NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.45.22.187 Active Moloch
117.18.232.200 Active Moloch
142.250.204.35 Active Moloch
142.251.220.4 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://pentest.privacyengine.io/
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/plugins/bootstrap/css/bootstrap.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/css/google-api-fonts.css
REQUEST
RESPONSE
GET 200 https://www.google.com/recaptcha/api.js?hl=en
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/css/components-rounded.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/font-awesome/css/font-awesome.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/css/layout-outer-custom.css?v=1
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/bootstrap-switch/css/bootstrap-switch.min.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/css/layout-outer.css?v=1
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/toastr-master/toastr.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/css/themes/dark.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/fonts/inter/inter.css
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/jquery-migrate.min.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/jquery.blockui.min.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/jquery.min.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/scripts/jquery.toaster.custom.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/jquery.validate/jquery.validate.min.1.13.0.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/plugins/summernote.min.js?v=1
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/scripts/layout-outer-custom.js?v=1
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/img/logo.png?v=1
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/images/20px/times-circle-modal.svg
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/autosize.min.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/plugins/bootstrap/js/bootstrap.min.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/plugins/summernote.min.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/new/js/main.js
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/fonts/inter/Inter-Regular.woff?v=3.15
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/assets/img/remove-icon-small.png
REQUEST
RESPONSE
GET 200 https://pentest.privacyengine.io/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49172 -> 142.251.220.4:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49185 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49164 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49175 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 142.250.204.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49184 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 142.251.220.4:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 142.250.204.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49183 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 104.45.22.187:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49172
142.251.220.4:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com c3:7c:54:cd:86:09:a4:3e:2c:6d:ec:7c:fa:65:7b:3e:64:cb:10:e0
TLSv1
192.168.56.101:49168
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49165
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49169
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49170
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49164
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49175
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49167
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49178
142.250.204.35:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 34:5a:0a:3b:4f:02:f9:c6:c9:d7:3f:ca:9d:17:0d:40:27:05:05:0a
TLSv1
192.168.56.101:49171
142.251.220.4:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com c3:7c:54:cd:86:09:a4:3e:2c:6d:ec:7c:fa:65:7b:3e:64:cb:10:e0
TLSv1
192.168.56.101:49174
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2
TLSv1
192.168.56.101:49179
142.250.204.35:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 34:5a:0a:3b:4f:02:f9:c6:c9:d7:3f:ca:9d:17:0d:40:27:05:05:0a
TLSv1
192.168.56.101:49176
104.45.22.187:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.privacyengine.io 69:f2:7b:59:6f:1d:61:3a:5c:ff:3a:ab:41:68:1c:f0:fc:b9:7d:f2

Snort Alerts

No Snort Alerts