Skip to content

Instantly share code, notes, and snippets.

@emilyaustin

emilyaustin/2022-10-19_185.104.194.13.json Secret

Created February 22, 2023 15:56
Show Gist options
  • Save emilyaustin/37a8bc12bf5293c9c456ede0e1ada4c8 to your computer and use it in GitHub Desktop.
Save emilyaustin/37a8bc12bf5293c9c456ede0e1ada4c8 to your computer and use it in GitHub Desktop.
Download ZIP
Data for ransomed host 185.104.194.13
Raw
2022-10-19_185.104.194.13.json
{
"ip": "185.104.194.13",
"services": [
{
"_decoded": "http",
"_encoding": {
"banner": "DISPLAY_UTF8",
"banner_hex": "DISPLAY_HEX"
},
"banner": "HTTP/1.1 301 Moved Permanently\r\nDate: <REDACTED>\nLocation: https://185.104.194.13/\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 56\r\n",
"banner_hashes": [
"sha256:d9be4c6d7fd0ffaa7837dff907fa239a39d27f50a357dcb06b3124aac15a8914"
],
"banner_hex": "485454502f312e3120333031204d6f766564205065726d616e656e746c790d0a446174653a20203c52454441435445443e0a4c6f636174696f6e3a2068747470733a2f2f3138352e3130342e3139342e31332f0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035360d0a",
"extended_service_name": "HTTP",
"http": {
"request": {
"method": "GET",
"uri": "http://185.104.194.13/",
"headers": {
"User_Agent": [
"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
],
"_encoding": {
"User_Agent": "DISPLAY_UTF8",
"Accept": "DISPLAY_UTF8"
},
"Accept": [
"*/*"
]
}
},
"response": {
"protocol": "HTTP/1.1",
"status_code": 301,
"status_reason": "Moved Permanently",
"headers": {
"Date": [
"<REDACTED>"
],
"_encoding": {
"Date": "DISPLAY_UTF8",
"Location": "DISPLAY_UTF8",
"Connection": "DISPLAY_UTF8",
"Content_Type": "DISPLAY_UTF8",
"Content_Length": "DISPLAY_UTF8"
},
"Location": [
"https://185.104.194.13/"
],
"Connection": [
"close"
],
"Content_Type": [
"text/html"
],
"Content_Length": [
"56"
]
},
"body_size": 56,
"_encoding": {
"body": "DISPLAY_UTF8",
"body_hash": "DISPLAY_UTF8"
},
"body": "<HTML><BODY><H1>301 Moved Permanently</H1></BODY></HTML>",
"body_hashes": [
"sha256:24205eed13dc1d5ba6cd6a4a326a0e6264a49a5b8ed99d450af1119a65baea01",
"sha1:dcc188320985cb95a175ca127f4ac8f3f5140149"
],
"body_hash": "sha1:dcc188320985cb95a175ca127f4ac8f3f5140149"
},
"supports_http2": false
},
"observed_at": "2022-10-18T17:33:56.213883721Z",
"perspective_id": "PERSPECTIVE_TATA",
"port": 80,
"service_name": "HTTP",
"source_ip": "167.94.138.117",
"transport_protocol": "TCP",
"truncated": false
},
{
"_decoded": "ntp",
"extended_service_name": "NTP",
"ntp": {
"get_time_header": {
"version": 3,
"mode": 4,
"stratum": 3,
"poll": 3,
"precision": -21,
"_encoding": {
"reference_id": "DISPLAY_UTF8"
},
"reference_id": "R\ufffdh\ufffd",
"leap_indicator": 0
}
},
"observed_at": "2022-10-18T18:30:09.170623759Z",
"perspective_id": "PERSPECTIVE_HE",
"port": 123,
"service_name": "NTP",
"source_ip": "162.142.125.213",
