Overview

URLhttp://secure.runescape.com.weblog-ins.cu.cc/m=forum/forums.ws?154=455
IP216.38.62.18
ASNAS25847 ServInt
Location United States
Report completed2012-10-25 15:53:22 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-10-25 15:52:47 urlQuery Client 216.38.62.182ET CURRENT_EVENTS HTTP Request to a *.cu.cc domain
2012-10-25 15:52:48 urlQuery Client 216.38.62.182ET CURRENT_EVENTS HTTP Request to a *.cu.cc domain
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 216.38.62.18

Date Alerts / IDS URL IP
2013-02-20 06:27:500 / 6http://frejyuiders.cu.cc/links/fate_acted.php216.38.62.18
2013-02-20 06:27:290 / 6http://kolpouop.cu.cc/links/fate_acted.php216.38.62.18
2013-02-16 09:44:180 / 5http://establishedforcourse.cu.cc/f/notepad.exe?ts=a970a8f7&affid=41100216.38.62.18
2013-02-13 23:54:300 / 6http://vertuks.cu.cc/data/ap2.php216.38.62.18
2013-02-13 18:57:460 / 6http://cesared.cu.cc/data/ap2.php216.38.62.18
2013-02-13 15:53:180 / 6http://nertgydev.cu.cc/links/fate_acted.php216.38.62.18

Last 6 reports on ASN: AS25847 ServInt

Date Alerts / IDS URL IP
2013-03-01 13:38:590 / 2http://easygiftgiving.com/.sys/?getexe=p.exe64.131.81.186
2013-03-01 13:38:180 / 0http://www.tunersports.com/external/related-products.php?storeid=cc&searchquery=Clutch%20In (...)216.22.26.25
2013-03-01 11:05:280 / 0http://www.sitefile.org/videos-1-footdom.htm206.214.209.75
2013-03-01 09:54:120 / 0http://www.huancaya.net/206.214.211.116
2013-03-01 04:02:581 / 0http://www.accountingcoach.com/online-accounting-course/01Xpg03.html64.131.65.169
2013-03-01 02:41:370 / 3http://3questionsgetthegirl.com/simple-trick-video/?afid=LinkTrust207.58.184.243



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (6)


Request Response 
GET /m=forum/forums.ws?154=455 HTTP/1.1

Host: secure.runescape.com.weblog-ins.cu.cc

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 302 Found

Content-Type: text/html

Date: Thu, 25 Oct 2012 13:52:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Location: http://cu.cc/free.php?domain=secure.runescape.com.weblog-ins.cu.cc
Content-Length: 0
Connection: close
GET /free.php?domain=secure.runescape.com.weblog-ins.cu.cc HTTP/1.1

Host: cu.cc

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 301 Moved Permanently

Content-Type: text/html; charset=iso-8859-1

Date: Thu, 25 Oct 2012 13:52:47 GMT
Server: Apache
Location: http://www.registry.cu.cc/free.php?domain=secure.runescape.com.weblog-ins.cu.cc
Content-Length: 287
Connection: close
GET /free.php?domain=secure.runescape.com.weblog-ins.cu.cc HTTP/1.1

Host: www.registry.cu.cc

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 302 Found

Content-Type: text/html

Date: Thu, 25 Oct 2012 13:52:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Set-Cookie: PHPSESSID=97f29686d9e1b04e6ac0e7e77de685f5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: http://15647.bodisparking.com/securerunescapecomweblog-ins.cu.cc
Content-Length: 3
Connection: close
GET /securerunescapecomweblog-ins.cu.cc HTTP/1.1

Host: 15647.bodisparking.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Last-Modified: Wed, 04 Jan 2012 08:24:07 GMT
Accept-Ranges: bytes
Etag: "80add639bacacc1:0"
Server: Microsoft-IIS/7.5
Date: Thu, 25 Oct 2012 13:52:50 GMT
Content-Length: 12
GET /favicon.ico HTTP/1.1

Host: 15647.bodisparking.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Last-Modified: Wed, 04 Jan 2012 08:24:07 GMT
Accept-Ranges: bytes
Etag: "80add639bacacc1:0"
Server: Microsoft-IIS/7.5
Date: Thu, 25 Oct 2012 13:52:50 GMT
Content-Length: 12
GET /favicon.ico HTTP/1.1

Host: 15647.bodisparking.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Range: bytes=0-
If-Range: "80add639bacacc1:0"
 
HTTP/1.1 206 Partial Content

Content-Type: text/html

Last-Modified: Wed, 04 Jan 2012 08:24:07 GMT
Accept-Ranges: bytes
Etag: "80add639bacacc1:0"
Server: Microsoft-IIS/7.5
Date: Thu, 25 Oct 2012 13:52:53 GMT
Content-Length: 12
Content-Range: bytes 0-11/12