NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
104.21.61.132 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
vmware.rest 104.21.61.132
GET 522 https://vmware.rest/jquery-3.3.1.min.js
REQUEST
RESPONSE
GET 200 https://vmware.rest/cdn-cgi/styles/main.css
REQUEST
RESPONSE
GET 0 https://vmware.rest/cdn-cgi/images/cf-icon-browser.png
REQUEST
RESPONSE
GET 200 https://vmware.rest/cdn-cgi/images/cf-icon-ok.png
REQUEST
RESPONSE
GET 200 https://vmware.rest/cdn-cgi/images/cf-icon-error.png
REQUEST
RESPONSE
GET 200 https://vmware.rest/cdn-cgi/images/cf-icon-cloud.png
REQUEST
RESPONSE
GET 200 https://vmware.rest/cdn-cgi/images/cf-icon-server.png
REQUEST
RESPONSE
GET 0 https://vmware.rest/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49170 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49164 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 104.21.61.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49175 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49177 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49165
104.21.61.132:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.101:49170
104.21.61.132:443
None None None
TLSv1
192.168.56.101:49167
104.21.61.132:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.101:49169
104.21.61.132:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.101:49164
104.21.61.132:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.101:49171
104.21.61.132:443
None None None
TLSv1
192.168.56.101:49168
104.21.61.132:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66

Snort Alerts

No Snort Alerts