"transport_protocol": "UDP",
"truncated": false
},
{
"_decoded": "http",
"_encoding": {
"banner": "DISPLAY_UTF8",
"certificate": "DISPLAY_HEX",
"banner_hex": "DISPLAY_HEX"
},
"banner": "HTTP/1.1 200 OK\r\nDate: <REDACTED>\nConnection: Keep-Alive\r\nContent-Security-Policy: block-all-mixed-content\r\nContent-Type: text/html\r\nStrict-Transport-Security: max-age=31536000\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: DENY\r\nX-XSS-Protection: 1\r\nContent-Length: 1248\r\n",
"banner_hashes": [
"sha256:8ea1efe8c8bb4ee66028070a18b71798eb60078f1d232e7e59e44254b0e3acd3"
],
"banner_hex": "485454502f312e3120323030204f4b0d0a446174653a20203c52454441435445443e0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a436f6e74656e742d53656375726974792d506f6c6963793a20626c6f636b2d616c6c2d6d697865642d636f6e74656e740d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a5374726963742d5472616e73706f72742d53656375726974793a206d61782d6167653d33313533363030300d0a582d436f6e74656e742d547970652d4f7074696f6e733a206e6f736e6966660d0a582d4672616d652d4f7074696f6e733a2044454e590d0a582d5853532d50726f74656374696f6e3a20310d0a436f6e74656e742d4c656e6774683a20313234380d0a",
"certificate": "17589002f310a7a720b629bcbad10928fc256bc7039912d5f3fb7669004cd714",
"extended_service_name": "HTTPS",
"http": {
"request": {
"method": "GET",
"uri": "https://185.104.194.13/",
"headers": {
"Accept": [
"*/*"
],
"_encoding": {
"Accept": "DISPLAY_UTF8",
"User_Agent": "DISPLAY_UTF8"
},
"User_Agent": [
"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
]
}
},
"response": {
"protocol": "HTTP/1.1",
"status_code": 200,
"status_reason": "OK",
"headers": {
"Content_Length": [
"1248"
],
"_encoding": {
"Content_Length": "DISPLAY_UTF8",
"Content_Type": "DISPLAY_UTF8",
"X_Frame_Options": "DISPLAY_UTF8",
"X_Content_Type_Options": "DISPLAY_UTF8",
"Connection": "DISPLAY_UTF8",
"Content_Security_Policy": "DISPLAY_UTF8",
"Strict_Transport_Security": "DISPLAY_UTF8",
"X_Xss_Protection": "DISPLAY_UTF8",
"Date": "DISPLAY_UTF8"
},
"Content_Type": [
"text/html"
],
"X_Frame_Options": [
"DENY"
],
"X_Content_Type_Options": [
"nosniff"
],
"Connection": [
"Keep-Alive"
],
"Content_Security_Policy": [
"block-all-mixed-content"
],
"Strict_Transport_Security": [
"max-age=31536000"
],
"X_Xss_Protection": [
"1"
],
"Date": [
"<REDACTED>"
]
},
"_encoding": {
"html_tags": "DISPLAY_UTF8",
"body": "DISPLAY_UTF8",
"body_hash": "DISPLAY_UTF8",
"html_title": "DISPLAY_UTF8"
},
"html_tags": [
"<title>How to Restore Your Files</title>"
],
"body_size": 1248,
