Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
cdnjs.cloudflare.com | 104.16.18.94 |
GET
200
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
REQUEST
RESPONSE
BODY
GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 17 Aug 2021 08:46:50 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 31017
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "603e8adc-15d9d"
Last-Modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
CF-Cache-Status: HIT
Age: 3591124
Expires: Sun, 07 Aug 2022 08:46:50 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ksp%2F0k2iPS%2F6XWpcUE8yfnXt8xjx1bsT6UXJRaG0Mx%2B6D5je6bRGOxFQEZKrdOWJiPMX%2FUz4zRgmLq5GLNQSdpJ%2FZpK5D9OZSkmi6BjCiJOmKHWak%2BY9D8PSi3jyIVAgScWXozrt"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=15780000
Server: cloudflare
CF-RAY: 6801a25d7c8412d6-ICN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET
200
https://cdnjs.cloudflare.com/ajax/libs/jszip/3.6.0/jszip.min.js
REQUEST
RESPONSE
BODY
GET /ajax/libs/jszip/3.6.0/jszip.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 17 Aug 2021 08:46:51 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 27809
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "606209cf-18328"
Last-Modified: Mon, 29 Mar 2021 17:09:35 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
cf-request-id: 09bec610720000351a80143000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
CF-Cache-Status: HIT
Age: 9497854
Expires: Sun, 07 Aug 2022 08:46:51 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZOmPmrIBwmZJMeZ0wD57o4rEJ%2Biqob9I%2BTAG%2FJk%2B6pBnkyFLZKsyoeuwZvYCHK9m4r%2Bx662NxCi8PawHKHvYEAHqmEUONyoyL58cbNAlIaWKDR1BG6IK1Su%2Bu3AeJm7ZTJOht%2BNQ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=15780000
Server: cloudflare
CF-RAY: 6801a261bead618f-ICN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET
200
https://cdnjs.cloudflare.com/ajax/libs/jszip-utils/0.1.0/jszip-utils.min.js
REQUEST
RESPONSE
BODY
GET /ajax/libs/jszip-utils/0.1.0/jszip-utils.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 17 Aug 2021 08:46:51 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 868
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "5eb03ecf-73b"
Last-Modified: Mon, 04 May 2020 16:11:59 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
CF-Cache-Status: HIT
Age: 454531
Expires: Sun, 07 Aug 2022 08:46:51 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ni7aSxRuwRGTKCLSJ1FSvjaNZKr5vAX1Esh1jb2FGydXu6jG9NqEQ3vANl2UqS8Jm4xKSkSFem6D5w1UsURBUuPTixnsNmjam5KbsKIAlblZlrEwggc%2FVVP%2BLUSfYEslWQBhWWDH"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=15780000
Server: cloudflare
CF-RAY: 6801a265688712d6-ICN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET
200
https://cdnjs.cloudflare.com/ajax/libs/FileSaver.js/2.0.5/FileSaver.min.js
REQUEST
RESPONSE
BODY
GET /ajax/libs/FileSaver.js/2.0.5/FileSaver.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 17 Aug 2021 08:46:51 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 1318
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "5fb68fc1-abd"
Last-Modified: Thu, 19 Nov 2020 15:31:13 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
cf-request-id: 0a757bd7a80000a23de7976000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
CF-Cache-Status: HIT
Age: 6432488
Expires: Sun, 07 Aug 2022 08:46:51 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DlnwYV2K0O1RQsOgs88GhcRX44O%2BLB0QslibfLP6%2FZj47ptnw4Z2L%2FGHcFXzzro5V0uzzVrxJqwUC9YAsnJSBjXw9d7EE17La2OciYEHb40W4XpruBdYXI8ioxomIFe8cmdCV1S5"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=15780000
Server: cloudflare
CF-RAY: 6801a2659c80618f-ICN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET
200
http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE
BODY
GET /IE9CompatViewList.xml HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Host: ie9cvlist.ie.microsoft.com
If-Modified-Since: Fri, 16 Oct 2020 17:54:09 GMT
If-None-Match: 0x8D871FC7BDF491D
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Age: 12612
Cache-Control: max-age=21600
Content-MD5: p9g4jsuZO6TaLMVAI9ujVg==
Content-Type: text/xml
Date: Tue, 17 Aug 2021 08:47:49 GMT
Etag: 0x8D9521D2D2DF1EC
Last-Modified: Wed, 28 Jul 2021 23:12:31 GMT
Server: ECAcc (tka/897A)
Vary: Accept-Encoding
X-Cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 2e67b3a6-801e-0019-5727-93c16a000000
x-ms-version: 2009-09-19
Content-Length: 13702
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.102:49173 -> 117.18.232.200:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.102:49166 -> 104.16.19.94:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.102:49174 -> 117.18.232.200:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 117.18.232.200:443 -> 192.168.56.102:49175 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
TCP 192.168.56.102:49167 -> 104.16.19.94:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49166 104.16.19.94:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:91:48:ff:ab:fd:c3:87:fd:8a:34:e4:af:b1:73:fb:12:f5:09:49 |
TLSv1 192.168.56.102:49167 104.16.19.94:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:91:48:ff:ab:fd:c3:87:fd:8a:34:e4:af:b1:73:fb:12:f5:09:49 |
Snort Alerts
No Snort Alerts