NetWork | ZeroBOX

Network Analysis

IP Address Status Action
162.159.137.232 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://discord.com/channels/@me/990887447170793522/991802468818243614
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:60117 -> 164.124.101.2:53 2035465 ET INFO Observed Discord Domain in DNS Lookup (discord .com) Misc activity
TCP 192.168.56.103:49163 -> 162.159.137.232:443 2035463 ET INFO Observed Discord Domain (discord .com in TLS SNI) Misc activity
TCP 192.168.56.103:49163 -> 162.159.137.232:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49163
162.159.137.232:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7f:8c:3c:11:cb:b1:87:28:aa:1b:bf:7b:e0:d0:49:64:a6:d3:da:3a

Snort Alerts

No Snort Alerts