NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.67.214.69 Active Moloch
69.16.175.42 Active Moloch
GET 200 https://use.fontawesome.com/releases/v5.7.0/css/all.css
REQUEST
RESPONSE
GET 200 https://use.fontawesome.com/releases/v5.7.0/webfonts/fa-regular-400.eot
REQUEST
RESPONSE
GET 200 https://use.fontawesome.com/releases/v5.7.0/webfonts/fa-solid-900.eot
REQUEST
RESPONSE
GET 200 https://code.jquery.com/jquery-1.12.4.min.js
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49212 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49204 -> 172.67.214.69:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49205 -> 69.16.175.42:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49214 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 172.67.214.69:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49206 -> 69.16.175.42:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49213 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49204
172.67.214.69:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com f2:20:91:a9:42:71:20:ad:c4:ae:41:6d:83:30:80:35:7d:ae:1e:53
TLSv1
192.168.56.101:49205
69.16.175.42:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.jquery.com 1e:0c:24:0d:28:fa:9d:cd:f4:f0:87:44:3d:92:67:22:f8:8f:59:17
TLSv1
192.168.56.101:49203
172.67.214.69:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com f2:20:91:a9:42:71:20:ad:c4:ae:41:6d:83:30:80:35:7d:ae:1e:53
TLSv1
192.168.56.101:49206
69.16.175.42:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.jquery.com 1e:0c:24:0d:28:fa:9d:cd:f4:f0:87:44:3d:92:67:22:f8:8f:59:17

Snort Alerts

No Snort Alerts