NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.250.204.129 Active Moloch
142.250.66.78 Active Moloch
164.124.101.2 Active Moloch
208.95.112.1 Active Moloch
GET 307 https://docs.google.com/document/d/10HvsTYa9mOZkmz5pyA-Za4wVTeJi4XzWOBmXG4x--SQ/export?format=txt
REQUEST
RESPONSE
GET 200 https://doc-0g-8k-docstext.googleusercontent.com/export/kr014gggnh0d9kvhc4c60ctnp0/qobs2n84j988rv25et34agsloo/1636505080000/109814536751784867157/*/10HvsTYa9mOZkmz5pyA-Za4wVTeJi4XzWOBmXG4x--SQ?format=txt
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/
REQUEST
RESPONSE
GET 200 http://ip-api.com/json/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49181 -> 142.250.66.78:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49182 -> 142.250.204.129:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49183 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.103:49183 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49181
142.250.66.78:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 16:80:69:27:68:35:54:61:3c:a2:bd:00:dc:49:ed:bb:d7:df:ee:cf
TLSv1
192.168.56.103:49182
142.250.204.129:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.googleusercontent.com a3:0c:85:1d:48:7f:3c:72:8f:9a:23:c7:23:f8:e4:03:ae:d0:4d:dc

Snort Alerts

No Snort Alerts