NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.250.207.78 Active Moloch
164.124.101.2 Active Moloch
172.217.31.1 Active Moloch
GET 303 https://drive.google.com/uc?export=download&id=1H8v0Z9q8BO4UTENkbTaiWpci8Y0jYRn3
REQUEST
RESPONSE
GET 200 https://drive.usercontent.google.com/download?id=1H8v0Z9q8BO4UTENkbTaiWpci8Y0jYRn3&export=download
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 142.250.207.78:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 172.217.31.1:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49166
142.250.207.78:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 70:cc:1a:8a:58:6c:1f:6d:43:ae:66:75:89:f7:99:7b:bc:7a:74:2d
TLSv1
192.168.56.101:49167
172.217.31.1:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.usercontent.google.com 62:04:fb:04:16:85:ca:ab:d2:ed:67:da:e5:1d:b5:20:b3:d1:b1:7b

Snort Alerts

No Snort Alerts