NetWork | ZeroBOX

Network Analysis

IP Address Status Action
103.86.45.70 Active Moloch
117.18.232.200 Active Moloch
142.250.199.67 Active Moloch
142.251.130.10 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://fonts.googleapis.com/earlyaccess/nanumgothic.css
REQUEST
RESPONSE
GET 200 https://fonts.googleapis.com/earlyaccess/notosanskr.css
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/nanumgothic/v21/PN_oRfi-oW3hYwmKDpxS7F_LQv3LyVsg.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/notosanskr/v27/Pby7FmXiEBPT4ITbgNA5CgmOelz477IX.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/nanumgothic/v21/PN_oRfi-oW3hYwmKDpxS7F_LXv7LyVsg.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/notosanskr/v27/Pby6FmXiEBPT4ITbgNA5CgmOsk7vyJE.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/nanumgothic/v21/PN_3Rfi-oW3hYwmKDpxS7F_D-djY.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/notosanskr/v27/PbykFmXiEBPT4ITbgNA5CgmG0X7r.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/notosanskr/v27/Pby7FmXiEBPT4ITbgNA5CgmOIl3477IX.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/notosanskr/v27/Pby7FmXiEBPT4ITbgNA5CgmOalv477IX.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/notosanskr/v27/Pby7FmXiEBPT4ITbgNA5CgmOUln477IX.woff
REQUEST
RESPONSE
GET 301 http://103.86.45.70/ant1a
REQUEST
RESPONSE
GET 307 http://103.86.45.70/ant1a/
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/Main/Login
REQUEST
RESPONSE
GET 404 http://103.86.45.70/ant1a/inc/vendors/font-awesome/css/font-awesome.min.css
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/css/bootstrap.min.css
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/css/addons/datatables.min.css
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/css/mdb.min.css
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/css/style.css
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/css/basic.css
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/js/jquery-3.4.1.min.js
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/js/popper.min.js
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/js/bootstrap.min.js
REQUEST
RESPONSE
GET 404 http://103.86.45.70/ant1a/inc/vendors/font-awesome/css/font-awesome.min.css
REQUEST
RESPONSE
GET 206 http://103.86.45.70/ant1a/inc/mdb/css/bootstrap.min.css
REQUEST
RESPONSE
GET 206 http://103.86.45.70/ant1a/inc/mdb/css/mdb.min.css
REQUEST
RESPONSE
GET 304 http://103.86.45.70/ant1a/inc/mdb/css/addons/datatables.min.css
REQUEST
RESPONSE
GET 304 http://103.86.45.70/ant1a/inc/mdb/css/style.css
REQUEST
RESPONSE
GET 206 http://103.86.45.70/ant1a/inc/css/basic.css
REQUEST
RESPONSE
GET 206 http://103.86.45.70/ant1a/inc/mdb/js/jquery-3.4.1.min.js
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/js/popper.min.js
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/js/bootstrap.min.js
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/js/mdb.min.js
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/font/roboto/Roboto-Thin.eot?
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/font/roboto/Roboto-Light.eot?
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/font/roboto/Roboto-Regular.eot?
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/font/roboto/Roboto-Bold.eot?
REQUEST
RESPONSE
GET 200 http://103.86.45.70/ant1a/inc/mdb/font/roboto/Roboto-Medium.eot?
REQUEST
RESPONSE
GET 200 http://103.86.45.70/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

Command Params Type
solid #78909c!important;background-color:transparent!important;color:#78909c!important}.btn-outline-blue-grey.active,.btn-outline-blue-grey:active,.btn-outline-blue-grey:active:focus,.btn-outline-blue-grey:focus,.btn-outline-blue-grey:hover{border-color:#78909c!important;background-color:transparent!important;color:#78909c!important}.btn-outline-blue-grey:not([disabled]):not(.disabled).active,.btn-outline-blue-grey:not([disabled]):not(.disabled):active,.show>.btn-outline-blue-grey.dropdown-toggle{background-color:transparent!important;border-color:#78909c!important}.btn-dark{background-color:#212121!important;color:#fff}.btn-dark:hover{background-color:#2e2e2e;color:#fff}.btn-dark.active,.btn-dark:active,.btn-dark:focus{background-color:#000}.btn-dark.dropdown-toggle{background-color:#212121!important}.btn-dark.dropdown-toggle:focus,.btn-dark.dropdown-toggle:hover{background-color:#2e2e2e!important}.btn-dark:not([disabled]):not(.disabled).active,.btn-dark:not([disabled]):not(.disabled):active,.show>.btn-dark.dropdown-toggle{background-color:#000!important}.dark-ic{color:#212121!important}.dark-ic:focus,.dark-ic:hover{color:#212121}table.table a.btn.btn-dark{color:#fff}.btn-outline-dark{border:2px solid #212121!important;background-color:transparent!important;color:#212121!important}.btn-outline-dark.active,.btn-outline-dark:active,.btn-outline-dark:active:focus,.btn-outline-dark:focus,.btn-outline-dark:hover{border-color:#212121!im server

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49176 -> 142.251.130.10:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 142.251.130.10:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49183 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49177 -> 142.251.130.10:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49185 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49188 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49195 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49196 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49197 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49179 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49184 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49182 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49187 -> 142.250.199.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49186
142.250.199.67:443
None None None
TLSv1
192.168.56.101:49178
142.251.130.10:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 5f:ac:74:e6:97:66:cd:d0:f1:ea:0d:01:37:89:65:2e:98:22:84:6c
TLSv1
192.168.56.101:49183
142.250.199.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com a3:09:cb:6c:64:76:4b:58:32:d1:21:3e:f4:65:1f:de:58:22:8f:d6
TLSv1
192.168.56.101:49177
142.251.130.10:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 5f:ac:74:e6:97:66:cd:d0:f1:ea:0d:01:37:89:65:2e:98:22:84:6c
TLSv1
192.168.56.101:49180
142.250.199.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com a3:09:cb:6c:64:76:4b:58:32:d1:21:3e:f4:65:1f:de:58:22:8f:d6
TLSv1
192.168.56.101:49181
142.250.199.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com a3:09:cb:6c:64:76:4b:58:32:d1:21:3e:f4:65:1f:de:58:22:8f:d6
TLSv1
192.168.56.101:49185
142.250.199.67:443
None None None
TLSv1
192.168.56.101:49188
142.250.199.67:443
None None None
TLSv1
192.168.56.101:49176
142.251.130.10:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 5f:ac:74:e6:97:66:cd:d0:f1:ea:0d:01:37:89:65:2e:98:22:84:6c
TLSv1
192.168.56.101:49179
142.250.199.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com a3:09:cb:6c:64:76:4b:58:32:d1:21:3e:f4:65:1f:de:58:22:8f:d6
TLSv1
192.168.56.101:49184
142.250.199.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com a3:09:cb:6c:64:76:4b:58:32:d1:21:3e:f4:65:1f:de:58:22:8f:d6
TLSv1
192.168.56.101:49182
142.250.199.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com a3:09:cb:6c:64:76:4b:58:32:d1:21:3e:f4:65:1f:de:58:22:8f:d6
TLSv1
192.168.56.101:49187
142.250.199.67:443
None None None

Snort Alerts

No Snort Alerts