NetWork | ZeroBOX

Network Analysis

IP Address Status Action
105.27.205.34 Active Moloch
185.56.175.122 Active Moloch
107.180.56.180 Active Moloch
164.124.101.2 Active Moloch
172.67.188.154 Active Moloch
216.146.43.70 Active Moloch
221.147.172.5 Active Moloch
5.152.175.57 Active Moloch
60.51.47.65 Active Moloch
GET 200 https://freegeoip.app/xml/175.208.134.150
REQUEST
RESPONSE
GET 200 http://checkip.dyndns.org/
REQUEST
RESPONSE
GET 200 http://checkip.dyndns.org/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53 2012758 ET INFO DYNAMIC_DNS Query to *.dyndns. Domain Misc activity
TCP 192.168.56.101:49204 -> 216.146.43.70:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.101:49203 -> 216.146.43.70:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 107.180.56.180:587 -> 192.168.56.101:49206 2260002 SURICATA Applayer Detect protocol only one direction Generic Protocol Command Decode
TCP 216.146.43.70:80 -> 192.168.56.101:49204 2014932 ET POLICY DynDNS CheckIp External IP Address Server Response Device Retrieving External IP Address Detected
TCP 192.168.56.101:49205 -> 172.67.188.154:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 216.146.43.70:80 -> 192.168.56.101:49203 2014932 ET POLICY DynDNS CheckIp External IP Address Server Response Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49205
172.67.188.154:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 34:53:38:0b:ad:7d:fb:fe:29:b1:d8:59:af:32:ce:ba:08:4c:87:3b

Snort Alerts

No Snort Alerts