NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.18.145.235 Active Moloch
104.26.4.15 Active Moloch
164.124.101.2 Active Moloch
193.233.132.62 Active Moloch
34.117.186.192 Active Moloch
193.233.132.56 Active Moloch
GET 200 https://db-ip.com/demo/home.php?s=175.208.134.152
REQUEST
RESPONSE
GET 403 http://www.maxmind.com/geoip/v2.1/city/me
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 104.26.4.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 193.233.132.62:58709 2049060 ET MALWARE RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 193.233.132.62:58709 -> 192.168.56.101:49165 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) A Network Trojan was detected
TCP 192.168.56.101:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49166 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49168
104.26.4.15:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=db-ip.com 65:b1:27:2e:35:d2:f7:1f:20:04:c5:ca:ea:4e:7a:b4:69:6a:83:00

Snort Alerts

No Snort Alerts