NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
172.217.174.202 Active Moloch
Name Response Post-Analysis Lookup
ajax.googleapis.com 172.217.175.234
GET 200 https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 172.217.174.202:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49162
172.217.174.202:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com ff:c0:ff:a1:df:4a:a6:62:2c:77:6b:0d:f5:da:dd:3c:ed:16:58:29

Snort Alerts

No Snort Alerts