Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| db-ip.com | 104.26.4.15 | |
| ipinfo.io | 34.117.59.81 | |
| api.db-ip.com | 104.26.5.15 |
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:53673 164.124.101.2:53
-
192.168.56.103:62576 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:62579 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.103:123
-
GET
200
https://db-ip.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Host: db-ip.com
HTTP/1.1 200 OK
Date: Mon, 06 Mar 2023 00:35:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-control: max-age=28800
X-IPLB-Request-ID: AC46E919:7FAA_93878F2E:0050_64050F89_D428301:2467A
X-IPLB-Instance: 30783
CF-Cache-Status: HIT
Age: 9680
Last-Modified: Sun, 05 Mar 2023 21:54:17 GMT
Server-Timing: cf-q-config;dur=6.0000020312145e-06
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PXvfR7bA7p3kQjgVJNxVgAqRQEOjSSxMuaJ9u32MUMVQVVIuNqN4%2F60oLJ6%2BEGUlYgcVqFiJiwtap1cDS0TJCGnn2HoDFxbaL%2BV1ExCaf7XtHflgpd2ROQyB5A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7a36851198bf8358-KIX
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST
200
https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self
REQUEST
RESPONSE
BODY
POST /v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self HTTP/1.1
Connection: Keep-Alive
Referer: https://db-ip.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Content-Length: 0
Host: api.db-ip.com
HTTP/1.1 200 OK
Date: Mon, 06 Mar 2023 00:35:38 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: http*://*db-ip.com
Cache-control: max-age=180
X-IPLB-Request-ID: AC46E935:D8B4_93878F2E:0050_64053555_D46AD9B:2467C
X-IPLB-Instance: 30783
CF-Cache-Status: DYNAMIC
Server-Timing: cf-q-config;dur=5.9999947552569e-06
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wc%2FJu0pNYTAZAoSTXKQMUrBT5p2Uk8TphXbr68cZadAwag80aRNWT8UaLW1Kv5Xe5mOULN7aDHjhUPZeK4%2Beh6CwwezgT1UeA2QOCPTwRiUWssCXCnblk3jwIdhbpHY%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7a3685129ec68329-KIX
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49163 -> 34.117.59.81:443 | 2025331 | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) | Device Retrieving External IP Address Detected |
| TCP 192.168.56.103:49163 -> 34.117.59.81:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49165 -> 104.26.4.15:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49163 -> 34.117.59.81:443 | 2025331 | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) | Device Retrieving External IP Address Detected |
| TCP 192.168.56.103:49166 -> 172.67.75.166:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49163 -> 34.117.59.81:443 | 2025331 | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) | Device Retrieving External IP Address Detected |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49165 104.26.4.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 8d:c8:6e:29:ea:e9:15:f8:85:80:ae:fd:51:f0:44:ca:8c:7d:0c:dc |
|
TLSv1 192.168.56.103:49166 172.67.75.166:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 8d:c8:6e:29:ea:e9:15:f8:85:80:ae:fd:51:f0:44:ca:8c:7d:0c:dc |
Snort Alerts
No Snort Alerts