NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.45.138 Active Moloch
104.21.84.67 Active Moloch
164.124.101.2 Active Moloch
182.162.106.144 Active Moloch
23.94.239.93 Active Moloch
GET 200 https://paste.ee/d/o8Evr
REQUEST
RESPONSE
GET 200 http://23.94.239.93/2355/microsoftprofile.vbs
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 104.21.84.67:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.103:49165 -> 104.21.84.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49169 -> 104.21.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49163 -> 23.94.239.93:80 2027260 ET INFO Dotted Quad Host VBS Request Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49165
104.21.84.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=paste.ee 75:09:97:90:38:ad:dd:cc:0d:1b:d8:8b:02:ab:5d:a9:3b:7a:1f:1d
TLSv1
192.168.56.103:49169
104.21.45.138:443
C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br ba:3d:80:0e:0b:d5:5b:6d:07:c3:31:35:4a:c7:85:77:5c:87:ba:ea

Snort Alerts

No Snort Alerts