NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.84.67 Active Moloch
164.124.101.2 Active Moloch
172.67.215.45 Active Moloch
51.81.235.253 Active Moloch
GET 200 https://paste.ee/d/I1BAU
REQUEST
RESPONSE
GET 404 https://uploaddeimagens.com.br/images/004/805/162/original/new_image_%281%29.jpg?1719495498
REQUEST
RESPONSE
GET 200 http://51.81.235.253/44155/amazingflowerspcitureshere.gif
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 104.21.84.67:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 104.21.84.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49165
104.21.84.67:443
C=US, O=Google Trust Services, CN=WE1 CN=paste.ee db:ac:96:3c:aa:07:4d:6f:90:48:a6:34:79:1d:71:cf:4d:ef:d9:c2
TLSv1
192.168.56.101:49167
172.67.215.45:443
C=US, O=Google Trust Services, CN=WE1 CN=uploaddeimagens.com.br 73:a9:e0:a5:b1:5f:db:89:38:94:4f:97:4d:68:78:e4:59:c5:9f:a5

Snort Alerts

No Snort Alerts