NetWork | ZeroBOX

IP Address	Status	Action
107.160.244.54	Active	Moloch
107.180.58.44	Active	Moloch
108.167.181.248	Active	Moloch
122.201.118.64	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
192.158.238.23	Active	Moloch
192.185.32.234	Active	Moloch
192.185.79.55	Active	Moloch
199.188.205.57	Active	Moloch
216.37.42.46	Active	Moloch
217.160.0.196	Active	Moloch

Name	Response	Post-Analysis Lookup
marcoislandguidebook.com	A 192.185.79.55	192.185.79.55
ntf.gov.sb	A 192.185.32.234	192.185.32.234
bellaloveboutique.com	A 107.180.58.44	107.180.58.44
prediction2020.com	A 107.160.244.54	107.160.244.54
ourcomm.co.uk	A 217.160.0.196	217.160.0.196
surustore.com	A 192.158.238.23	192.158.238.23
ootashop.com	A 199.188.205.57	199.188.205.57
alpax.elcanotradingcorp.com	A 108.167.181.248	108.167.181.248
brandsites.gunwebhosting.com.au	A 122.201.118.64	122.201.118.64
srivinaysalian.com	A 216.37.42.46	216.37.42.46

TCP Requests

UDP Requests

GET 404 https://surustore.com/image/cache/catalog/demo/banners/h0dD8T2aNRz.php

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49810 -> 192.185.32.234:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49815 -> 122.201.118.64:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.185.32.234:443 -> 192.168.56.102:49812	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49818 -> 107.180.58.44:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 199.188.205.57:443 -> 192.168.56.102:49828	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 107.180.58.44:443 -> 192.168.56.102:49820	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 122.201.118.64:443 -> 192.168.56.102:49816	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49824 -> 107.160.244.54:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.102:49824 -> 107.160.244.54:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49835 -> 216.37.42.46:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 216.37.42.46:443 -> 192.168.56.102:49836	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 107.160.244.54:443 -> 192.168.56.102:49824	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 107.160.244.54:443 -> 192.168.56.102:49824	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.185.79.55:443 -> 192.168.56.102:49840	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49819 -> 107.180.58.44:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49839 -> 192.185.79.55:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49826 -> 199.188.205.57:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49842 -> 108.167.181.248:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 108.167.181.248:443 -> 192.168.56.102:49845	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49822 -> 107.160.244.54:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.102:49822 -> 107.160.244.54:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49822 -> 107.160.244.54:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49844 -> 108.167.181.248:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 107.160.244.54:443 -> 192.168.56.102:49822	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 107.160.244.54:443 -> 192.168.56.102:49822	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49827 -> 199.188.205.57:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49808 -> 192.158.238.23:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49830 -> 217.160.0.196:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49831 -> 217.160.0.196:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49811 -> 192.185.32.234:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 217.160.0.196:443 -> 192.168.56.102:49832	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49814 -> 122.201.118.64:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49823 -> 107.160.244.54:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.102:49823 -> 107.160.244.54:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49823 -> 107.160.244.54:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49834 -> 216.37.42.46:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49838 -> 192.185.79.55:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 107.160.244.54:443 -> 192.168.56.102:49823	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 107.160.244.54:443 -> 192.168.56.102:49823	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49808 192.158.238.23:443	C=US, O=Let's Encrypt, CN=R3	CN=surustore.com	64:8a:61:10:46:af:ef:24:74:b1:3c:dc:ee:b1:3c:59:03:1c:b8:24

Snort Alerts

No Snort Alerts