Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| google.com | 172.217.175.78 | |
| www.google.com | 142.250.199.100 |
- UDP Requests
-
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:61480 239.255.255.250:3702
-
192.168.56.101:62327 239.255.255.250:1900
-
192.168.56.101:62329 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
301
https://google.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: google.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Location: https://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Wed, 08 Sep 2021 08:08:30 GMT
Expires: Fri, 08 Oct 2021 08:08:30 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 220
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET
200
https://www.google.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: www.google.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 08 Sep 2021 08:08:30 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2021-09-08-08; expires=Fri, 08-Oct-2021 08:08:30 GMT; path=/; domain=.google.com; Secure
Set-Cookie: NID=223=iZ3sDeTG9pKEqFTSzgvJRADCOGKWA6p28uVRHEwS0NSTlbgspGiRhBTQdWnzPQDBn9urox6P2gQh2vmYBcWtMDVuvCwLPCA1HBahIUak3NjEVqS_7WEl5UHlghuVOL_9Ga2_68Xss5PiQjs9rFqHjkpk4uZo-pQJuhxoP9GfTws; expires=Thu, 10-Mar-2022 08:08:30 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49200 -> 172.217.161.164:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49198 -> 216.58.220.206:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49200 172.217.161.164:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=www.google.com | 50:9d:4c:90:97:dd:23:de:78:ad:a2:09:25:c9:6b:30:0c:13:f1:94 |
|
TLSv1 192.168.56.101:49198 216.58.220.206:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=*.google.com | ef:1f:1c:2c:41:c4:ed:3c:4e:60:4f:56:1b:ed:09:ba:e9:e1:39:2d |
Snort Alerts
No Snort Alerts