NetWork | ZeroBOX

Network Analysis

IP Address Status Action
172.217.161.164 Active Moloch
104.21.10.67 Active Moloch
104.21.37.182 Active Moloch
104.21.64.202 Active Moloch
164.124.101.2 Active Moloch
88.99.66.31 Active Moloch
GET 200 https://startupmart.bar/?user_auth=p4_1
REQUEST
RESPONSE
GET 200 https://startupmart.bar/?user_auth=p4_2
REQUEST
RESPONSE
GET 500 https://startupmart.bar/?user_auth=p4_3
REQUEST
RESPONSE
GET 0 https://startupmart.bar/?user_auth=p4_4
REQUEST
RESPONSE
GET 0 https://startupmart.bar/?user_auth=p4_5
REQUEST
RESPONSE
GET 0 https://startupmart.bar/?user_auth=p4_6
REQUEST
RESPONSE
GET 0 https://startupmart.bar/?user_auth=p4_7
REQUEST
RESPONSE
GET 200 https://phonefix.bar/api.php?getusers
REQUEST
RESPONSE
GET 200 https://iplogger.org/1c6My7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1aGEa7
REQUEST
RESPONSE
GET 200 https://phonefix.bar/api.php
REQUEST
RESPONSE
POST 100 https://phonefix.bar/
REQUEST
RESPONSE
GET 0 https://wheelllc.bar/api.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 104.21.37.182:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49217 -> 104.21.64.202:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49213 -> 104.21.10.67:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
104.21.37.182:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com d0:78:9b:08:f2:b6:0e:da:b4:de:37:46:98:ea:98:33:ac:62:58:1d
TLSv1
192.168.56.101:49210
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.101:49217
104.21.64.202:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 5e:f4:67:42:28:72:f0:d2:95:d8:9e:7d:2d:b6:fd:51:07:32:6d:ce
TLSv1
192.168.56.101:49213
104.21.10.67:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com c8:84:e2:8e:b6:c5:30:52:c2:d2:ae:3f:0d:1d:9d:1f:b1:0e:0b:b3
TLSv1
192.168.56.101:49218
88.99.66.31:443
None None None

Snort Alerts

No Snort Alerts