NetWork | ZeroBOX

Network Analysis

IP Address Status Action
103.224.212.222 Active Moloch
104.21.69.237 Active Moloch
121.254.136.27 Active Moloch
164.124.101.2 Active Moloch
185.230.63.107 Active Moloch
212.1.210.110 Active Moloch
66.96.149.32 Active Moloch
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
GET 200 http://baangnews.com/wp-admin/z0lGKS/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49166 -> 66.96.149.32:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 212.1.210.110:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49169 -> 212.1.210.110:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49168 -> 212.1.210.110:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49169 -> 212.1.210.110:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 212.1.210.110:443 -> 192.168.56.102:49169 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 212.1.210.110:443 -> 192.168.56.102:49169 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49170 -> 103.224.212.222:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49171 -> 103.224.212.222:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49174 -> 185.230.63.107:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49168 -> 212.1.210.110:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49168 -> 212.1.210.110:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49173 -> 185.230.63.107:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 212.1.210.110:443 -> 192.168.56.102:49168 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 212.1.210.110:443 -> 192.168.56.102:49168 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49166
66.96.149.32:443
C=US, O=Let's Encrypt, CN=R3 CN=*.theaffiliateincome.com 65:8d:5f:6b:7b:f6:fc:c3:5f:a4:87:6b:b3:52:f7:0f:4a:91:b9:cd

Snort Alerts

No Snort Alerts