NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.67.149.231 Active Moloch
Name Response Post-Analysis Lookup
www.luxuryshield.org 172.67.149.231
GET 403 https://www.luxuryshield.org/?__cf_chl_tk=MzoipA0JWISUjOClHcsQwKUHXueBNC8cKT_tsGH.M2s-1702993100-0-gaNycGzNDaU
REQUEST
RESPONSE
GET 200 https://www.luxuryshield.org/cdn-cgi/styles/challenges.css
REQUEST
RESPONSE
GET 200 https://www.luxuryshield.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=83888fe87ed83149
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49172 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49164 -> 172.67.149.231:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 172.67.149.231:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49174 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
172.67.149.231:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 93:10:40:92:b3:4e:ba:6b:a7:c9:4e:0b:f6:ac:d5:4c:58:d4:9e:de
TLSv1
192.168.56.101:49165
172.67.149.231:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 93:10:40:92:b3:4e:ba:6b:a7:c9:4e:0b:f6:ac:d5:4c:58:d4:9e:de

Snort Alerts

No Snort Alerts