NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.84.67 Active Moloch
104.22.53.71 Active Moloch
107.175.113.207 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://paste.ee/d/s5jMq
REQUEST
RESPONSE
GET 200 http://107.175.113.207/3555/BrowserUpdate.vbs
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 104.21.84.67:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 104.21.84.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 104.22.53.71:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49162 -> 107.175.113.207:80 2027260 ET INFO Dotted Quad Host VBS Request Potentially Bad Traffic
TCP 192.168.56.101:49167 -> 104.22.53.71:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
104.21.84.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=paste.ee c2:b4:ac:5e:d6:d0:79:48:bd:61:49:ff:7a:f4:5f:ee:d4:45:1b:74

Snort Alerts

No Snort Alerts