NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.41.247 Active Moloch
121.254.136.18 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
POST 100 https://nitrosoftwares.shop/gate
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49171 -> 104.21.41.247:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49171
104.21.41.247:443
C=US, O=Let's Encrypt, CN=E1 CN=nitrosoftwares.shop 55:16:8c:37:8b:81:1a:5e:02:c1:77:19:5c:d1:66:2f:51:be:a7:33

Snort Alerts

No Snort Alerts