NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.22.36 Active Moloch
104.21.74.160 Active Moloch
104.26.13.31 Active Moloch
164.124.101.2 Active Moloch
188.124.36.242 Active Moloch
188.165.222.221 Active Moloch
88.99.66.31 Active Moloch
94.140.112.88 Active Moloch
GET 0 https://guidereviews.bar/?username=p9_1
REQUEST
RESPONSE
GET 0 https://guidereviews.bar/?username=p9_2
REQUEST
RESPONSE
GET 0 https://guidereviews.bar/?username=p9_3
REQUEST
RESPONSE
POST 100 https://all-design-space.top/
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 0 https://guidereviews.bar/?username=p9_4
REQUEST
RESPONSE
GET 0 https://guidereviews.bar/?username=p9_7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1aBhd7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1aNhd7
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49164 -> 104.21.22.36:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:64995 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.102:49170 -> 104.21.74.160:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49173 -> 104.26.13.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49177 -> 104.26.13.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49189 -> 104.26.13.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49188 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49187 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49164
104.21.22.36:443
C=US, O=Let's Encrypt, CN=R3 CN=*.guidereviews.bar f8:d2:01:79:14:17:35:10:a6:4c:62:52:e6:c8:6d:5a:41:fd:04:99
TLSv1
192.168.56.102:49170
104.21.74.160:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 25:5b:bb:c9:8a:6c:8d:6c:d1:1c:b3:8c:2c:4e:76:b3:e4:a9:95:c3
TLSv1
192.168.56.102:49173
104.26.13.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1
192.168.56.102:49177
104.26.13.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1
192.168.56.102:49189
104.26.13.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1
192.168.56.102:49188
88.99.66.31:443
None None None
TLSv1
192.168.56.102:49187
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Snort Alerts

No Snort Alerts