NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
142.251.222.195 Active Moloch
164.124.101.2 Active Moloch
172.217.24.228 Active Moloch
173.194.174.84 Active Moloch
GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 302 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AS5LTAStUYgHXYd6dyrzYlv0rlNXWsy8KDcmbk61i6z1oK1cpRecjGypwowFoNYDjJy4FzHyYiwZOg
REQUEST
RESPONSE
GET 200 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AS5LTATsj2mzmMe9etAFGZRbGaNTsG4tOqdZIHJNt3wqGpQ2QarlByCCBLR3Uvd1sZcv0LJcjpdIzA&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-2096241754%3A1717836011855520
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 302 https://accounts.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 204 https://accounts.google.com/generate_204?h1fWvw
REQUEST
RESPONSE
GET 200 https://www.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 142.251.222.195:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 172.217.24.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 173.194.174.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 173.194.174.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 173.194.174.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 172.217.24.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 142.251.222.195:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 173.194.174.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49174
172.217.24.228:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com 49:0b:95:b4:5b:b7:c3:9d:db:5e:94:8d:27:0f:94:46:a6:ba:fe:70
TLSv1
192.168.56.101:49168
142.251.222.195:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com 77:11:18:41:85:fb:07:fc:f9:f2:09:81:a6:67:e9:39:3b:b8:e2:76
TLSv1
192.168.56.101:49167
173.194.174.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com 2a:31:eb:08:13:bb:e3:fc:68:36:a9:36:c3:61:30:16:e1:d5:b8:aa
TLSv1
192.168.56.101:49166
173.194.174.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com 2a:31:eb:08:13:bb:e3:fc:68:36:a9:36:c3:61:30:16:e1:d5:b8:aa
TLSv1
192.168.56.101:49170
173.194.174.84:443
None None None
TLSv1
192.168.56.101:49173
172.217.24.228:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com 49:0b:95:b4:5b:b7:c3:9d:db:5e:94:8d:27:0f:94:46:a6:ba:fe:70
TLSv1
192.168.56.101:49169
142.251.222.195:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com 77:11:18:41:85:fb:07:fc:f9:f2:09:81:a6:67:e9:39:3b:b8:e2:76
TLSv1
192.168.56.101:49171
173.194.174.84:443
None None None

Snort Alerts

No Snort Alerts