NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.54.4 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
bsnlplots.com 172.67.221.235
GET 404 https://bsnlplots.com/css/css/b/l/i2.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49165 -> 104.21.54.4:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49165
104.21.54.4:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com fd:49:9b:03:bf:ec:8d:81:dc:c1:61:c4:9e:5f:3d:c1:19:e9:29:1f

Snort Alerts

No Snort Alerts