NetWork | ZeroBOX

Network Analysis

IP Address Status Action
157.240.215.35 Active Moloch
164.124.101.2 Active Moloch
172.67.200.215 Active Moloch
198.13.62.186 Active Moloch
208.95.112.1 Active Moloch
88.218.92.148 Active Moloch
88.99.66.31 Active Moloch
GET 200 https://www.facebook.com/
REQUEST
RESPONSE
GET 200 https://www.facebook.com/
REQUEST
RESPONSE
GET 200 https://iplogger.org/18hh57
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
POST 200 http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE
GET 200 http://uyg5wye.2ihsfa.com/api/fbtime
REQUEST
RESPONSE
POST 200 http://uyg5wye.2ihsfa.com/api/?sid=244033&key=14a21546c007e98b00ef413b26924f80
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
POST 200 http://ol.gamegame.info/report7.4.php
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
POST 200 http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/?fields=8198
REQUEST
RESPONSE
POST 200 http://iw.gamegame.info/report7.4.php
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3
192.168.56.101 198.13.62.186 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49204 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49211 -> 157.240.215.35:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49221 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49218 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49218 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49211
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com 64:6a:5b:69:8b:12:93:b5:d8:b2:20:d5:3f:4e:74:04:ca:ba:95:5e
TLSv1
192.168.56.101:49221
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Snort Alerts

No Snort Alerts