NetWork | ZeroBOX

Network Analysis

IP Address Status Action
185.140.53.199 Active Moloch
104.16.154.36 Active Moloch
162.159.129.233 Active Moloch
164.124.101.2 Active Moloch
212.1.210.54 Active Moloch
GET 200 https://cdn.discordapp.com/attachments/893177342426509335/898167236617981952/898D6AF5.jpg
REQUEST
RESPONSE
GET 200 https://cdn.discordapp.com/attachments/893177342426509335/898167239608504340/29015685.jpg
REQUEST
RESPONSE
GET 403 http://whatismyipaddress.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49163 -> 162.159.129.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 212.1.210.54:587 -> 192.168.56.102:49169 2260002 SURICATA Applayer Detect protocol only one direction Generic Protocol Command Decode
TCP 192.168.56.102:49169 -> 212.1.210.54:587 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 212.1.210.54:587 -> 192.168.56.102:49178 2260002 SURICATA Applayer Detect protocol only one direction Generic Protocol Command Decode
TCP 192.168.56.102:49178 -> 212.1.210.54:587 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49163
162.159.129.233:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.102:49169
212.1.210.54:587
C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority CN=abagoodluck.com 7f:6d:18:f5:04:64:14:6d:bf:be:b4:2b:16:26:ba:08:7c:6f:9d:c2
TLSv1
192.168.56.102:49178
212.1.210.54:587
C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority CN=abagoodluck.com 7f:6d:18:f5:04:64:14:6d:bf:be:b4:2b:16:26:ba:08:7c:6f:9d:c2

Snort Alerts

No Snort Alerts