"body": "<html lang=\"en\">\n<head>\n <title>How to Restore Your Files</title>\n</head>\n<body>\n\n<h1>How to Restore Your Files</h1>\n\n<p><strong><u>Security Alert!!!</u></strong></p>\n<p>We hacked your company successfully</p>\n<p>All files have been stolen and encrypted by us</p>\n<p>If you want to restore files or avoid file leaks, please send <b>1.08739</b> bitcoins to the wallet <b>bc1q0thcm5cc25u2jj78njxx7e9sa7z2dhdu59d0cw</b></p>\n<p>If money is received, encryption key will be available on our web site <b>http://yytf6btdhrikgywd6aluwbafjgm5oj3pan2lg3czvhs34obs3brid7ad.onion/747e133c-17ec-4b99-a0dc-58b9521075c0</b></p>\n\n<p><strong><u>Attention!!!</u></strong></p>\n<p>Send money within 3 days, otherwise we will expose some data and raise the price</p>\n<p>Don't try to decrypt important files, it may damage your files</p>\n<p>Don't trust who can decrypt, they are liars, no one can decrypt without key file</p>\n<p>If you don't send bitcoins, we will notify your customers of the data breach by email and text message</p>\n<p>And sell your data to your opponents or criminals, data may be made release</p>\n\n<p><strong><u>Note</u></strong></p>\n<p>SSH is turned on</p>\n<p>Firewall is disabled</p>\n\n<br>\n<p>givemesomebtcplease@proton.me</p>\n</body>\n</html>\n",
"body_hashes": [
"sha256:8c55f95847f4b4c453eae27e1922056e09f2178278967f3abaf0fa65ca30c890",
"sha1:608ec98db35533b2fb489184c9b609d537afad9c"
],
"body_hash": "sha1:608ec98db35533b2fb489184c9b609d537afad9c",
"html_title": "How to Restore Your Files"
},
"supports_http2": false
},
"jarm": {
"_encoding": {
"fingerprint": "DISPLAY_HEX",
"cipher_and_version_fingerprint": "DISPLAY_HEX",
"tls_extensions_sha256": "DISPLAY_HEX"
},
"fingerprint": "2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d",
"cipher_and_version_fingerprint": "2ad2ad0002ad2ad0002ad2ad2ad2ad",
"tls_extensions_sha256": "755a2cec4b52fb1bce1ac7f1e48c8a7d",
"observed_at": "2022-10-14T12:16:58.115491848Z"
},
"observed_at": "2022-10-18T17:33:56.785524647Z",
"perspective_id": "PERSPECTIVE_TATA",
"port": 443,
"service_name": "HTTP",
"source_ip": "167.94.138.117",
"tls": {
"version_selected": "TLSv1_2",
"cipher_selected": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"certificates": {
"_encoding": {
"leaf_fp_sha_256": "DISPLAY_HEX"
},
"leaf_fp_sha_256": "17589002f310a7a720b629bcbad10928fc256bc7039912d5f3fb7669004cd714",
"leaf_data": {
"names": [
"pcshop-esxi.help-it.biz"
],
"subject_dn": "emailAddress=vmca@vmware.com, C=US, ST=California, L=Palo Alto, O=VMware, OU=VMware Engineering, CN=pcshop-esxi.help-it.biz, emailAddress=vmca@vmware.com",
"issuer_dn": "DC=starlink, DC=ua, CN=CA, DC=starlink, DC=ua, C=US, ST=California, O=vcent, OU=VMware Engineering",
"pubkey_bit_size": 2048,
"pubkey_algorithm": "RSA",
"tbs_fingerprint": "3e10b06879fc9fb97cd37a025dbeae913d36b938aef8b4262b3f817b8e2ecd89",
"fingerprint": "17589002f310a7a720b629bcbad10928fc256bc7039912d5f3fb7669004cd714",
"issuer": {
"common_name": [
"CA"
],
"domain_component": [
"starlink",
"ua"
],
"organization": [
"vcent"
],
"organizational_unit": [
"VMware Engineering"
],
"province": [
