NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.20.68.143 Active Moloch
104.21.6.247 Active Moloch
121.254.136.27 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://pastebin.com/raw/NVAgzFRR
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49161 -> 104.20.68.143:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2034938 ET POLICY Observed DNS Query to Pastebin-style Service (wtools .io) Potential Corporate Privacy Violation
TCP 192.168.56.101:49163 -> 104.21.6.247:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49161
104.20.68.143:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com c7:af:cc:81:4d:27:d1:4c:7c:f4:bf:5d:55:9d:80:50:3b:6f:6c:cd
TLSv1
192.168.56.101:49163
104.21.6.247:443
C=US, O=Let's Encrypt, CN=E1 CN=wtools.io 9c:25:6b:44:0d:fa:8c:18:14:80:59:26:63:42:4c:cd:97:e8:59:2b

Snort Alerts

No Snort Alerts