BEGIN OF HTTPS DATA:This request reached the HTTPS part of my honeypot yesterday. I am posting this more out or curiostity as it is the first time I see this type of requests, A bit googling lead to
2015-08-08 14:25:47
Source IP: 109.234.39.46
Country: RU RiskScore: 1 Malware: []
SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1
Host: 109.234.106.8
SSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}
Content-Length: 18446744073709551615
https://msdn.microsoft.com/en-us/library/cc247364.aspx and shows that this is part of an Microsoft Secure Socket Tunneling Protocol (SSTP) initialization.
| Analysis Date | 2 seconds ago |
| Blacklist Status | POSSIBLY SAFE 0/40 |
| IP Address | 109.234.39.46 ( Websites Lookup ) |
| Reverse DNS | server6.com |
| ASN | AS35415 |
| ASN Owner | WebaZilla B.V. |
| ISP | McHost.Ru |
| Continent | Europe |
| Country Code | (RU) Russian Federation |
| Latitude / Longitude | 55.75 / 37.6166 |
| City | Unknown |
| Region | Unknown |
(RU) Russian Federation
Keine Kommentare:
Kommentar veröffentlichen