"California"
],
"country": [
"US"
]
},
"subject": {
"common_name": [
"pcshop-esxi.help-it.biz"
],
"locality": [
"Palo Alto"
],
"organization": [
"VMware"
],
"organizational_unit": [
"VMware Engineering"
],
"province": [
"California"
],
"country": [
"US"
],
"email_address": [
"vmca@vmware.com"
]
},
"public_key": {
"key_algorithm": "RSA",
"rsa": {
"_encoding": {
"modulus": "DISPLAY_BASE64",
"exponent": "DISPLAY_BASE64"
},
"modulus": "wZ0nkDYMd98L6N4mjYtFtAf4ksyolepF0yhD0cTcrDOk2L5PzNWi3MzvBtAoGS7/SC42fdKWtHRQ4jaQhUeBG0WMh5dP9rNgWbtZv5ncV5xqeLwldYfVORZhafcS+tyPiCs83pNALx3bkYYLJPx7uDWeQ31BpnofXwpHswUWBCIBkOtb797uhOnlCy9oTHX+z4JRL9eK3ncYBSZYo0xBHJJzWYf5kxlr9ENB+fphmQ3iC1Br97DJGi1rUtkXyDbjITA29e+esRUd1NB8l4U8JEy2UQ6xXEmR/vd+QqOoaI7k/MI+UCOSU4wLWrcIE9Jzgm41Zu6/vH+saldyyu6guw==",
"exponent": "AAEAAQ==",
"length": 256
},
"fingerprint": "a626c2a90c1cfddb9da2421cb6e5ef0d54ff96bd3946c2d60f3fb1432eba5b5f"
},
"signature": {
"signature_algorithm": "SHA256-RSA",
"self_signed": false
}
}
},
"server_key_exchange": {
"ec_params": {
"named_curve": 23
}
},
"_encoding": {
"ja3s": "DISPLAY_HEX"
},
"ja3s": "0debd3853f330c574b05e0b6d882dc27"
},
"transport_protocol": "TCP",
"truncated": false
},
{
"_decoded": "smtp",
"_encoding": {
"banner": "DISPLAY_UTF8",
"banner_hex": "DISPLAY_HEX"
},
"banner": "220 VMware Authentication Daemon Version 1.10: SSL Required, ServerDaemonProtocol:SOAP, MKSDisplayProtocol:VNC , VMXARGS supported, NFCSSL supported/t\r\n",
"banner_hashes": [
"sha256:43b1f8fa13ae2b04fcd1f141a6ebbbbe9b8c854566eb4d32bc54c746d104d4cc"
],
"banner_hex": "32323020564d776172652041757468656e7469636174696f6e204461656d6f6e2056657273696f6e20312e31303a2053534c2052657175697265642c205365727665724461656d6f6e50726f746f636f6c3a534f41502c204d4b53446973706c617950726f746f636f6c3a564e43202c20564d584152475320737570706f727465642c204e464353534c20737570706f727465642f740d0a",
"extended_service_name": "SMTP",
"labels": [
"Email"
],
"observed_at": "2022-10-16T18:02:54.392497314Z",
"perspective_id": "PERSPECTIVE_NTT",
"port": 902,
"service_name": "SMTP",
"smtp": {
"_encoding": {
"banner": "DISPLAY_UTF8"
},
"banner": "220 VMware Authentication Daemon Version 1.10: SSL Required, ServerDaemonProtocol:SOAP, MKSDisplayProtocol:VNC , VMXARGS supported, NFCSSL supported/t\r\n"
},
"source_ip": "167.248.133.117",
"transport_protocol": "TCP",
"truncated": false
},
{
"_decoded": "http",
"_encoding": {
"banner": "DISPLAY_UTF8",
"certificate": "DISPLAY_HEX",
"banner_hex": "DISPLAY_HEX"
},
"banner": "HTTP/1.1 202 Accepted\r\nServer: gSOAP/2.8\r\nContent-Type: text/xml\r\nContent-Length: 0\r\nConnection: close\r\n",
"banner_hashes": [
"sha256:1c8576b88199171c361e47076940461e87835f03fe6b3ea07bfc4bae627cfdda"
],
"banner_hex": "485454502f312e31203230322041636365707465640d0a5365727665723a2067534f41502f322e380d0a436f6e74656e742d547970653a20746578742f786d6c0d0a436f6e74656e742d4c656e6774683a20300d0a436f6e6e656374696f6e3a20636c6f73650d0a",
