NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.60.158 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
i8.ae 104.21.60.158
GET 410 https://i8.ae/lphsk
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 104.21.60.158:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49162
104.21.60.158:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=i8.ae 0e:64:13:ca:0a:5f:1a:9f:71:08:3b:e1:eb:fd:8c:c0:b9:ab:a0:5e

Snort Alerts

No Snort Alerts