NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.251.220.4 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
www.google.com 142.250.76.132
GET 200 https://www.google.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 142.251.220.4:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49162
142.251.220.4:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com 78:c8:75:67:11:10:cc:4e:f6:7a:ae:7c:09:54:a1:f7:44:d8:18:e0

Snort Alerts

No Snort Alerts