NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.42.63 Active Moloch
104.26.12.31 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
172.67.222.237 Active Moloch
85.192.56.35 Active Moloch
88.99.66.31 Active Moloch
GET 0 https://videoconvert-download38.xyz/?user=newpb1_1
REQUEST
RESPONSE
GET 0 https://videoconvert-download38.xyz/?user=newpb1_2
REQUEST
RESPONSE
GET 0 https://videoconvert-download38.xyz/?user=newpb1_3
REQUEST
RESPONSE
GET 0 https://videoconvert-download38.xyz/?user=newpb1_4
REQUEST
RESPONSE
GET 0 https://videoconvert-download38.xyz/?user=newpb1_5
REQUEST
RESPONSE
GET 0 https://videoconvert-download38.xyz/?user=newpb1_6
REQUEST
RESPONSE
GET 200 https://pcfixmy-download-13.xyz/api.php?getusers
REQUEST
RESPONSE
GET 200 https://iplogger.org/1SPHi7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1vpFz7
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 200 https://pcfixmy-download-13.xyz/api.php
REQUEST
RESPONSE
POST 100 https://pcfixmy-download-13.xyz/
REQUEST
RESPONSE
POST 100 http://kanagannne.xyz/
REQUEST
RESPONSE
POST 100 http://kanagannne.xyz/
REQUEST
RESPONSE
POST 100 http://kanagannne.xyz/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49808 -> 104.21.42.63:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49815 -> 172.67.222.237:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49818 -> 104.26.12.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49816 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49814 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49808
104.21.42.63:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 93:6b:79:10:2f:fa:2c:2d:8f:dc:cc:56:70:d2:93:ad:c7:4d:2a:b5
TLSv1
192.168.56.102:49815
172.67.222.237:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com be:5c:1d:18:63:e0:32:d8:d5:c4:ac:93:c7:3f:13:6c:f4:b5:1d:b4
TLSv1
192.168.56.102:49818
104.26.12.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e
TLSv1
192.168.56.102:49814
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.102:49816
88.99.66.31:443
None None None

Snort Alerts

No Snort Alerts