For this assignment, please use the appropriate tools at DNSQuery.org to answer

Question

For this assignment, please use the appropriate tools at DNSQuery.org to answer the questions:

1.

A spam email message contains an attachment that causes an executable to be downloaded from the Internet and executed. This executable is part of the CERBER Ransomware family and will encrypt all data files on the computer.  

The executable is downloaded from 119.17.253.225.

What country is the IP Address located in?

2. For that same (Q1) email, what person could we contact about the computer at 119.17.253.225 if we need to obtain log files from the computer?

3. A spam email message has a Word document that claims to have an important financial statement that needs to be reviewed.   If it is opened, an additional computer is contacted to download malware that is part of the DRIDEX financial crimes malware. The malware is downloaded from “www.sammelarmband.de” .   What is the telephone number for the Technical Contact for this domain?

4. This phishing website is located at
marojallia.fr/wp-includes/SimplePie/Decode/HTML/db2016/index.html

What is the email address of the person who purchased this domain?

5. This website is not WellsFargo.com – it is www.nirrmaan.com/assets/bootstrap/img/Wellsfargo/login.htm (Links to an external site.)Links to an external site.

What Registrar was used to purchase this domain name?

Explanation / Answer

1. The IP address belongs to 119.17.253.225 VietNam

2. You can contact on hai.nt90@netnam.vn for any queries or complaints

3. The domain is resolved to IP 81.169.145.92 and phone no +4930398020

4. The page is invalid but marojallia.fr is a valid domain name, resolving to 81.88.48.95, The email address of the buyer is vanessa.porcheron@vealis.com

5. Registrar used to purchase this domain name

Related Questions

Navigate

• Browse (All)
• Browse F
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.