NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.251.220.78 Active Moloch
142.251.220.97 Active Moloch
164.124.101.2 Active Moloch
GET 0 https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1BnLwNXIOB1ed0vfig76FOiB5_vSYfxO8
REQUEST
RESPONSE
GET 200 https://doc-0c-bs-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/gsj07kmmd732u9jfj0sd2ubl6lqnbh2o/1702290825000/03617822427045637603/*/1BnLwNXIOB1ed0vfig76FOiB5_vSYfxO8?e=download&uuid=cd74acaf-b34e-46e0-a195-a721074feb84
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49168 -> 142.251.220.97:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 142.251.220.78:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
142.251.220.97:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.googleusercontent.com 17:e3:6e:db:3c:c4:0e:b4:6d:d3:55:1a:70:f8:0b:23:86:54:69:d8
TLSv1
192.168.56.103:49165
142.251.220.78:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 5d:3a:d9:47:14:b0:78:30:a1:bf:b4:45:f6:f5:81:ad:0a:c7:76:89

Snort Alerts

No Snort Alerts