NetWork | ZeroBOX

Network Analysis

IP Address Status Action
162.159.129.233 Active Moloch
164.124.101.2 Active Moloch
182.162.106.26 Active Moloch
212.193.30.193 Active Moloch
81.177.141.85 Active Moloch
GET 200 https://cdn.discordapp.com/attachments/893177342426509335/897835449870090250/D3E31C82.jpg
REQUEST
RESPONSE
GET 200 https://cdn.discordapp.com/attachments/893177342426509335/897835452164366366/FBFC4F80.jpg
REQUEST
RESPONSE
GET 200 https://b.ckauni.ru/
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
81.177.141.85 192.168.56.102 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49163 -> 162.159.129.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49174 -> 81.177.141.85:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49163
162.159.129.233:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLS 1.2
192.168.56.102:49174
81.177.141.85:443
C=US, O=Let's Encrypt, CN=R3 CN=*.b.ckauni.ru 56:48:bb:59:46:44:77:9a:7f:be:08:ad:91:92:1f:23:d4:b2:a1:dc

Snort Alerts

No Snort Alerts