NetWork | ZeroBOX

Network Analysis

IP Address Status Action
108.177.125.84 Active Moloch
117.18.232.200 Active Moloch
142.250.204.99 Active Moloch
164.124.101.2 Active Moloch
216.58.200.228 Active Moloch
GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 302 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AaSxoQyfq-7cY1XYRwY0ShX6ZV4VcZueKcLnzJPsI6p6tZOYS9WyJYiRxxUn4zwmOnW_RmvTApfUTA
REQUEST
RESPONSE
GET 200 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AaSxoQxJSQfRgSvbcN4CCAR5Cv1vi0mtSDJubDwaCZfi3oDyh2K0IRbr6QdURxYZZ9aKOSzITZzYCw&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1526235381%3A1716860687656877
REQUEST
RESPONSE
GET 200 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 302 https://accounts.google.com/favicon.ico
REQUEST
RESPONSE
GET 0 https://accounts.google.com/generate_204?Bd_bhQ
REQUEST
RESPONSE
GET 200 https://www.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49168 -> 142.250.204.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 108.177.125.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 216.58.200.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49167 -> 142.250.204.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49171 -> 216.58.200.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 108.177.125.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
142.250.204.99:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com 7d:72:f0:f7:c4:74:72:f9:fe:32:36:d5:de:7f:6f:9f:71:24:9d:86
TLSv1
192.168.56.103:49166
108.177.125.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com ae:dc:b1:05:0d:f9:b8:76:4b:01:23:cc:23:87:c4:9e:52:ba:56:94
TLSv1
192.168.56.103:49170
216.58.200.228:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com c4:8a:ee:0d:ac:8d:be:2a:36:c4:8b:e8:f0:93:22:29:1e:42:9d:a9
TLSv1
192.168.56.103:49167
142.250.204.99:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com 7d:72:f0:f7:c4:74:72:f9:fe:32:36:d5:de:7f:6f:9f:71:24:9d:86
TLSv1
192.168.56.103:49171
216.58.200.228:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com c4:8a:ee:0d:ac:8d:be:2a:36:c4:8b:e8:f0:93:22:29:1e:42:9d:a9
TLSv1
192.168.56.103:49165
108.177.125.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com ae:dc:b1:05:0d:f9:b8:76:4b:01:23:cc:23:87:c4:9e:52:ba:56:94

Snort Alerts

No Snort Alerts