NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.14.200 Active Moloch
104.26.12.31 Active Moloch
164.124.101.2 Active Moloch
172.67.150.32 Active Moloch
188.124.36.242 Active Moloch
88.99.66.31 Active Moloch
94.140.112.88 Active Moloch
GET 0 https://dependstar.bar/?username=p9_1
REQUEST
RESPONSE
GET 0 https://dependstar.bar/?username=p9_2
REQUEST
RESPONSE
GET 0 https://dependstar.bar/?username=p9_3
REQUEST
RESPONSE
GET 0 https://dependstar.bar/?username=p9_4
REQUEST
RESPONSE
GET 0 https://dependstar.bar/?username=p9_5
REQUEST
RESPONSE
GET 0 https://dependstar.bar/?username=p9_6
REQUEST
RESPONSE
GET 0 https://dependstar.bar/?username=p9_7
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 200 https://iplogger.org/1bsZq7
REQUEST
RESPONSE
GET 200 https://one-globe-online.bar/api.php
REQUEST
RESPONSE
GET 200 https://iplogger.org/1DAit7
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 104.21.14.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49203 -> 172.67.150.32:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 104.26.12.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49211 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49212 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49216 -> 104.26.12.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
104.21.14.200:443
C=US, O=Let's Encrypt, CN=R3 CN=*.dependstar.bar 4b:2d:d1:8b:07:37:7d:2d:a6:3f:f2:f8:4f:5f:a0:b7:c6:ed:89:49
TLSv1
192.168.56.101:49203
172.67.150.32:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com f4:1e:e0:c7:47:7f:16:59:fc:b5:a5:ee:b2:bb:4d:13:72:a3:24:b4
TLSv1
192.168.56.101:49210
104.26.12.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1
192.168.56.101:49211
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.101:49212
88.99.66.31:443
None None None
TLSv1
192.168.56.101:49216
104.26.12.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9

Snort Alerts

No Snort Alerts