popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 4 DNS 2 TCP 4 UDP 11 HTTP(S) 2 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
164.124.101.2 Active Moloch
172.67.75.172 Active Moloch
79.174.13.108 Active Moloch
80.66.87.32 Active Moloch
GET 200 https://api.ip.sb/geoip
REQUEST
: GET /geoip HTTP/1.1
Host: api.ip.sb
Connection: Keep-Alive
RESPONSE
: HTTP/1.1 200 OK
Date: Sat, 18 Sep 2021 10
Content-Type: application/json; charset=utf-8
Content-Length: 348
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Cache-Control: no-cache
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https
Report-To: {"endpoints"
NEL: {"success_fraction"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 690a02f6ee690abe-KIX
alt-svc: h3="
BODY 

            

        


    



        
            

    
        GET
        
        200
        https://api.ip.sb/geoip
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /geoip HTTP/1.1
			

			

				Host:
				 api.ip.sb
			

			

				Connection:
				 Keep-Alive
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Date:
				 Sat, 18 Sep 2021 10
			

			

				Content-Type:
				 application/json; charset=utf-8
			

			

				Content-Length:
				 348
			

			

				Connection:
				 keep-alive
			

			

				Vary:
				 Accept-Encoding
			

			

				Vary:
				 Accept-Encoding
			

			

				Cache-Control:
				 no-cache
			

			

				Access-Control-Allow-Origin:
				 *
			

			

				CF-Cache-Status:
				 DYNAMIC
			

			

				Expect-CT:
				 max-age=604800, report-uri="https
			

			

				Report-To:
				 {"endpoints"
			

			

				NEL:
				 {"success_fraction"
			

			

				Strict-Transport-Security:
				 max-age=31536000; includeSubDomains; preload
			

			

				Server:
				 cloudflare
			

			

				CF-RAY:
				 690a02f75fc8ae55-KIX
			

			

				alt-svc:
				 h3="
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.101:49211 ->
                172.67.75.172:443
            
            906200056
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49212 ->
                172.67.75.172:443
            
            906200056
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.101:49211 

                172.67.75.172:443
            		
            C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2
            C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com
            7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
        

        
        

            
                TLSv1 

                192.168.56.101:49212 

                172.67.75.172:443
            		
            C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2
            C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com
            7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
        

        
    





                            
Snort Alerts


    
No Snort Alerts