| 185.172.128.19/ghsdh39s/index.php |  185.172.128.19 | | 20 B |
URL 185.172.128.19/ghsdh39s/index.php IP185.172.128.19:0 ASN#50916 OOO Nadym Svyaz Service
File typegzip compressed data, max speed, from Unix\012- data Hasha4745abc5e7fdb89cc6df3069f3c6e69 74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
GET /ghsdh39s/index.php HTTP/1.1
Host: 185.172.128.19
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 27 Nov 2023 08:33:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Refresh: 0; url = Login.php
Content-Encoding: gzip
|
| 185.172.128.19/ghsdh39s/Login.php | 185.172.128.19 | 200 OK | 548 B |
URL User Request GET HTTP/1.1185.172.128.19/ghsdh39s/Login.php IP185.172.128.19:80 ASN#50916 OOO Nadym Svyaz Service
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text Hash8ea118d027eef34cb14adbd89c29a61d 8696dd1328bce009919af1620a417393f4777233 7fc36bcedfe09b38477691486a1b8fcad5adc6a285c831ed0a8bd98e8754ad6d
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /ghsdh39s/Login.php HTTP/1.1
Host: 185.172.128.19
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 27 Nov 2023 08:33:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=1tja178sl0ad3ikhpa6omruvof; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
|
| 185.172.128.19/ghsdh39s/Css/Style.css | 185.172.128.19 | 200 OK | 7.6 kB |
URL GET HTTP/1.1185.172.128.19/ghsdh39s/Css/Style.css IP185.172.128.19:80 ASN#50916 OOO Nadym Svyaz Service
Requested byhttp://185.172.128.19/ghsdh39s/Login.php
Hash2d92f144f3487610f73c93100fb06032 0b75d3487e100beafd634305d4e0485256b4a888 3781df9b0f592b34b7bb6fb79203c78113889a85db0f368ad6228d6c7b292413
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
GET /ghsdh39s/Css/Style.css HTTP/1.1
Host: 185.172.128.19
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://185.172.128.19/ghsdh39s/Login.php
Cookie: PHPSESSID=1tja178sl0ad3ikhpa6omruvof
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 27 Nov 2023 08:33:44 GMT
Content-Type: text/css
Content-Length: 7566
Last-Modified: Sun, 05 Nov 2023 13:55:19 GMT
Connection: keep-alive
ETag: "65479ec7-1d8e"
Accept-Ranges: bytes
|
| 185.172.128.19/favicon.ico | 185.172.128.19 | 404 Not Found | 123 B |
URL GET HTTP/1.1185.172.128.19/favicon.ico IP185.172.128.19:80 ASN#50916 OOO Nadym Svyaz Service
Requested byhttp://185.172.128.19/ghsdh39s/Login.php
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash1b7c22a214949975556626d7217e9a39 d01c97e2944166ed23e47e4a62ff471ab8fa031f 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 185.172.128.19
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://185.172.128.19/ghsdh39s/Login.php
Cookie: PHPSESSID=1tja178sl0ad3ikhpa6omruvof
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 27 Nov 2023 08:33:44 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
|