NetWork | ZeroBOX

Network Analysis

IP Address Status Action
121.254.136.27 Active Moloch
142.250.204.110 Active Moloch
142.250.204.129 Active Moloch
142.250.204.35 Active Moloch
142.250.204.46 Active Moloch
142.250.204.74 Active Moloch
142.250.207.99 Active Moloch
142.250.66.132 Active Moloch
142.250.66.77 Active Moloch
146.75.50.191 Active Moloch
164.124.101.2 Active Moloch
172.217.24.99 Active Moloch
216.58.200.227 Active Moloch
34.104.35.123 Active Moloch
45.83.122.52 Active Moloch
52.6.155.20 Active Moloch
66.220.9.58 Active Moloch
67.199.248.10 Active Moloch

GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
GET 204 http://www.gstatic.com/generate_204
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
HEAD 200 http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/n3xmszuzmcp4pxq3qhmant63nm_9.45.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.45.0_all_ecp3yewcq3fuvht5wyi7t7s37y.crx3
REQUEST
RESPONSE
GET 206 http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/n3xmszuzmcp4pxq3qhmant63nm_9.45.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.45.0_all_ecp3yewcq3fuvht5wyi7t7s37y.crx3
REQUEST
RESPONSE
GET 301 http://bit.ly/2TwPVOe
REQUEST
RESPONSE
GET 206 http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/n3xmszuzmcp4pxq3qhmant63nm_9.45.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.45.0_all_ecp3yewcq3fuvht5wyi7t7s37y.crx3
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 146.75.50.191:443 -> 192.168.56.102:49241 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49243 -> 146.75.50.191:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49237 -> 146.75.50.191:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49238 -> 146.75.50.191:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49240 -> 146.75.50.191:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49239 -> 146.75.50.191:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.102:49173
142.250.66.132:443
None None None
TLS 1.3
192.168.56.102:49174
142.250.66.132:443
None None None
TLS 1.3
192.168.56.102:49175
142.250.66.132:443
None None None
TLS 1.3
192.168.56.102:49178
142.250.204.35:443
None None None
TLS 1.3
192.168.56.102:49179
142.250.204.35:443
None None None
TLS 1.3
192.168.56.102:49177
216.58.200.227:443
None None None
TLS 1.3
192.168.56.102:49181
142.250.204.74:443
None None None
TLS 1.3
192.168.56.102:49180
142.250.204.35:443
None None None
TLS 1.3
192.168.56.102:49182
172.217.24.99:443
None None None
TLS 1.3
192.168.56.102:49183
142.250.204.46:443
None None None
TLS 1.3
192.168.56.102:49176
142.250.66.77:443
None None None
TLS 1.3
192.168.56.102:49195
142.250.204.129:443
None None None
TLS 1.2
192.168.56.102:49187
45.83.122.52:443
C=US, O=Let's Encrypt, CN=R3 CN=pdf-readonline.website 19:86:91:ef:29:9d:9a:a1:83:ca:a4:b0:32:65:04:3d:46:87:28:1d
TLS 1.2
192.168.56.102:49186
45.83.122.52:443
C=US, O=Let's Encrypt, CN=R3 CN=pdf-readonline.website 19:86:91:ef:29:9d:9a:a1:83:ca:a4:b0:32:65:04:3d:46:87:28:1d
TLS 1.2
192.168.56.102:49198
45.83.122.52:443
C=US, O=Let's Encrypt, CN=R3 CN=pdf-readonline.website 19:86:91:ef:29:9d:9a:a1:83:ca:a4:b0:32:65:04:3d:46:87:28:1d
TLS 1.2
192.168.56.102:49194
45.83.122.52:443
C=US, O=Let's Encrypt, CN=R3 CN=pdf-readonline.website 19:86:91:ef:29:9d:9a:a1:83:ca:a4:b0:32:65:04:3d:46:87:28:1d
TLS 1.2
192.168.56.102:49196
45.83.122.52:443
C=US, O=Let's Encrypt, CN=R3 CN=pdf-readonline.website 19:86:91:ef:29:9d:9a:a1:83:ca:a4:b0:32:65:04:3d:46:87:28:1d
TLSv1
192.168.56.102:49207
66.220.9.58:443
C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 CN=*.webdav.drivehq.com a6:bb:84:e8:8d:62:93:e2:b5:60:36:d3:c4:9b:9e:6b:00:7a:a5:82
TLSv1
192.168.56.102:49208
66.220.9.58:443
C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 CN=*.webdav.drivehq.com a6:bb:84:e8:8d:62:93:e2:b5:60:36:d3:c4:9b:9e:6b:00:7a:a5:82
TLS 1.2
192.168.56.102:49199
45.83.122.52:443
C=US, O=Let's Encrypt, CN=R3 CN=pdf-readonline.website 19:86:91:ef:29:9d:9a:a1:83:ca:a4:b0:32:65:04:3d:46:87:28:1d
TLS 1.3
192.168.56.102:49200
142.250.204.110:443
None None None
TLSv1
192.168.56.102:49203
66.220.9.58:443
C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 CN=*.webdav.drivehq.com a6:bb:84:e8:8d:62:93:e2:b5:60:36:d3:c4:9b:9e:6b:00:7a:a5:82
TLSv1
192.168.56.102:49205
66.220.9.58:443
C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 CN=*.webdav.drivehq.com a6:bb:84:e8:8d:62:93:e2:b5:60:36:d3:c4:9b:9e:6b:00:7a:a5:82
TLSv1
192.168.56.102:49216
66.220.9.58:443
C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 CN=*.webdav.drivehq.com a6:bb:84:e8:8d:62:93:e2:b5:60:36:d3:c4:9b:9e:6b:00:7a:a5:82
TLSv1
192.168.56.102:49212
66.220.9.58:443
C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 CN=*.webdav.drivehq.com a6:bb:84:e8:8d:62:93:e2:b5:60:36:d3:c4:9b:9e:6b:00:7a:a5:82
TLS 1.3
192.168.56.102:49221
142.250.207.99:443
None None None
TLS 1.3
192.168.56.102:49222
142.250.204.35:443
None None None
TLS 1.3
192.168.56.102:49225
52.6.155.20:443
None None None
TLS 1.3
192.168.56.102:49226
52.6.155.20:443
None None None
TLS 1.2
192.168.56.102:49229
23.45.56.171:443
C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1 C=US, ST=California, L=San Jose, O=Adobe Inc, CN=*.adobe.com b5:2f:f2:ba:e6:6a:d7:82:1c:df:03:c5:51:6c:84:5f:9e:70:0d:71
TLS 1.3
192.168.56.102:49192
142.250.207.99:443
None None None
TLS 1.2
192.168.56.102:49230
23.45.56.171:443
C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1 C=US, ST=California, L=San Jose, O=Adobe Inc, CN=*.adobe.com b5:2f:f2:ba:e6:6a:d7:82:1c:df:03:c5:51:6c:84:5f:9e:70:0d:71

Snort Alerts

No Snort Alerts