Overview

URLhttp://us.battle.net.login.batniker.tk/login.asp?amp;app
IP93.170.52.21
ASNAS44557 Dragonara Alliance Ltd
Location Czech Republic
Report completed2012-11-13 20:54:08 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-13 20:53:32 urlQuery Client 93.170.52.512ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:32 urlQuery Client Internal IP2ET CURRENT_EVENTS DNS Query to a .tk domain - Likely Hostile
2012-11-13 20:53:32 urlQuery Client Internal IP2ET CURRENT_EVENTS DNS Query to a .tk domain - Likely Hostile
2012-11-13 20:53:32 93.170.52.31 urlQuery Client3ET RBN Known Russian Business Network IP (435)
2012-11-13 20:53:32 urlQuery Client 93.170.52.312ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:32 urlQuery Client Internal IP2ET CURRENT_EVENTS DNS Query to a .tk domain - Likely Hostile
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 93.170.52.312ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 93.170.52.212ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client Internal IP2ET CURRENT_EVENTS DNS Query to a .tk domain - Likely Hostile
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:33 urlQuery Client 205.251.219.2032ET CURRENT_EVENTS HTTP Request to a *.tk domain
2012-11-13 20:53:34 urlQuery Client Internal IP2ET CURRENT_EVENTS DNS Query to a .tk domain - Likely Hostile
2012-11-13 20:53:34 urlQuery Client 93.170.52.212ET CURRENT_EVENTS HTTP Request to a *.tk domain
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 93.170.52.21

Date Alerts / IDS URL IP
2013-04-07 23:13:470 / 5http://ddosonline.tk/93.170.52.21
2013-04-07 22:18:430 / 7http://www.operationisrael.tk/93.170.52.21
2013-04-07 19:30:150 / 5http://www.ddosonline.tk/93.170.52.21
2013-04-07 08:59:250 / 9http://fbprofilevievs.tk93.170.52.21
2013-04-07 08:56:090 / 7http://9profile12010.tk93.170.52.21
2013-04-07 08:56:010 / 7http://aafbfriends.tk93.170.52.21

Last 6 reports on ASN: AS44557 Dragonara Alliance Ltd

Date Alerts / IDS URL IP
2013-04-08 04:36:570 / 9http://hdmovil.tk93.170.52.31
2013-04-07 23:23:580 / 5http://ddosonline.tk/93.170.52.31
2013-04-07 23:13:470 / 5http://ddosonline.tk/93.170.52.21
2013-04-07 22:48:490 / 5http://www.ddosonline.tk/93.170.52.31
2013-04-07 22:18:430 / 7http://www.operationisrael.tk/93.170.52.21
2013-04-07 19:30:150 / 5http://www.ddosonline.tk/93.170.52.21

Last 6 reports on domain: us.battle.net.login.batniker.tk

Date Alerts / IDS URL IP
2012-11-11 23:59:460 / 8http://us.battle.net.login.batniker.tk/93.170.52.21
2012-11-11 21:39:130 / 19http://us.battle.net.login.batniker.tk/login.asp?amp;93.170.52.31
2012-11-11 21:38:550 / 22http://us.battle.net.login.batniker.tk/login.asp?ref=https:/us.battle.net/account/management/in (...)93.170.52.21
2012-11-09 22:19:480 / 21http://us.battle.net.login.batniker.tk/login.asp?ref=https:/us.battle.net/account/management/in (...)93.170.52.31
2012-11-09 16:13:110 / 22http://us.battle.net.login.batniker.tk/login.asp?ref=https:/us.battle.net/account/management/in (...)93.170.52.31
2012-11-07 23:40:090 / 21http://us.battle.net.login.batniker.tk/login.asp?ref=https:/us.battle.net/account/management/in (...)93.170.52.31



JavaScript

Executed Scripts (2)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (13)


Request Response 
GET /p/?d=BATNIKER&i=80.203.168.254&c=47&ro=0&uq=1&ref=unknown&_=1352836412728 HTTP/1.1

Host: domain.dot.tk
GET /p/?d=BATNIKER&i=80.203.168.254&c=47&ro=0&uq=1&ref=unknown&_=1352836412728 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://us.battle.net.login.batniker.tk/login.asp?amp;app
 
