NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
91.235.128.141 Active Moloch
Name Response Post-Analysis Lookup
cp5ua.hyperhost.ua 91.235.128.141

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 91.235.128.141:587 -> 192.168.56.103:49165 2260002 SURICATA Applayer Detect protocol only one direction Generic Protocol Command Decode
TCP 192.168.56.103:49165 -> 91.235.128.141:587 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49165
91.235.128.141:587
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.hyperhost.ua 31:5a:b5:30:54:87:eb:3f:d4:42:69:f9:97:6e:d8:03:c6:5d:32:c0

Snort Alerts

No Snort Alerts