"certificate": "17589002f310a7a720b629bcbad10928fc256bc7039912d5f3fb7669004cd714",
"extended_service_name": "HTTPS",
"http": {
"request": {
"method": "GET",
"uri": "https://185.104.194.13:9080/",
"headers": {
"User_Agent": [
"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
],
"_encoding": {
"User_Agent": "DISPLAY_UTF8",
"Accept": "DISPLAY_UTF8"
},
"Accept": [
"*/*"
]
}
},
"response": {
"protocol": "HTTP/1.1",
"status_code": 202,
"status_reason": "Accepted",
"headers": {
"Content_Type": [
"text/xml"
],
"_encoding": {
"Content_Type": "DISPLAY_UTF8",
"Content_Length": "DISPLAY_UTF8",
"Server": "DISPLAY_UTF8",
"Connection": "DISPLAY_UTF8"
},
"Content_Length": [
"0"
],
"Server": [
"gSOAP/2.8"
],
"Connection": [
"close"
]
},
"body_size": 0
},
"supports_http2": false
},
"jarm": {
"_encoding": {
"fingerprint": "DISPLAY_HEX",
"cipher_and_version_fingerprint": "DISPLAY_HEX",
"tls_extensions_sha256": "DISPLAY_HEX"
},
"fingerprint": "21d14d00021d21d00021d14d21d21dedc34fa25010764f91c4fbc0f8ced721",
"cipher_and_version_fingerprint": "21d14d00021d21d00021d14d21d21d",
"tls_extensions_sha256": "edc34fa25010764f91c4fbc0f8ced721",
"observed_at": "2022-10-02T22:35:07.426079753Z"
},
"observed_at": "2022-10-16T18:03:00.811329772Z",
"perspective_id": "PERSPECTIVE_HE",
"port": 9080,
"service_name": "HTTP",
"software": [
{
"uniform_resource_identifier": "cpe:2.3:a:genivia:gsoap:2.8:*:*:*:*:*:*:*",
"part": "a",
"vendor": "Genivia",
"product": "gSOAP",
"version": "2.8",
"source": "OSI_APPLICATION_LAYER"
},
{
"uniform_resource_identifier": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
"part": "o",
"vendor": "freebsd",
"product": "freebsd",
"source": "OSI_TRANSPORT_LAYER"
}
],
"source_ip": "162.142.125.219",
"tls": {
"version_selected": "TLSv1_2",
"cipher_selected": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"certificates": {
"_encoding": {
"leaf_fp_sha_256": "DISPLAY_HEX",
"chain_fps_sha_256": "DISPLAY_HEX"
},
"leaf_fp_sha_256": "17589002f310a7a720b629bcbad10928fc256bc7039912d5f3fb7669004cd714",
"chain_fps_sha_256": [
"4c2fd94ee750fcf89453ee9ee7c55e1223798d90747e89114ebe659bb88ba0a3"
],
"leaf_data": {
"names": [
"pcshop-esxi.help-it.biz"
],
"subject_dn": "emailAddress=vmca@vmware.com, C=US, ST=California, L=Palo Alto, O=VMware, OU=VMware Engineering, CN=pcshop-esxi.help-it.biz, emailAddress=vmca@vmware.com",
"issuer_dn": "DC=starlink, DC=ua, CN=CA, DC=starlink, DC=ua, C=US, ST=California, O=vcent, OU=VMware Engineering",
"pubkey_bit_size": 2048,
"pubkey_algorithm": "RSA",
"tbs_fingerprint": "3e10b06879fc9fb97cd37a025dbeae913d36b938aef8b4262b3f817b8e2ecd89",
"fingerprint": "17589002f310a7a720b629bcbad10928fc256bc7039912d5f3fb7669004cd714",
"issuer": {
"common_name": [
