NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.94.228 Active Moloch
121.254.136.57 Active Moloch
164.124.101.2 Active Moloch
172.67.144.208 Active Moloch
172.67.221.103 Active Moloch
188.68.201.6 Active Moloch
45.129.99.59 Active Moloch
45.130.41.15 Active Moloch
88.99.66.31 Active Moloch
GET 0 https://niemannbest.me/?username=p16_1
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p16_3
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p16_5
REQUEST
RESPONSE
POST 100 https://online-stock-solutions.com/
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p16_6
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p16_7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1qdds7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1IXpS
REQUEST
RESPONSE
POST 100 https://speeddatingstudio.com/
REQUEST
RESPONSE
GET 200 https://groo.extralive.site/
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:64995 -> 164.124.101.2:53 2027758 ET DNS Query for .cc TLD Potentially Bad Traffic
TCP 192.168.56.102:49163 -> 172.67.221.103:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:64034 -> 164.124.101.2:53 2027758 ET DNS Query for .cc TLD Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 172.67.144.208:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49180 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49181 -> 104.21.94.228:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49179 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49182 -> 45.130.41.15:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49163
172.67.221.103:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 16:7c:ef:5c:eb:cb:66:bc:19:9f:3a:95:c8:e3:06:1c:95:6b:0b:11
TLSv1
192.168.56.102:49172
172.67.144.208:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 0b:25:fd:6b:42:58:ec:82:45:ab:49:32:47:99:bc:e1:2d:df:0e:ca
TLSv1
192.168.56.102:49180
88.99.66.31:443
None None None
TLSv1
192.168.56.102:49181
104.21.94.228:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:d8:32:f1:aa:8f:dc:7e:26:ab:ab:a0:a4:3b:db:67:c8:9d:2e:d5
TLSv1
192.168.56.102:49179
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLS 1.2
192.168.56.102:49182
45.130.41.15:443
C=US, O=Let's Encrypt, CN=R3 CN=extralive.site 61:6f:79:cf:21:4b:61:c5:68:60:6f:0a:a2:7b:12:f9:63:d3:ac:9e

Snort Alerts

No Snort Alerts