NetWork | ZeroBOX

IP Address	Status	Action
104.255.169.179	Active	Moloch
138.68.235.11	Active	Moloch
144.91.77.124	Active	Moloch
162.253.125.64	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
18.136.132.202	Active	Moloch
70.39.250.160	Active	Moloch
87.229.72.45	Active	Moloch
94.124.84.11	Active	Moloch

Name	Response	Post-Analysis Lookup
monarchmedical.co.uk	A 18.136.132.202	18.136.132.202
fitzgeraldstreet.com	A 162.253.125.64	162.253.125.64
es.e-m2.net	A 94.124.84.11	94.124.84.11
teste.sitiodoastronauta.com.br	A 138.68.235.11	138.68.235.11
dev1.whoatemylunch.org	A 70.39.250.160	70.39.250.160
courieradmin.phebsoft-team.com	A 144.91.77.124	144.91.77.124
consultadom.e-m2.net	A 94.124.84.11	94.124.84.11
ahdmsport.com	A 104.255.169.179	104.255.169.179
adamjeecommodities.com	A 18.136.132.202	18.136.132.202
santorinitravel.naturalgraphic.hu	A 87.229.72.45	87.229.72.45

TCP Requests

UDP Requests

GET 404 https://dev1.whoatemylunch.org/wp-includes/js/tinymce/themes/inlite/hxXHK0N6.php

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 162.253.125.64:443 -> 192.168.56.102:49816	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49815 -> 162.253.125.64:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49819 -> 138.68.235.11:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49818 -> 138.68.235.11:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49828 -> 87.229.72.45:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 87.229.72.45:443 -> 192.168.56.102:49829	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49845 -> 144.91.77.124:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49811 -> 94.124.84.11:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49835 -> 104.255.169.179:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.102:49835 -> 104.255.169.179:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49835 -> 104.255.169.179:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49823 -> 18.136.132.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49836 -> 104.255.169.179:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.102:49836 -> 104.255.169.179:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49836 -> 104.255.169.179:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.255.169.179:443 -> 192.168.56.102:49836	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49836	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 94.124.84.11:443 -> 192.168.56.102:49812	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49826 -> 70.39.250.160:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 18.136.132.202:443 -> 192.168.56.102:49824	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49831 -> 94.124.84.11:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49844 -> 144.91.77.124:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 18.136.132.202:443 -> 192.168.56.102:49842	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 104.255.169.179:443 -> 192.168.56.102:49835	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49835	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49837 -> 104.255.169.179:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.102:49837 -> 104.255.169.179:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49837	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49837	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.102:49840 -> 18.136.132.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49810 -> 94.124.84.11:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49814 -> 162.253.125.64:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 138.68.235.11:443 -> 192.168.56.102:49820	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49822 -> 18.136.132.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49827 -> 87.229.72.45:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49832 -> 94.124.84.11:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 94.124.84.11:443 -> 192.168.56.102:49833	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49841 -> 18.136.132.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 144.91.77.124:443 -> 192.168.56.102:49846	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49826 70.39.250.160:443	C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority	CN=dev1.whoatemylunch.org	89:a5:e5:57:f0:d4:a4:c5:3b:74:aa:2d:ef:de:b8:b3:df:7c:16:01

Snort Alerts

No Snort Alerts