NetWork | ZeroBOX

Network Analysis

IP Address Status Action
13.107.21.200 Active Moloch
164.124.101.2 Active Moloch
216.58.200.68 Active Moloch
Name Response Post-Analysis Lookup
www.google.com 172.217.31.132
GET 200 https://www.google.com/
REQUEST
RESPONSE
GET 0 https://www.bing.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 13.107.21.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 216.58.200.68:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49168
13.107.21.200:443
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 CN=www.bing.com af:e3:17:ed:18:4a:d9:1c:24:8a:89:d5:ac:11:b3:27:96:02:37:c8
TLSv1
192.168.56.101:49167
216.58.200.68:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com 5e:4b:8f:b5:bf:60:fd:ba:f1:72:07:9b:d3:3a:35:d8:d0:3b:75:57

Snort Alerts

No Snort Alerts