NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.217.27.36 Active Moloch
Name Response Post-Analysis Lookup
www.google.com 172.217.25.164
GET 200 https://www.google.com/search?q=t+mobile+login&source=hp&ei=jWInZICdLYLQkPIPlrCG8AQ&oq=tmobile+lo&gs_lcp=ChFtb2JpbGUtZ3dzLXdpei1ocBABGAAyBwgAEIAEEAoyCAgAEIAEEMkDMggIABCKBRCSAzILCAAQgAQQsQMQgwEyBQgAEIAEMgUIABCABDIFCAAQgAQyBQgAEIAEOgsIKRCABBCxAxCDAToCCCk6DggAEI8BEOoCEIwDEOUCOg4ILhCPARDqAhCMAxDlAjoICAAQgAQQsQM6DgguEIAEELEDEIMBENQCOgsILhCABBDHARCvAToNCC4QgAQQxwEQ0QMQCjoKCAAQgAQQyQMQCjoKCAAQgAQQkgMQCjoQCC4QgAQQsQMQxwEQ0QMQClDWDFiRZ2CLb2gAcAB4AIAB5AGIAa4NkgEFMC44LjKYAQCgAQGwARQ&sclient=mobile-gws-wiz-hp
REQUEST
RESPONSE
GET 0 https://www.google.com/images/branding/searchlogo/1x/googlelogo_desk_heirloom_color_150x55dp.gif
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 172.217.27.36:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 172.217.27.36:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49172 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49173 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
172.217.27.36:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com d3:51:df:2c:c5:59:90:61:21:b2:f2:a0:d7:43:4e:06:00:25:af:c9
TLSv1
192.168.56.101:49165
172.217.27.36:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com d3:51:df:2c:c5:59:90:61:21:b2:f2:a0:d7:43:4e:06:00:25:af:c9

Snort Alerts

No Snort Alerts