NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.51.48 Active Moloch
104.21.71.122 Active Moloch
164.124.101.2 Active Moloch
88.99.66.31 Active Moloch
GET 0 https://niemannbest.me/?username=p15_1
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p15_2
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p15_3
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p15_4
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p15_5
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p15_6
REQUEST
RESPONSE
POST 100 https://online-stock-solutions.com/
REQUEST
RESPONSE
GET 0 https://niemannbest.me/?username=p15_7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1qads7
REQUEST
RESPONSE
GET 200 https://iplogger.org/1qsds7
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53 2027758 ET DNS Query for .cc TLD Potentially Bad Traffic
TCP 192.168.56.101:49201 -> 104.21.51.48:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49207 -> 104.21.71.122:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49209 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
104.21.51.48:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 16:7c:ef:5c:eb:cb:66:bc:19:9f:3a:95:c8:e3:06:1c:95:6b:0b:11
TLSv1
192.168.56.101:49207
104.21.71.122:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 0b:25:fd:6b:42:58:ec:82:45:ab:49:32:47:99:bc:e1:2d:df:0e:ca
TLSv1
192.168.56.101:49210
88.99.66.31:443
None None None
TLSv1
192.168.56.101:49209
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Snort Alerts

No Snort Alerts