Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| mailnepalarmymil.mods.email | 91.223.208.175 | |
| x1.i.lencr.org | 23.52.33.11 |
GET
404
https://mailnepalarmymil.mods.email/dispachofapc-46703841?yui=0
REQUEST
RESPONSE
BODY
GET /dispachofapc-46703841?yui=0 HTTP/1.1
Accept: */*
Accept-Language: ko-KR
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Host: mailnepalarmymil.mods.email
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 14 Jun 2024 23:10:50 GMT
Content-Type: text/html
Content-Length: 91220
Connection: keep-alive
GET
200
http://x1.i.lencr.org/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: x1.i.lencr.org
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/pkix-cert
Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
ETag: "64cd6654-56f"
Content-Disposition: attachment; filename="ISRG Root X1.der"
Cache-Control: max-age=73543
Expires: Sat, 15 Jun 2024 19:36:11 GMT
Date: Fri, 14 Jun 2024 23:10:28 GMT
Content-Length: 1391
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49164 -> 91.223.208.175:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49169 -> 91.223.208.175:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49164 91.223.208.175:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=*.mods.email | b8:66:ff:f2:98:5b:cd:cf:73:a4:d4:6b:9c:dd:ac:4f:a6:55:f0:cc |
|
TLSv1 192.168.56.103:49169 91.223.208.175:443 |
None | None | None |
Snort Alerts
No Snort Alerts