Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| codeonicinc.com | 104.26.8.6 |
POST
200
https://codeonicinc.com/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Host: codeonicinc.com
User-Agent: NSIS_InetLoad (Mozilla)
Accept: */*
Content-Length: 70
Content-Type: application/x-www-form-urlencoded
HTTP/1.1 200 OK
Date: Tue, 02 Jul 2024 06:51:52 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TY7DimtmE%2Bx5p9vSjs7kO6KSIb96VjP1veIcoAdOzc9lqj0bRZvDDPna8TnzsM5DDBfP6h9NNIp08NZcCx%2BmWPTTVK8BjdW%2BUKyjDfJ4VIrknTQ1CAoU%2FEYemuwKzDohUA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 89ccb5b4bbff29e6-FUK
POST
200
https://codeonicinc.com/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Host: codeonicinc.com
User-Agent: NSIS_InetLoad (Mozilla)
Accept: */*
Content-Length: 70
Content-Type: application/x-www-form-urlencoded
HTTP/1.1 200 OK
Date: Tue, 02 Jul 2024 06:51:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sf797z8FgKwG6%2FNlUOpMi%2FsjzAXJJogUXQT%2F36enImyDkZGm4CaE655S1ut%2FjmlUCgxH9eEH%2BKnTdcP9NqQM62BaPjCciTHZN0W5OgKbRW3oG%2BN6bGzQruQXSPFtOeylVA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 89ccb5b7bc597220-FUK
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49167 -> 172.67.69.54:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49164 -> 172.67.69.54:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.2 192.168.56.102:49167 172.67.69.54:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=codeonicinc.com | 86:da:8b:36:46:21:b9:cf:2c:38:f1:8a:de:64:e9:75:47:0f:ee:47 |
|
TLS 1.2 192.168.56.102:49164 172.67.69.54:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=codeonicinc.com | 86:da:8b:36:46:21:b9:cf:2c:38:f1:8a:de:64:e9:75:47:0f:ee:47 |
Snort Alerts
No Snort Alerts