NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
181.214.31.79	Active	Moloch

Name	Response	Post-Analysis Lookup
aljazeera.cc	A 181.214.31.79	181.214.31.79

UDP Requests

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:53893 -> 164.124.101.2:53	2027758	ET DNS Query for .cc TLD	Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 181.214.31.79:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 181.214.31.79:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.103:49169 -> 181.214.31.79:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 181.214.31.79:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 181.214.31.79:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 181.214.31.79:443 -> 192.168.56.103:49169	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 181.214.31.79:443 -> 192.168.56.103:49169	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 181.214.31.79:443 -> 192.168.56.103:49168	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 181.214.31.79:443 -> 192.168.56.103:49168	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts