NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.67.203.200 Active Moloch
Name Response Post-Analysis Lookup
baidu.hao012.tk 104.21.22.93
GET 500 https://baidu.hao012.tk:8443/image/
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2012811 ET DNS Query to a .tk domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 172.67.203.200:8443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 172.67.203.200:8443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49165
172.67.203.200:8443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.hao012.tk 59:27:4d:fc:a6:71:9f:e7:ca:34:7c:83:c3:89:f7:da:cb:a8:fa:e1
TLSv1
192.168.56.103:49166
172.67.203.200:8443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.hao012.tk 59:27:4d:fc:a6:71:9f:e7:ca:34:7c:83:c3:89:f7:da:cb:a8:fa:e1

Snort Alerts

No Snort Alerts