Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.google.com | 142.250.206.228 |
GET
0
https://www.google.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: www.google.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 15 Feb 2023 00:40:11 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2023-02-15-00; expires=Fri, 17-Mar-2023 00:40:11 GMT; path=/; domain=.google.com; Secure
Set-Cookie: AEC=ARSKqsJQwuvqyYztfn3nQ_xZHpfDOMBXBHZ-iXcKhySw3QFeaTKgkRpOFQ; expires=Mon, 14-Aug-2023 00:40:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: NID=511=IgJ-MK74T5NaXaAfJG-Pnb7my9q2baFhFlIR8DN3iZ8YP33wL_VPJ-TNaobCsV3ZRudfLM4iPHXIqzG2RQQcyMhLTfMIW8mC_Xjy3H9NAcq0DxeHt1K5bcJTaS4u8OaFJxJfhgDLciqAsino3_ylns1Ilqqbx--QKonqs2oPCTE; expires=Thu, 17-Aug-2023 00:40:11 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
GET
0
https://www.google.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: www.google.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 15 Feb 2023 00:42:05 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2023-02-15-00; expires=Fri, 17-Mar-2023 00:42:05 GMT; path=/; domain=.google.com; Secure
Set-Cookie: AEC=ARSKqsImOmWOz0Bc5KWqeLKWezoHQ2LxM7ezmreKAr9vGgOSBT0vcCWx4w; expires=Mon, 14-Aug-2023 00:42:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: NID=511=iEGHsYdSIeImNuPqvo4dWZy07jJQRU_QTHY1EzoqpL5xNpmwH3g8lZcXfdZvhz6eAlDDEMS0TrQd8PgYH0bvEaeDQ9aU2-L1OtmuxagAqsUUfqalcJpTPVpWAIhXg2qBXUnKf0Uywa_vKa1rBL29o0bJxMcqGP-HTX46geBM1eg; expires=Thu, 17-Aug-2023 00:42:05 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49172 -> 142.250.207.36:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49162 -> 142.250.207.36:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49172 142.250.207.36:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=www.google.com | f3:20:a1:a6:14:71:79:4e:7d:03:9e:5d:df:53:e0:29:a6:0d:b3:e2 |
|
TLSv1 192.168.56.101:49162 142.250.207.36:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=www.google.com | f3:20:a1:a6:14:71:79:4e:7d:03:9e:5d:df:53:e0:29:a6:0d:b3:e2 |
Snort Alerts
No Snort Alerts