NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
172.67.183.88 Active Moloch
GET 0 https://kyliansuperm92139124.shop/customer/1236
REQUEST
RESPONSE
GET 0 https://kyliansuperm92139124.shop/customer/1236
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49163 -> 172.67.183.88:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 172.67.183.88:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49163
172.67.183.88:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=kyliansuperm92139124.shop 5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35
TLSv1
192.168.56.101:49171
172.67.183.88:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=kyliansuperm92139124.shop 5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35

Snort Alerts

No Snort Alerts