NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
104.21.235.134 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
www.swingerxxx.com 104.21.235.134
GET 404 https://www.swingerxxx.com/images/MD.php
REQUEST
RESPONSE
GET 301 http://www.swingerxxx.com/images/MD.php
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49168 -> 104.21.235.134:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
104.21.235.134:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 8b:02:27:21:3c:49:d3:c3:4d:eb:57:38:39:c2:0c:72:7c:63:50:19

Snort Alerts

No Snort Alerts