NetWork | ZeroBOX

Network Analysis

IP Address Status Action
103.186.117.184 Active Moloch
104.21.81.200 Active Moloch
164.124.101.2 Active Moloch
GET 0 https://groundbreakingsstyle.com/wp-content/nanofolder/img-files/CUITe.Silver?query=param
REQUEST
RESPONSE
GET 0 https://groundbreakingsstyle.com/wp-content/nanofolder/img-files/c64b4d29-0152-4fe3-b127-2a109241a951.Silver?query=param
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 103.186.117.184:1199 -> 192.168.56.101:49169 2400016 ET DROP Spamhaus DROP Listed Traffic Inbound group 17 Misc Attack
TCP 192.168.56.101:49163 -> 104.21.81.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 103.186.117.184:1199 2032776 ET MALWARE Remcos 3.x Unencrypted Checkin Malware Command and Control Activity Detected
TCP 103.186.117.184:1199 -> 192.168.56.101:49168 2032777 ET MALWARE Remcos 3.x Unencrypted Server Response Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49163
104.21.81.200:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=groundbreakingsstyle.com 83:98:63:39:74:f3:ee:3d:ee:53:66:ec:1f:75:c0:b3:2b:40:14:43

Snort Alerts

No Snort Alerts