NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
36.51.224.27 Active Moloch
36.51.224.53 Active Moloch
GET 302 https://weibo.com/
REQUEST
RESPONSE
GET 200 https://passport.weibo.com/visitor/visitor?entry=miniblog&a=enter&url=https%3A%2F%2Fweibo.com%2F&domain=weibo.com&_rand=1696372813674&sudaref=
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49161 -> 36.51.224.53:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49162 -> 36.51.224.27:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49161
36.51.224.53:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=GeoTrust CN RSA CA G1 C=CN, ST=Beijing, O=Sina.com Technology(China)Co.,ltd, CN=weibo.cn 79:ba:c8:0e:94:43:4a:82:24:d9:a7:d4:07:56:67:c1:6b:ed:51:bb
TLSv1
192.168.56.103:49162
36.51.224.27:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=GeoTrust CN RSA CA G1 C=CN, ST=Beijing, O=Sina.com Technology(China)Co.,ltd, CN=sina.com d8:ca:c3:ab:c9:0b:74:8c:48:4d:64:e8:35:c3:6c:95:f2:de:cb:fa

Snort Alerts

No Snort Alerts