NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.17.25.14 Active Moloch
117.18.232.200 Active Moloch
13.225.131.87 Active Moloch
164.124.101.2 Active Moloch
182.162.106.33 Active Moloch
23.67.53.17 Active Moloch
54.230.176.21 Active Moloch
GET 200 https://qrco.de/bfAK2I?onO=XTpHzVDAeO?WTh=1XXH9na1GN
REQUEST
RESPONSE
GET 200 https://qrco.de/css/build/smartphone-preview.min.css
REQUEST
RESPONSE
GET 200 https://qrcg-registry.qr-code-generator.com/qrapp-legacy-webcomponents/qrcg.min.js
REQUEST
RESPONSE
GET 200 https://qrco.de/favicon.ico
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 13.225.131.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2039504 ET INFO QR Code Generator Domain in DNS Lookup (qrco .de) Misc activity
TCP 192.168.56.101:49164 -> 13.225.131.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 54.230.176.21:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 54.230.176.21:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 104.17.25.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49177 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49178 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49168 -> 104.17.25.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 13.225.131.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 13.225.131.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49165
13.225.131.87:443
C=US, O=Amazon, CN=Amazon RSA 2048 M03 CN=qrco.de 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69
TLSv1
192.168.56.101:49164
13.225.131.87:443
C=US, O=Amazon, CN=Amazon RSA 2048 M03 CN=qrco.de 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69
TLSv1
192.168.56.101:49169
54.230.176.21:443
C=US, O=Amazon, CN=Amazon RSA 2048 M02 CN=qrcg-registry.qr-code-generator.com 90:91:de:6a:37:40:5c:6b:82:d9:26:4f:7f:f4:db:c1:e5:15:83:a9
TLSv1
192.168.56.101:49167
104.17.25.14:443
C=US, O=Let's Encrypt, CN=R3 CN=cdnjs.cloudflare.com d2:ad:d7:fd:89:73:53:92:b8:97:c0:9e:64:3b:b4:1f:a2:d7:ac:9b
TLSv1
192.168.56.101:49170
54.230.176.21:443
C=US, O=Amazon, CN=Amazon RSA 2048 M02 CN=qrcg-registry.qr-code-generator.com 90:91:de:6a:37:40:5c:6b:82:d9:26:4f:7f:f4:db:c1:e5:15:83:a9
TLSv1
192.168.56.101:49168
104.17.25.14:443
C=US, O=Let's Encrypt, CN=R3 CN=cdnjs.cloudflare.com d2:ad:d7:fd:89:73:53:92:b8:97:c0:9e:64:3b:b4:1f:a2:d7:ac:9b
TLSv1
192.168.56.101:49174
13.225.131.87:443
C=US, O=Amazon, CN=Amazon RSA 2048 M03 CN=qrco.de 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69
TLSv1
192.168.56.101:49173
13.225.131.87:443
C=US, O=Amazon, CN=Amazon RSA 2048 M03 CN=qrco.de 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69

Snort Alerts

No Snort Alerts