NetWork | ZeroBOX

Network Analysis

IP Address Status Action
107.154.230.90 Active Moloch
117.18.232.200 Active Moloch
119.161.14.18 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
204.79.197.200 Active Moloch
64.111.117.81 Active Moloch
GET 204 https://bat.bing.com/p/action/4022064
REQUEST
RESPONSE
GET 200 https://s.yimg.com/wi/ytc.js
REQUEST
RESPONSE
GET 200 http://www.freegamer.info/join/
REQUEST
RESPONSE
GET 200 http://www.freegamer.info/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1751958704
REQUEST
RESPONSE
GET 200 http://bat.bing.com/bat.js
REQUEST
RESPONSE
GET 200 http://www.freegamer.info/_Incapsula_Resource?SWKMTFSR=1&e=0.16526160572090975
REQUEST
RESPONSE
GET 200 http://www.freegamer.info/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49811 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49842 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49812 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49816 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 107.154.230.90:80 -> 192.168.56.102:49827 2221017 SURICATA HTTP invalid response field folding Generic Protocol Command Decode
TCP 107.154.230.90:80 -> 192.168.56.102:49827 2221021 SURICATA HTTP response header invalid Generic Protocol Command Decode
TCP 192.168.56.102:49838 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 64.111.117.81:443 -> 192.168.56.102:49813 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49815 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 64.111.117.81:443 -> 192.168.56.102:49817 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49831 -> 119.161.14.18:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49830 -> 119.161.14.18:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49837 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 64.111.117.81:443 -> 192.168.56.102:49839 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49841 -> 64.111.117.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 64.111.117.81:443 -> 192.168.56.102:49843 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49832 -> 204.79.197.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49830
119.161.14.18:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Sunnyvale, O=Oath Inc, CN=*.yahoo.com b0:29:79:7d:77:15:cc:13:0d:dc:50:5d:a0:cd:44:a5:79:df:61:f3
TLSv1
192.168.56.102:49831
119.161.14.18:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Sunnyvale, O=Oath Inc, CN=*.yahoo.com b0:29:79:7d:77:15:cc:13:0d:dc:50:5d:a0:cd:44:a5:79:df:61:f3
TLSv1
192.168.56.102:49832
204.79.197.200:443
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 CN=www.bing.com 29:b4:ed:e7:1f:1c:1b:12:99:6c:9b:1e:27:75:ac:01:25:15:77:1f

Snort Alerts

No Snort Alerts