NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.18.19.218 Active Moloch
104.21.89.144 Active Moloch
104.22.68.176 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://bitcoin.org/bin/bitcoin-core-22.0/bitcoin-22.0-win64-setup.exe
REQUEST
RESPONSE
GET 200 https://download.electrum.org/4.3.4/electrum-4.3.4-setup.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 104.18.19.218:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.18.19.218:443 -> 192.168.56.101:49166 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 104.22.68.176:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 104.21.89.144:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 104.18.19.218:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49162
104.22.68.176:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.bitcoin.org 1a:81:c6:0e:51:52:81:af:8a:1f:a8:fe:a3:18:04:fa:db:01:f5:3c
TLSv1
192.168.56.101:49168
104.21.89.144:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.electrum.org 76:1b:7b:1a:b2:a7:3f:c5:99:a7:2b:68:f5:fd:1b:a5:5e:97:4b:65

Snort Alerts

No Snort Alerts