Report - plcforum.work.gd/

Report Overview

Visitedpublic

2023-11-23 02:19:14

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
plcforum.work.gd	unknown	2022-06-18	2023-03-30 16:13:47	2023-10-03 21:28:40	15 kB	437 kB	213.57.238.94

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-23 02:18:59	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:18:59	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:18:59	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:18:59	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:18:59	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:18:59	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:00	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:01	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-11-23 02:19:02	medium	Client IP	213.57.238.94	ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain
2023-11-23 02:19:02	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)
2023-11-23 02:19:02	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)
2023-11-23 02:19:03	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed
2023-11-23	medium	plcforum.work.gd	Sinkholed

ThreatFox

No alerts detected

JavaScript (7)

HTTP Transactions (39)

	URL	IP	Response	Size