NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.23.96 Active Moloch
104.21.52.244 Active Moloch
107.180.29.18 Active Moloch
142.4.29.146 Active Moloch
159.89.200.161 Active Moloch
160.153.208.149 Active Moloch
162.241.218.172 Active Moloch
164.124.101.2 Active Moloch
192.185.110.230 Active Moloch
198.12.234.210 Active Moloch
208.109.41.227 Active Moloch

GET 404 https://zotno.xyz/wp-content/themes/storefront/e2e/specs/kCKt578W.php
REQUEST
RESPONSE
GET 404 https://brasilvioleiro.com.br/wp-content/cache/object/e3c/9ab/rSpBh8UHQx8r.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49164 -> 104.21.52.244:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49192 -> 192.185.110.230:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49171 -> 198.12.234.210:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49197 -> 160.153.208.149:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49167 -> 142.4.29.146:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49166 -> 142.4.29.146:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49170 -> 198.12.234.210:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49179 -> 208.109.41.227:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49176 -> 159.89.200.161:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49176 -> 159.89.200.161:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 159.89.200.161:443 -> 192.168.56.102:49176 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 159.89.200.161:443 -> 192.168.56.102:49176 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49182 -> 162.241.218.172:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49196 -> 160.153.208.149:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 208.109.41.227:443 -> 192.168.56.102:49180 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 198.12.234.210:443 -> 192.168.56.102:49172 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 142.4.29.146:443 -> 192.168.56.102:49168 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 208.109.41.227:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49174 -> 159.89.200.161:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49174 -> 159.89.200.161:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49174 -> 159.89.200.161:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49175 -> 159.89.200.161:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49175 -> 159.89.200.161:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49175 -> 159.89.200.161:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 107.180.29.18:443 -> 192.168.56.102:49188 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49193 -> 192.185.110.230:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 159.89.200.161:443 -> 192.168.56.102:49175 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 159.89.200.161:443 -> 192.168.56.102:49175 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.185.110.230:443 -> 192.168.56.102:49194 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49190 -> 104.21.23.96:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49183 -> 162.241.218.172:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.241.218.172:443 -> 192.168.56.102:49184 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49186 -> 107.180.29.18:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49187 -> 107.180.29.18:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 160.153.208.149:443 -> 192.168.56.102:49198 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 159.89.200.161:443 -> 192.168.56.102:49174 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 159.89.200.161:443 -> 192.168.56.102:49174 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49164
104.21.52.244:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a8:79:58:32:70:81:29:58:c8:ea:87:be:f6:a7:e4:6c:31:b8:7c:f5
TLSv1
192.168.56.102:49190
104.21.23.96:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 68:e2:fe:e6:33:4f:56:07:40:96:fa:1a:5d:e3:ff:53:b1:52:d0:b5

Snort Alerts

No Snort Alerts