NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.202.237 Active Moloch
164.124.101.2 Active Moloch
199.91.155.25 Active Moloch
GET 302 https://www.mediafire.com/file/p3ay4it08j1s7hp/0main.htm/file
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49166 -> 199.91.155.25:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49167 -> 199.91.155.25:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 199.91.155.25:443 -> 192.168.56.102:49168 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 104.16.202.237:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49165
104.16.202.237:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Organization Validation Secure Server CA C=US, ST=Texas, O=MediaFire, OU=IT, CN=*.mediafire.com 49:b6:4e:74:94:f0:7e:32:2b:c5:39:18:d0:a5:1e:69:4d:65:8f:b6

Snort Alerts

No Snort Alerts