Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.google.com | 142.250.206.228 |
GET
200
https://www.google.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: www.google.com
Connection: Close
HTTP/1.1 200 OK
Date: Sat, 25 Jun 2022 09:01:55 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2022-06-25-09; expires=Mon, 25-Jul-2022 09:01:55 GMT; path=/; domain=.google.com; Secure
Set-Cookie: AEC=AakniGNVPXZnjFwMpCIFSahD3hYUiNQpvkuzKwD8jI3R0E0hBIm8FtgyIPM; expires=Thu, 22-Dec-2022 09:01:55 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: NID=511=g9qef6CTwoD8M0tlS9Q29xsTxkXXz0evT0gp8BtLVzTNl4QMbZf6wvoxxlOcMUTkm-Y1z6IGxpfl7oik5mZQ0osBASmmG2i61BMu2Hr-iACnB-MOQBXK0joKzblaPacuPTCA-roPzuJm2uxQ64ZCiNhjoOsjqIBve0jiHkIslMA; expires=Sun, 25-Dec-2022 09:01:55 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Connection: close
Transfer-Encoding: chunked
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49161 -> 172.217.161.68:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49161 172.217.161.68:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=www.google.com | a4:07:f4:90:6a:f9:b4:aa:1a:00:64:11:22:ab:9c:52:bb:ba:9a:d8 |
Snort Alerts
No Snort Alerts