Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| elcbd.net | 209.222.97.206 | |
| saftronics.co.za | 196.37.111.115 | |
| pmbtvonline.com | 192.185.227.95 |
- TCP Requests
-
-
192.168.56.103:49172 192.185.227.95:443pmbtvonline.com
-
192.168.56.103:49174 192.185.227.95:443pmbtvonline.com
-
192.168.56.103:49175 192.185.227.95:443pmbtvonline.com
-
192.168.56.103:49177 196.37.111.115:443saftronics.co.za
-
192.168.56.103:49168 209.222.97.206:443elcbd.net
-
192.168.56.103:49169 209.222.97.206:443elcbd.net
-
192.168.56.103:49170 209.222.97.206:443elcbd.net
-
- UDP Requests
-
-
192.168.56.103:53498 164.124.101.2:53
-
192.168.56.103:53893 164.124.101.2:53
-
192.168.56.103:56357 164.124.101.2:53
-
192.168.56.103:58465 164.124.101.2:53
-
192.168.56.103:63128 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:49152 239.255.255.250:3702
-
192.168.56.103:49168 239.255.255.250:1900
-
192.168.56.103:49170 239.255.255.250:3702
-
192.168.56.103:53894 239.255.255.250:3702
-
192.168.56.103:56358 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.103:123
-
GET
200
https://saftronics.co.za/WRpRfTpvJ/alen.html
REQUEST
RESPONSE
BODY
GET /WRpRfTpvJ/alen.html HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Host: saftronics.co.za
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sat, 16 Oct 2021 04:05:56 GMT
Server: Apache
X-Powered-By: PHP/7.4.16
Cache-Control: max-age=86400
Expires: Sun, 17 Oct 2021 04:05:56 GMT
Vary: User-Agent
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49174 -> 192.185.227.95:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 209.222.97.206:443 -> 192.168.56.103:49170 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
| TCP 192.168.56.103:49168 -> 209.222.97.206:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49169 -> 209.222.97.206:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49177 -> 196.37.111.115:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49172 -> 192.185.227.95:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.185.227.95:443 -> 192.168.56.103:49175 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49177 196.37.111.115:443 |
C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority | CN=saftronics.co.za | e3:23:5e:cd:7c:24:5f:df:cc:6d:44:e3:11:22:7a:22:08:d6:07:34 |
Snort Alerts
No Snort Alerts