NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.67.210.161 Active Moloch
Name Response Post-Analysis Lookup
www.vmware.rest 172.67.210.161
GET 522 https://www.vmware.rest/jquery-3.3.1.min.js
REQUEST
RESPONSE
GET 200 https://www.vmware.rest/cdn-cgi/styles/main.css
REQUEST
RESPONSE
GET 200 https://www.vmware.rest/cdn-cgi/images/cf-icon-browser.png
REQUEST
RESPONSE
GET 200 https://www.vmware.rest/cdn-cgi/images/cf-icon-cloud.png
REQUEST
RESPONSE
GET 200 https://www.vmware.rest/cdn-cgi/images/cf-icon-server.png
REQUEST
RESPONSE
GET 200 https://www.vmware.rest/cdn-cgi/images/cf-icon-error.png
REQUEST
RESPONSE
GET 200 https://www.vmware.rest/cdn-cgi/images/cf-icon-ok.png
REQUEST
RESPONSE
GET 522 https://www.vmware.rest/favicon.ico
REQUEST
RESPONSE
GET 304 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49166 -> 172.67.210.161:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49179 -> 172.67.210.161:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49173 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49180 -> 172.67.210.161:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49171 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49170 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49177 -> 172.67.210.161:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49165 -> 172.67.210.161:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49168 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49172 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 172.67.210.161:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49166
172.67.210.161:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.102:49180
172.67.210.161:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.102:49179
172.67.210.161:443
None None None
TLSv1
192.168.56.102:49177
172.67.210.161:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.102:49165
172.67.210.161:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.vmware.rest 97:9f:77:bf:9c:8b:74:27:ef:fa:3f:9b:d8:84:10:f2:7a:b8:d7:66
TLSv1
192.168.56.102:49178
172.67.210.161:443
None None None

Snort Alerts

No Snort Alerts