NetWork | ZeroBOX

IP Address	Status	Action
138.68.242.172	Active	Moloch
164.124.101.2	Active	Moloch
173.230.252.50	Active	Moloch
188.165.53.185	Active	Moloch
192.185.16.122	Active	Moloch
199.188.205.57	Active	Moloch
216.37.42.46	Active	Moloch
54.39.133.15	Active	Moloch
62.171.164.209	Active	Moloch
82.98.169.3	Active	Moloch
87.247.240.31	Active	Moloch

Name	Response	Post-Analysis Lookup
shantijoseph.com	A 87.247.240.31	87.247.240.31
srivinaysalian.com	A 216.37.42.46	216.37.42.46
menuiserie-lemoine.bzh	A 188.165.53.185	188.165.53.185
vitiligomatch.com	A 192.185.16.122	192.185.16.122
labrie-sabette.com	A 173.230.252.50	173.230.252.50
tineo.gal	A 82.98.169.3	82.98.169.3
ootashop.com	A 199.188.205.57	199.188.205.57
thelottery.io	A 138.68.242.172	138.68.242.172
kweraltd.com	A 54.39.133.15	54.39.133.15
abidshakir.co.uk	A 62.171.164.209	62.171.164.209

TCP Requests

UDP Requests

GET 200 https://tineo.gal/wp-content/plugins/wordpress-seo/vendor/composer/installers/tests/Composer/Installers/lSNBjeKdHn.php

GET 403 https://menuiserie-lemoine.bzh/wp-content/themes/twentynineteen/template-parts/content/x0XxEHWGdeyPBEj.php

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49205 -> 216.37.42.46:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 216.37.42.46:443 -> 192.168.56.101:49207	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49206 -> 216.37.42.46:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49213 -> 199.188.205.57:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49211 -> 62.171.164.209:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49209 -> 62.171.164.209:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49211 -> 62.171.164.209:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49209 -> 62.171.164.209:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49209 -> 62.171.164.209:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 199.188.205.57:443 -> 192.168.56.101:49215	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 62.171.164.209:443 -> 192.168.56.101:49211	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 62.171.164.209:443 -> 192.168.56.101:49211	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 62.171.164.209:443 -> 192.168.56.101:49209	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 62.171.164.209:443 -> 192.168.56.101:49209	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49210 -> 62.171.164.209:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49210 -> 62.171.164.209:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49210 -> 62.171.164.209:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49218 -> 192.185.16.122:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49217 -> 192.185.16.122:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 62.171.164.209:443 -> 192.168.56.101:49210	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 62.171.164.209:443 -> 192.168.56.101:49210	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.185.16.122:443 -> 192.168.56.101:49220	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49225 -> 54.39.133.15:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49226 -> 54.39.133.15:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49225 -> 54.39.133.15:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49226 -> 54.39.133.15:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49225 -> 54.39.133.15:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 54.39.133.15:443 -> 192.168.56.101:49226	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 54.39.133.15:443 -> 192.168.56.101:49225	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 54.39.133.15:443 -> 192.168.56.101:49226	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 54.39.133.15:443 -> 192.168.56.101:49225	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49224 -> 54.39.133.15:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49224 -> 54.39.133.15:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49224 -> 54.39.133.15:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 54.39.133.15:443 -> 192.168.56.101:49224	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 54.39.133.15:443 -> 192.168.56.101:49224	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49204 -> 82.98.169.3:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49233 -> 87.247.240.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49234 -> 87.247.240.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49229 -> 173.230.252.50:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 87.247.240.31:443 -> 192.168.56.101:49235	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49228 -> 173.230.252.50:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49214 -> 199.188.205.57:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 173.230.252.50:443 -> 192.168.56.101:49230	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49232 -> 188.165.53.185:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49222 -> 138.68.242.172:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49204 82.98.169.3:443	C=US, O=Let's Encrypt, CN=R3	CN=tineo.gal	87:ac:66:65:d8:3d:7f:7d:d4:f4:9b:59:1b:36:52:43:b9:20:8d:9c
TLSv1 192.168.56.101:49232 188.165.53.185:443	C=US, O=Let's Encrypt, CN=R3	CN=menuiserie-lemoine.bzh	4f:05:fa:a2:bf:27:fe:2c:ba:9a:ef:f3:3d:c4:4b:bd:42:8b:90:84

Snort Alerts

No Snort Alerts