IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 7df3d7cf3358af3f470ac7229387ef94
c51a3f0e6de4eb802d5630941c3fd9e1d0efae4b
fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de
Analyzer Verdict Alert ThreatFox malicious RecordBreaker
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
suricata medium ET INFO Unconfigured nginx Access
GET / HTTP/1.1
Host: 195.20.16.93
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 09:44:28 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Fri, 14 Jan 2022 07:23:06 GMT
Connection: keep-alive
ETag: "61e124da-267"
Accept-Ranges: bytes
195.20.16.93/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
146 B URL 195.20.16.93/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO Dotted Quad Host DLL Request
suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1
Host: 195.20.16.93
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 01 Dec 2023 09:44:29 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
GET /favicon.ico HTTP/1.1
Host: 195.20.16.93
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://195.20.16.93/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 01 Dec 2023 09:44:29 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
195.20.16.93