Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| electronspectroscopy.bar | 172.67.133.24 | |
| startupmart.bar | ||
| best-supply-link.xyz | 104.21.35.128 |
- UDP Requests
-
-
192.168.56.102:52062 164.124.101.2:53
-
192.168.56.102:52336 164.124.101.2:53
-
192.168.56.102:64034 164.124.101.2:53
-
192.168.56.102:64995 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:49164 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
GET
200
https://best-supply-link.xyz/?user_auth=p4_1
REQUEST
RESPONSE
BODY
GET /?user_auth=p4_1 HTTP/1.1
Host: best-supply-link.xyz
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 19 Sep 2021 02:27:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
x-powered-by: PHP/7.1.33
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9bdMrcBBa93iwhxs2Fu5n%2B8zJyOKqCI6WgfhFy2tSeCrlLnWgVVUOpcrj2Bor430a7cHZF72pCgeV%2BzrIxb%2Bm%2BU%2F7E45esJqOPKEs1pTpvMO6xgl2d5tkukVPj51gOM3T9mY60s0Jg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 690f5f6d6eee0ace-KIX
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET
200
https://best-supply-link.xyz/?user_auth=p4_2
REQUEST
RESPONSE
BODY
GET /?user_auth=p4_2 HTTP/1.1
Host: best-supply-link.xyz
HTTP/1.1 200 OK
Date: Sun, 19 Sep 2021 02:27:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
x-powered-by: PHP/7.1.33
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4nHu6a18JZ78F4qpm5arV5BmUVEETFvxe3sCOPcLtuWbpz%2BuafXvcX7Gvdq1lwZ1BASaQEsAYRH7OjSl25MlSJUuaU1ityg1pUJ1uwNPHoqb4OrW1oHjY0Z7GXfFF9dZifbAcwk9nQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 690f5fb1998f0ace-KIX
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET
0
https://best-supply-link.xyz/?user_auth=p4_3
REQUEST
RESPONSE
BODY
GET /?user_auth=p4_3 HTTP/1.1
Host: best-supply-link.xyz
POST
100
https://electronspectroscopy.bar/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Host: electronspectroscopy.bar
Content-Length: 4640
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49164 -> 104.21.35.128:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49171 -> 172.67.133.24:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49164 104.21.35.128:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 72:ae:40:01:ab:8e:40:ff:b8:85:8c:54:dc:c0:99:3b:af:a3:50:99 |
|
TLSv1 192.168.56.102:49171 172.67.133.24:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | b4:b7:65:f9:96:ff:20:7e:c9:7b:a0:53:1b:14:98:ac:d6:aa:48:00 |
Snort Alerts
No Snort Alerts