| 185.172.128.100/u6vhSc3PPq/index.php |  185.172.128.100 | | 20 B |
URL 185.172.128.100/u6vhSc3PPq/index.php IP185.172.128.100:0 ASN#50916 OOO Nadym Svyaz Service
File typegzip compressed data, max speed, from Unix\012- data Hasha4745abc5e7fdb89cc6df3069f3c6e69 74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /u6vhSc3PPq/index.php HTTP/1.1
Host: 185.172.128.100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 25 Nov 2023 18:59:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Refresh: 0; url = Login.php
Content-Encoding: gzip
|
| 185.172.128.100/u6vhSc3PPq/Login.php | 185.172.128.100 | 200 OK | 569 B |
URL User Request GET HTTP/1.1185.172.128.100/u6vhSc3PPq/Login.php IP185.172.128.100:80 ASN#50916 OOO Nadym Svyaz Service
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text Hash6d7f367fe1e4b597820a0c6d8a44d7e3 9e7f11249aabead8745023fce94af7897cd03bfd 2a2418fe7e9391e1d22b70bdc43d9b3cff35f76a9be26e85644f001838e0b775
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
GET /u6vhSc3PPq/Login.php HTTP/1.1
Host: 185.172.128.100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 25 Nov 2023 18:59:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=da8k0ijq84o98p0tc6uu29mfic; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
|
| 185.172.128.100/u6vhSc3PPq/Css/Style.css | 185.172.128.100 | 200 OK | 7.6 kB |
URL GET HTTP/1.1185.172.128.100/u6vhSc3PPq/Css/Style.css IP185.172.128.100:80 ASN#50916 OOO Nadym Svyaz Service
Requested byhttp://185.172.128.100/u6vhSc3PPq/Login.php
Hash2d92f144f3487610f73c93100fb06032 0b75d3487e100beafd634305d4e0485256b4a888 3781df9b0f592b34b7bb6fb79203c78113889a85db0f368ad6228d6c7b292413
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
GET /u6vhSc3PPq/Css/Style.css HTTP/1.1
Host: 185.172.128.100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://185.172.128.100/u6vhSc3PPq/Login.php
Cookie: PHPSESSID=da8k0ijq84o98p0tc6uu29mfic
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 25 Nov 2023 18:59:55 GMT
Content-Type: text/css
Content-Length: 7566
Last-Modified: Sun, 05 Nov 2023 13:55:19 GMT
Connection: keep-alive
ETag: "65479ec7-1d8e"
Accept-Ranges: bytes
|
| 185.172.128.100/favicon.ico | 185.172.128.100 | 404 Not Found | 123 B |
URL GET HTTP/1.1185.172.128.100/favicon.ico IP185.172.128.100:80 ASN#50916 OOO Nadym Svyaz Service
Requested byhttp://185.172.128.100/u6vhSc3PPq/Login.php
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash1b7c22a214949975556626d7217e9a39 d01c97e2944166ed23e47e4a62ff471ab8fa031f 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 185.172.128.100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://185.172.128.100/u6vhSc3PPq/Login.php
Cookie: PHPSESSID=da8k0ijq84o98p0tc6uu29mfic
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 25 Nov 2023 18:59:55 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
|