NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.8.227 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
j.ffbbjjkk.com 172.67.158.22
GET 200 https://j.ffbbjjkk.com/35.html
REQUEST
RESPONSE
GET 200 https://j.ffbbjjkk.com/logo.png
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 104.21.8.227:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49162
104.21.8.227:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.ffbbjjkk.com 8a:a5:6d:82:a6:a0:20:43:b2:b0:7e:aa:9a:9f:c2:ad:00:dd:fe:84

Snort Alerts

No Snort Alerts