NetWork | ZeroBOX

Network Analysis

IP Address Status Action
157.240.215.35 Active Moloch
164.124.101.2 Active Moloch
208.95.112.1 Active Moloch
88.218.92.148 Active Moloch
88.99.66.31 Active Moloch
GET 200 https://www.facebook.com/
REQUEST
RESPONSE
GET 200 https://www.facebook.com/
REQUEST
RESPONSE
GET 200 https://iplogger.org/18hh57
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/
REQUEST
RESPONSE
GET 200 http://uyg5wye.2ihsfa.com/api/fbtime
REQUEST
RESPONSE
POST 200 http://uyg5wye.2ihsfa.com/api/?sid=292191&key=60099d26f09507c82251d7c25fada928
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49198 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49204 -> 157.240.215.35:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49209 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49204
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com 8a:d5:51:89:8f:00:98:8e:5b:0f:b8:07:6d:0d:43:18:89:c2:bb:d0
TLSv1
192.168.56.101:49209
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Snort Alerts

No Snort Alerts