Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| ip4.seeip.org | 23.128.64.141 | |
| discord.com | 162.159.138.232 | |
| ip-api.com | 208.95.112.1 |
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62327 239.255.255.250:1900
-
192.168.56.101:62329 239.255.255.250:3702
-
192.168.56.101:62331 239.255.255.250:3702
-
192.168.56.101:62333 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
https://ip4.seeip.org/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: ip4.seeip.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Sun, 05 Sep 2021 23:17:31 GMT
Content-Type: text/plain
Content-Length: 15
Connection: keep-alive
strict-transport-security: max-age=31536000; includeSubDomains
POST
100
https://discord.com/api/webhooks/883326477058322432/IXZLhaSxLX1AF91879NsCIngdIsdSS1jfKadTr2S5yvi7fyakjNiWsb46ZXZWAKSxguX
REQUEST
RESPONSE
BODY
POST /api/webhooks/883326477058322432/IXZLhaSxLX1AF91879NsCIngdIsdSS1jfKadTr2S5yvi7fyakjNiWsb46ZXZWAKSxguX HTTP/1.1
Content-Type: application/json
Host: discord.com
Content-Length: 452
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
https://discord.com/api/webhooks/883326477058322432/IXZLhaSxLX1AF91879NsCIngdIsdSS1jfKadTr2S5yvi7fyakjNiWsb46ZXZWAKSxguX
REQUEST
RESPONSE
BODY
POST /api/webhooks/883326477058322432/IXZLhaSxLX1AF91879NsCIngdIsdSS1jfKadTr2S5yvi7fyakjNiWsb46ZXZWAKSxguX HTTP/1.1
Content-Type: application/json
Host: discord.com
Content-Length: 315
Expect: 100-continue
HTTP/1.1 100 Continue
GET
200
http://ip-api.com//json/175.208.134.150
REQUEST
RESPONSE
BODY
GET //json/175.208.134.150 HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 05 Sep 2021 23:17:40 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 275
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49206 -> 23.128.64.141:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49205 -> 23.128.64.141:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49207 -> 208.95.112.1:80 | 2022082 | ET POLICY External IP Lookup ip-api.com | Device Retrieving External IP Address Detected |
| TCP 192.168.56.101:49208 -> 162.159.128.233:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49206 23.128.64.141:443 |
None | None | None |
|
TLSv1 192.168.56.101:49205 23.128.64.141:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=ip.seeip.org | f1:99:11:a9:d0:61:44:69:46:48:9e:ac:37:a9:e7:3a:29:3d:13:97 |
|
TLSv1 192.168.56.101:49208 162.159.128.233:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | af:ff:1b:9d:0f:f5:f2:ad:ef:c8:c3:f5:45:0f:7f:e8:20:a0:79:0a |
Snort Alerts
No Snort Alerts