| 193.233.132.167/enigma/index.php |  193.233.132.167 | | 21 B |
URL 193.233.132.167/enigma/index.php IP193.233.132.167:0 ASN#216319 Chromis It Ltd
File typevery short file (no magic) Hash7215ee9c7d9dc229d2921a40e899ec5f b858cb282617fb0956d960215c8e84d1ccf909c6 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /enigma/index.php HTTP/1.1
Host: 193.233.132.167
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 19 Apr 2024 23:22:49 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Refresh: 0; url = Login.php
Content-Encoding: gzip
|
| 193.233.132.167/enigma/Login.php | 193.233.132.167 | 200 OK | 658 B |
URL User Request GET HTTP/1.1193.233.132.167/enigma/Login.php IP193.233.132.167:80 ASN#216319 Chromis It Ltd
File typeHTML document, ASCII text Hashf7099217194c08619fe12610dbacfca7 ced0ebb88bd37dfd2e4baca17b1d0f65f7a784c0 97bf5f7a05b6277f113de9dc07bfe5f26c9794afb6fa384cc888225119241f02
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Amadey | | Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /enigma/Login.php HTTP/1.1
Host: 193.233.132.167
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 19 Apr 2024 23:22:50 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=ed1hlqve9aahcmrappiqigs9a4; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
|
| 193.233.132.167/enigma/Css/Style.css | 193.233.132.167 | 200 OK | 7.7 kB |
URL GET HTTP/1.1193.233.132.167/enigma/Css/Style.css IP193.233.132.167:80 ASN#216319 Chromis It Ltd
Requested byhttp://193.233.132.167/enigma/Login.php
Hash78c2fa69e102add32b6bd20793f52c23 b46f612475efaecc871e6593108a29b4bb2da9e6 01686e416a0186114e86b720a56069252742a1a05fb07d29996db3c4f0bac9d8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /enigma/Css/Style.css HTTP/1.1
Host: 193.233.132.167
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://193.233.132.167/enigma/Login.php
Cookie: PHPSESSID=ed1hlqve9aahcmrappiqigs9a4
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 19 Apr 2024 23:22:50 GMT
Content-Type: text/css
Content-Length: 7680
Last-Modified: Thu, 01 Feb 2024 16:00:25 GMT
Connection: keep-alive
ETag: "65bbc019-1e00"
Accept-Ranges: bytes
|
| 193.233.132.167/enigma/Images/Ico.ico | 193.233.132.167 | 200 OK | 1.2 kB |
URL GET HTTP/1.1193.233.132.167/enigma/Images/Ico.ico IP193.233.132.167:80 ASN#216319 Chromis It Ltd
Requested byhttp://193.233.132.167/enigma/Login.php
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel Hashb2bcd585ec006f9da4bbeb6d38928e49 4dd455a112ca3f49d40bbab7e559fb785a67d61c 54713a2d801093e2d318a36f662604649aeb8bd6f649bec00c53abf6813f2014
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /enigma/Images/Ico.ico HTTP/1.1
Host: 193.233.132.167
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://193.233.132.167/enigma/Login.php
Cookie: PHPSESSID=ed1hlqve9aahcmrappiqigs9a4
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 19 Apr 2024 23:22:50 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Thu, 01 Feb 2024 16:00:29 GMT
Connection: keep-alive
ETag: "65bbc01d-47e"
Accept-Ranges: bytes
|