HTTP/1.0 301 Moved Permanently

Content-Type: text/html; charset=ISO-8859-1

Date: Tue, 13 Nov 2012 19:53:32 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Location: http://batniker.tk/abused
Content-Length: 0
Connection: close
GET /urlfwd/abused/logo.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 7577
Connection: keep-alive
Date: Tue, 13 Nov 2012 11:43:16 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "4e4012-1d99-4e57796a"
Accept-Ranges: bytes
Age: 29417
X-Amz-Cf-Id: AXD_v5OQUu0SptqXUUsRb6-aC_oofW8IwYpNnLjy02eIVN4eW-vOfg==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/sub_page_box.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 2408
Connection: keep-alive
Date: Tue, 13 Nov 2012 12:22:14 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "b8013-968-4e57796a"
Accept-Ranges: bytes
Age: 27079
X-Amz-Cf-Id: YUnxA4SAbFQ1rqhKApx6JZsT7Qpmhao31HviX8kAO41qWsr2iVmJbQ==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/sub_page_box_slice.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 244
Connection: keep-alive
Date: Tue, 13 Nov 2012 12:22:15 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "b8015-f4-4e57796a"
Accept-Ranges: bytes
Age: 27078
X-Amz-Cf-Id: QxBVlUAwVkwo2ya64VrbSPHRyw9BWKwgdyXOB45e0sHZ0iT1qcuilw==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/bgGreyBox.gif HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/gif

Content-Length: 171
Connection: keep-alive
Date: Tue, 13 Nov 2012 12:22:14 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "4e400f-ab-4e57796a"
Accept-Ranges: bytes
Age: 27079
X-Amz-Cf-Id: _KiI0ac4bUZsHNjjAEKmTem7FSye1natV4UylZ4byMOtolekYtts3A==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/abuse_sprite2.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 4832
Connection: keep-alive
Date: Tue, 13 Nov 2012 12:22:14 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Mon, 12 Dec 2011 15:51:07 GMT
Etag: "4e40bf-12e0-4ee622eb"
Accept-Ranges: bytes
Age: 27079
X-Amz-Cf-Id: WJk3yWPtC8EHiST80smXSzZIKBWkfZXC1wCV_zgpoBxyJTlOteknag==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Miss from cloudfront
GET /urlfwd/abused/go.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 1623
Connection: keep-alive
Date: Thu, 08 Nov 2012 16:45:29 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "4e4010-657-4e57796a"
Accept-Ranges: bytes
Age: 27078
X-Amz-Cf-Id: eLpdDouwYtIUod2fR6gdBuv5DZ-gNEDQ6RdxHBG6Lid6tYK4ZW-49w==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/sub_page_box_bottom1.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 1214
Connection: keep-alive
Date: Tue, 13 Nov 2012 12:22:14 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "c30014-4be-4e57796a"
Accept-Ranges: bytes
Age: 27079
X-Amz-Cf-Id: rcT1dDbEZdYDCh6qzQHA7b5quRh6Wdn-MpLTJO5L_hJlMIQqyjGCmQ==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/background.jpg HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/jpeg

Content-Length: 46073
Connection: keep-alive
Date: Mon, 12 Nov 2012 12:40:49 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "c3000e-b3f9-4e57796a"
Accept-Ranges: bytes
Age: 29417
X-Amz-Cf-Id: E4c6Dy7PVYOJ4Vun1rzj2JE6ap2r41Iv1AvaEwWsaJGb7ydVBV5bHQ==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /urlfwd/abused/tk2.png HTTP/1.1

Host: cdn.dot.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://batniker.tk/abused
 
HTTP/1.0 200 OK

Content-Type: image/png

Content-Length: 43651
Connection: keep-alive
Date: Tue, 13 Nov 2012 12:22:14 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.30
Last-Modified: Fri, 26 Aug 2011 10:46:02 GMT
Etag: "c30017-aa83-4e57796a"
Accept-Ranges: bytes
Age: 27079
X-Amz-Cf-Id: YtZO6Y9buWv5p87bgPQ9ifELCFTAd3nGHvoNd4HUPc7QjugpLdYpNw==
Via: 1.0 40d8ccd85f297110636fb1f51391cbe8.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
GET /favicon.ico HTTP/1.1

Host: us.battle.net.login.batniker.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: JSESSIONID=aztKOWTigJlh
 
HTTP/1.0 200 OK

Content-Type: image/x-icon

Date: Tue, 13 Nov 2012 19:53:32 GMT
Server: Resin/2.1.17
X-Server: teoki.ams.taloha.net
Expires: Wed, 14 Nov 2012 19:53:33 GMT
Connection: close
GET /abused HTTP/1.1

Host: batniker.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://us.battle.net.login.batniker.tk/login.asp?amp;app
 
HTTP/1.0 200 OK

Content-Type: text/html;charset=UTF-8

Date: Tue, 13 Nov 2012 19:53:32 GMT
Server: Resin/2.1.17
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-Server: fala.ams.taloha.net
Set-Cookie: JSESSIONID=adkYMOq16kEc; path=/
Connection: close
GET /favicon.ico HTTP/1.1

Host: batniker.tk

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: JSESSIONID=adkYMOq16kEc
 
HTTP/1.0 200 OK

Content-Type: image/x-icon

Date: Tue, 13 Nov 2012 19:53:33 GMT
Server: Resin/2.1.17
X-Server: maloofuta.ams.taloha.net
Expires: Wed, 14 Nov 2012 19:53:34 GMT
Connection: close