NetWork | ZeroBOX

Network Analysis

IP Address Status Action
162.159.135.233 Active Moloch
164.124.101.2 Active Moloch
172.67.75.172 Active Moloch
185.235.130.48 Active Moloch
34.117.59.81 Active Moloch
GET 200 https://cdn.discordapp.com/attachments/893177342426509335/905442111237816370/patch.jpg
REQUEST
RESPONSE
GET 522 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 200 https://ipinfo.io/ip
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 162.159.135.233:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49169 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.101:49169 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49168 -> 172.67.75.172:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.235.130.48:44050 -> 192.168.56.101:49166 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49162
162.159.135.233:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78
TLSv1
192.168.56.101:49169
34.117.59.81:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io f0:42:a0:3b:5b:a8:0e:51:f4:13:25:f7:fc:7c:dc:35:63:19:75:63
TLSv1
192.168.56.101:49168
172.67.75.172:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9

Snort Alerts

No Snort Alerts