NetWork | ZeroBOX

Network Analysis

IP Address Status Action
150.109.222.97 Active Moloch
164.124.101.2 Active Moloch
43.154.131.186 Active Moloch
61.110.197.11 Active Moloch
GET 200 https://www.ip138.com/
REQUEST
RESPONSE
GET 403 http://pv.sohu.com/cityjson
REQUEST
RESPONSE
GET 301 http://www.ip138.com/
REQUEST
RESPONSE
GET 200 http://2022.ip138.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 61.110.197.11:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49165
61.110.197.11:443
C=US, O=DigiCert Inc, CN=DigiCert Basic RSA CN CA G2 C=CN, ST=福建省, L=厦门市, O=网宿科技股份有限公司厦门分公司, CN=default.chinanetcenter.com e8:03:33:5c:51:55:27:6a:aa:32:35:20:46:a9:6f:ab:09:cb:c6:c2

Snort Alerts

No Snort Alerts