NetWork | ZeroBOX

IP Address	Status	Action
104.26.5.15	Active	Moloch
164.124.101.2	Active	Moloch
23.41.113.9	Active	Moloch
39.109.117.123	Active	Moloch

Name	Response	Post-Analysis Lookup
i.alie3ksgaa.com	A 39.109.117.123	39.109.117.123
x1.i.lencr.org	CNAME crl.root-x1.letsencrypt.org.edgekey.net CNAME e8652.dscx.akamaiedge.net A 23.41.113.9	23.52.33.11

TCP Requests

UDP Requests

GET 200 http://x1.i.lencr.org/

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49166 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49165 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49168 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49170 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49175 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49177 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49180 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49182 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49186 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49174 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49184 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49161 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49167 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49172 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49179 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49176 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49185 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49178 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49181 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49193 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49183 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49187 -> 39.109.117.123:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49166 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49165 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49168 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49170 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49175 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49177 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49180 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49182 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49186 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49174 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49184 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49161 39.109.117.123:443	C=US, O=Let's Encrypt, CN=R3	CN=i.alie3ksgaa.com	ca:3f:77:18:57:ea:1e:58:26:f4:e0:05:79:5c:16:05:aa:53:de:47
TLSv1 192.168.56.101:49167 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49173 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49164 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49172 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49171 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49179 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49176 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49185 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49178 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49181 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49193 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49183 39.109.117.123:443	None	None	None
TLSv1 192.168.56.101:49187 39.109.117.123:443	None	None	None

Snort Alerts

No Snort Alerts