"CA"
],
"domain_component": [
"starlink",
"ua"
],
"organization": [
"vcent"
],
"organizational_unit": [
"VMware Engineering"
],
"province": [
"California"
],
"country": [
"US"
]
},
"subject": {
"common_name": [
"pcshop-esxi.help-it.biz"
],
"locality": [
"Palo Alto"
],
"organization": [
"VMware"
],
"organizational_unit": [
"VMware Engineering"
],
"province": [
"California"
],
"country": [
"US"
],
"email_address": [
"vmca@vmware.com"
]
},
"public_key": {
"key_algorithm": "RSA",
"rsa": {
"_encoding": {
"modulus": "DISPLAY_BASE64",
"exponent": "DISPLAY_BASE64"
},
"modulus": "wZ0nkDYMd98L6N4mjYtFtAf4ksyolepF0yhD0cTcrDOk2L5PzNWi3MzvBtAoGS7/SC42fdKWtHRQ4jaQhUeBG0WMh5dP9rNgWbtZv5ncV5xqeLwldYfVORZhafcS+tyPiCs83pNALx3bkYYLJPx7uDWeQ31BpnofXwpHswUWBCIBkOtb797uhOnlCy9oTHX+z4JRL9eK3ncYBSZYo0xBHJJzWYf5kxlr9ENB+fphmQ3iC1Br97DJGi1rUtkXyDbjITA29e+esRUd1NB8l4U8JEy2UQ6xXEmR/vd+QqOoaI7k/MI+UCOSU4wLWrcIE9Jzgm41Zu6/vH+saldyyu6guw==",
"exponent": "AAEAAQ==",
"length": 256
},
"fingerprint": "a626c2a90c1cfddb9da2421cb6e5ef0d54ff96bd3946c2d60f3fb1432eba5b5f"
},
"signature": {
"signature_algorithm": "SHA256-RSA",
"self_signed": false
}
},
"chain": [
{
"fingerprint": "4c2fd94ee750fcf89453ee9ee7c55e1223798d90747e89114ebe659bb88ba0a3",
"subject_dn": "DC=starlink, DC=ua, CN=CA, DC=starlink, DC=ua, C=US, ST=California, O=vcent, OU=VMware Engineering",
"issuer_dn": "DC=starlink, DC=ua, CN=CA, DC=starlink, DC=ua, C=US, ST=California, O=vcent, OU=VMware Engineering"
}
]
},
"server_key_exchange": {
"ec_params": {
"named_curve": 23
}
},
"_encoding": {
"ja3s": "DISPLAY_HEX"
},
"ja3s": "303951d4c50efb2e991652225a6f02b1"
},
"transport_fingerprint": {
"id": 116,
"os": "FreeBSD",
"raw": "65535,64,true,MNWST,1460,false,false"
},
"transport_protocol": "TCP",
"truncated": false
}
],
"location": {
"continent": "Europe",
"country": "Poland",
"country_code": "PL",
"city": "Warsaw",
"postal_code": "00-510",
"timezone": "Europe/Warsaw",
"province": "Mazovia",
"coordinates": {
"latitude": 52.2296,
"longitude": 21.0067
},
"registered_country": "Bulgaria",
"registered_country_code": "BG"
},
"location_updated_at": "2022-10-14T06:17:34.473078Z",
"autonomous_system": {
"asn": 59711,
"description": "HZ-EU-AS",
"bgp_prefix": "185.104.194.0/24",
"name": "HZ-EU-AS",
"country_code": "BG"
},
"autonomous_system_updated_at": "2022-10-05T04:15:25.498013Z",
"operating_system": {
"uniform_resource_identifier": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
"part": "o",
"vendor": "freebsd",
"product": "freebsd",
"source": "OSI_TRANSPORT_LAYER"
},
"dns": {
"names": [
"pcshop-esxi.help-it.biz"
],
"records": {
"pcshop-esxi.help-it.biz": {
"record_type": "A",
"resolved_at": "2022-10-08T12:16:21.384300118Z"
}
}
},
"last_updated_at": "2022-10-19T03:11:28.669Z",
"labels": [
"Email"
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment