NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
142.250.71.163 Active Moloch
164.124.101.2 Active Moloch
216.58.203.68 Active Moloch
74.125.203.84 Active Moloch
GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 302 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AS5LTARyH5Kd-rVBKeWnqUj906AGGHofujSb8AgwWKsTypD2yBBYr3WBtOnUhGtxSOgxIU3lQHJc9Q
REQUEST
RESPONSE
GET 200 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AS5LTARz2rTindXOxtKWlV36tkFtVGW8sAyWc6Y640azCnTxNjcf0x1986tGgMcPtexJF55x92Pocw&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1023256178%3A1719641978822264
REQUEST
RESPONSE
GET 200 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 302 https://accounts.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 https://www.google.com/favicon.ico
REQUEST
RESPONSE
GET 204 https://accounts.google.com/generate_204?e342lA
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49166 -> 74.125.203.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49169 -> 142.250.71.163:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 216.58.203.68:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49174 -> 74.125.203.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49175 -> 74.125.203.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49167 -> 74.125.203.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 142.250.71.163:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49173 -> 216.58.203.68:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49166
74.125.203.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com c0:dc:0b:e4:ce:f0:67:45:f7:48:92:e3:bb:9e:40:3f:c1:59:fb:9b
TLSv1
192.168.56.103:49169
142.250.71.163:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com c4:9c:27:09:1c:f7:14:c9:86:f0:b5:42:0b:8a:d2:ae:5e:ae:98:04
TLSv1
192.168.56.103:49172
216.58.203.68:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com 7d:d9:03:2a:d5:d4:39:e1:4f:69:08:1c:64:e9:f9:16:1c:b1:5b:cf
TLSv1
192.168.56.103:49174
74.125.203.84:443
None None None
TLSv1
192.168.56.103:49175
74.125.203.84:443
None None None
TLSv1
192.168.56.103:49167
74.125.203.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com c0:dc:0b:e4:ce:f0:67:45:f7:48:92:e3:bb:9e:40:3f:c1:59:fb:9b
TLSv1
192.168.56.103:49170
142.250.71.163:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com c4:9c:27:09:1c:f7:14:c9:86:f0:b5:42:0b:8a:d2:ae:5e:ae:98:04
TLSv1
192.168.56.103:49173
216.58.203.68:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com 7d:d9:03:2a:d5:d4:39:e1:4f:69:08:1c:64:e9:f9:16:1c:b1:5b:cf

Snort Alerts

No Snort Alerts