NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.76.57 Active Moloch
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
92.222.212.74 Active Moloch
212.224.86.223 Active Moloch
Name Response Post-Analysis Lookup
iplogger.com 104.21.76.57
GET 403 https://iplogger.com/19eWD4
REQUEST
RESPONSE
GET 200 https://iplogger.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=85016c18ce5d7ed1
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 92.222.212.74:1450 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 92.222.212.74:1450 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.101:49162 -> 92.222.212.74:1450 2046045 ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 92.222.212.74:1450 -> 192.168.56.101:49162 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.101:49162 -> 92.222.212.74:1450 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.101:49167 -> 104.21.76.57:443 2047718 ET INFO External IP Lookup Domain (iplogger .com in TLS SNI) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49167 -> 104.21.76.57:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2047719 ET INFO External IP Lookup Domain (iplogger .com in DNS lookup) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49168 -> 104.21.76.57:443 2047718 ET INFO External IP Lookup Domain (iplogger .com in TLS SNI) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49168 -> 104.21.76.57:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49162 -> 92.222.212.74:1450 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.101:49162 -> 92.222.212.74:1450 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 92.222.212.74:1450 -> 192.168.56.101:49162 2046056 ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49167
104.21.76.57:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=iplogger.com 58:f1:b8:44:37:6f:27:f8:01:6a:79:0e:7e:47:5b:b5:88:ec:1d:cc
TLSv1
192.168.56.101:49168
104.21.76.57:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=iplogger.com 58:f1:b8:44:37:6f:27:f8:01:6a:79:0e:7e:47:5b:b5:88:ec:1d:cc

Snort Alerts

No Snort Alerts