IP
ASN #48282 Hosting technology LTD
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1032)
Hash 136866e194d0437edf7c426cde7ae7b4
c9780a3d559a58b85ec4f2478845b410c58cd5a6
d8a972d018e89dc9a5adfa1033a94258fdd4081d8ad9872552f2a7e6eb0fb920
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
GET / HTTP/1.1
Host: 193.178.170.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 07:21:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 01 Dec 2023 07:21:39 GMT
Set-Cookie: PHPSESSID=00e77662bf5144db2952c68248a3d6d9; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Encoding: gzip
193.178.170.44/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140.dll
107 B URL User Request GET 193.178.170.44/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140.dll
IP
ASN #48282 Hosting technology LTD
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO Dotted Quad Host DLL Request
suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
GET /an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140.dll HTTP/1.1
Host: 193.178.170.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 01 Dec 2023 07:21:39 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
193.178.170.44/favicon.ico
200 OK 15 kB URL GET HTTP/1.1 193.178.170.44/favicon.ico
IP
ASN #48282 Hosting technology LTD
Requested by http://193.178.170.44/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140.dll
File type MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Hash 5567e9ce23e5549e0fcd7195f3882816
caf74e24414d131e0ec95b336854f4919b1f5b9c
b2dd935235013a51fde0a2afc12ba965952e384b7ab43fe1746cc21c7eafc38c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
GET /favicon.ico HTTP/1.1
Host: 193.178.170.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://193.178.170.44/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140.dll
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 07:21:40 GMT
Content-Type: image/x-icon
Content-Length: 15086
Last-Modified: Wed, 15 Nov 2023 17:03:22 GMT
Connection: keep-alive
ETag: "6554f9da-3aee"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
193.178.170.44