bdcd1:826b"
Server: Microsoft-IIS/6.0
Date: Thu, 08 Nov 2012 13:50:54 GMT
GET /favicon.ico HTTP/1.1

Host: ccubetutorials.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: image/vnd.microsoft.icon

Date: Thu, 08 Nov 2012 13:46:45 GMT
Server: Apache/2.2.11
X-Powered-By: PHP/5.2.17
Content-Length: 0
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
GET /links/landing-philosophy_dry-suspende.php HTTP/1.1

Host: 9.bohmamei.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ccubetutorials.com/EqQLkAZK/index.html
 
HTTP/1.1 502 Bad Gateway

Content-Type: text/html

Server: nginx/0.7.67
Date: Thu, 08 Nov 2012 13:51:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.14-1~dotdeb.0
GET /favicon.ico HTTP/1.1

Host: 9.bohmamei.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Server: nginx/0.7.67
Date: Thu, 08 Nov 2012 13:51:02 GMT
Connection: keep-alive
Content-Length: 162
GET /favicon.ico HTTP/1.1

Host: ccubetutorials.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: image/vnd.microsoft.icon

Date: Thu, 08 Nov 2012 13:46:48 GMT
Server: Apache/2.2.11
X-Powered-By: PHP/5.2.17
Content-Length: 0
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
GET /favicon.ico HTTP/1.1

Host: 9.bohmamei.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Server: nginx/0.7.67
Date: Thu, 08 Nov 2012 13:51:04 GMT
Connection: keep-alive
Content-Length: 162
GET /jU6zWGy9/js.js HTTP/1.1

Host: klasikkitaplar.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ccubetutorials.com/EqQLkAZK/index.html