Overview

URLhttp://traffcool.biz/progs_traff/mfwihg/ltbjzhtpiq
IP208.91.197.46
ASNAS40034 Confluence Networks Inc
Location Virgin Islands, British
Report completed2012-11-10 06:43:09 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-10 06:42:36 urlQuery Client 208.91.197.461ET MALWARE CWS Trafcool.biz Related Installer
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 208.91.197.46

Date Alerts / IDS URL IP
2013-03-31 20:52:330 / 1http://traffsale1.biz/progs_traff/amnyj/kfdykwvt.php208.91.197.46
2013-03-31 20:52:320 / 1http://traffsale1.biz/progs_traff/amnyj/wezkjiucks208.91.197.46
2013-03-31 20:52:320 / 1http://traffsale1.biz/progs_traff/amnyj/mupbj.php?exp=1208.91.197.46
2013-03-31 20:52:310 / 1http://traffsale1.biz/progs_traff/amnyj/ecxwi208.91.197.46
2013-03-31 20:52:230 / 1http://traffsale1.biz/progs_traff/amnyj/ulgfam.php208.91.197.46
2013-03-31 20:52:210 / 1http://traffsale1.biz/progs_traff/amnyj/tbwvghxia.php?adv=adv710208.91.197.46

Last 6 reports on ASN: AS40034 Confluence Networks Inc

Date Alerts / IDS URL IP
2013-04-02 05:15:320 / 0http://onlinefwd.com208.91.196.96
2013-04-02 04:29:330 / 1http://nickelbackre.com/s.php?0Q9oBPXEN0uECUgzEJ95RQsaiDrvq1aG3F/2q5oNowaH1WY=208.91.197.216
2013-04-02 03:15:400 / 1http://w22844.bins.lop.com/bins/int/9kgen_up.int208.91.197.160
2013-04-02 03:11:060 / 2http://www.ababasoft.com/utilityadvance/cdorganizer.exe199.79.62.206
2013-04-02 02:47:510 / 1http://f8126.bins.lop.com/bins/int/9kgen_up.int208.91.197.160
2013-04-02 01:03:310 / 1http://casbygroup.com/images/logos.gif?1d378=359016199.79.62.205

Last 6 reports on domain: traffcool.biz

Date Alerts / IDS URL IP
2013-03-29 16:46:290 / 1http://traffcool.biz/progs_traff/baxymei/ilejjowbpq.php?exp=1208.91.197.46
2013-03-29 16:46:280 / 1http://traffcool.biz/progs_traff/vxonmlvody/yittyqumdv.php?exp=1208.91.197.46
2013-03-13 02:29:240 / 1http://traffcool.biz/progs_traff/hezyg/vdvupbam208.91.197.46
2013-03-13 02:29:240 / 1http://traffcool.biz/progs_traff/hezyg/odpwzsy208.91.197.46
2013-03-13 02:29:200 / 1http://traffcool.biz/progs_traff/hezyg/vnihdpadt208.91.197.46
2013-03-13 02:29:200 / 1http://traffcool.biz/progs_traff/hezyg/iwedcacf.php208.91.197.46



JavaScript

Executed Scripts (1)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (4)


Request Response 
GET /progs_traff/mfwihg/ltbjzhtpiq HTTP/1.1

Host: traffcool.biz

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sat, 10 Nov 2012 05:42:36 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.3.16
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1156
Keep-Alive: timeout=5, max=128
Connection: Keep-Alive
GET /?fp=h0CyPwjnFpJvJXx4Z9N%2F2LbMQiBG1uv3CLu2ANuZxIR6THvLy2Ik5D2pQmi9gqFXlYPBGgek9kxHrok9gzb3OA%3D%3D&prvtof=817VcD8Q8EAOC%2Bf8H0Hb3eO%2B5eyvVbwoanQuFp0HEpA%3D&poru=eK7F%2FEudibWNjZehJ2augrxW82Spd1iC0dwiGbBQ8XyY0uAL7yIEFnctDvwSk7LAh00fYSACMITaDcODSWn2mdj%2BcBw5MaEQ6EMXWbVaJUo%3D& HTTP/1.1

Host: traffcool.biz
GET /?fp=h0CyPwjnFpJvJXx4Z9N%2F2LbMQiBG1uv3CLu2ANuZxIR6THvLy2Ik5D2pQmi9gqFXlYPBGgek9kxHrok9gzb3OA%3D%3D&prvtof=817VcD8Q8EAOC%2Bf8H0Hb3eO%2B5eyvVbwoanQuFp0HEpA%3D&poru=eK7F%2FEudibWNjZehJ2augrxW82Spd1iC0dwiGbBQ8XyY0uAL7yIEFnctDvwSk7LAh00fYSACMITaDcODSWn2mdj%2BcBw5MaEQ6EMXWbVaJUo%3D& HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://traffcool.biz/progs_traff/mfwihg/ltbjzhtpiq
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sat, 10 Nov 2012 05:42:36 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.3.16
Set-Cookie: vsid=913vr1000717562119088; expires=Thu, 09-Nov-2017 05:42:36 GMT; path=/; domain=traffcool.biz; httponly
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 193
Keep-Alive: timeout=5, max=127
Connection: Keep-Alive
GET /favicon.ico HTTP/1.1

Host: traffcool.biz

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: vsid=913vr1000717562119088
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Date: Sat, 10 Nov 2012 05:42:36 GMT
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 30
Keep-Alive: timeout=5, max=126
Connection: Keep-Alive
GET /favicon.ico HTTP/1.1

Host: traffcool.biz

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: vsid=913vr1000717562119088
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Date: Sat, 10 Nov 2012 05:42:39 GMT
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 30
Keep-Alive: timeout=5, max=125
Connection: Keep-Alive