URL User Request GET HTTP/1.1IP 37.1.217.172:80
File typeHTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hashe798c358d73d0708ceeedfd9727a19e7 f73c2b3b8235dc33685c82a1fc06d0017d6fd736 41ddfbc19ee9c648eb662915ce4c8f83086af0a536bc57a644c7a95d59471568
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET / HTTP/1.1
Host: work.a-poster.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sun, 26 Nov 2023 18:41:16 GMT
Content-Type: text/html
Content-Length: 963
Connection: keep-alive
Last-Modified: Thu, 04 Jun 2015 08:33:36 GMT
ETag: "3c3-517ad081ce760"
|
| work.a-poster.info/favicon.ico | 37.1.217.172 | 200 OK | 1.2 kB |
URL GET HTTP/1.1work.a-poster.info/favicon.ico IP37.1.217.172:80
Requested byhttp://work.a-poster.info/
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Hashec49973c1991bf39fcdb53260467f39f 7e47e857f6b5bb34dc8aea01d6f422e2d0ddbc65 3550474f9a466ace7857064d81db50a25ba7c81de043bc9df8289bd90e32e411
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /favicon.ico HTTP/1.1
Host: work.a-poster.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://work.a-poster.info/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sun, 26 Nov 2023 18:41:17 GMT
Content-Type: image/vnd.microsoft.icon
Content-Length: 1150
Connection: keep-alive
Last-Modified: Thu, 04 Jun 2015 08:27:53 GMT
ETag: "55700c09-47e"
X-Powered-By: PleskLin
Accept-Ranges: bytes
|