NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
142.250.66.99 Active Moloch
142.251.220.100 Active Moloch
142.251.8.84 Active Moloch
164.124.101.2 Active Moloch
GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 302 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AdF4I76Y3NkKUEH3PqSbeNYT6o-AmZa8Isqhy7dbwEu3iufOXcI9DiOb9Rvo_KyAQWxTR7znvW1X-w
REQUEST
RESPONSE
GET 200 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AdF4I74pC9xrfzbndeH-N6NOflXq1MjzJIxNFee4-gZlSvToqsOXxF3zsbE0AhE66RpXdgwWsyVz&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1023031012%3A1720346845031034
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 200 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 204 https://accounts.google.com/generate_204?w4ag3w
REQUEST
RESPONSE
GET 302 https://accounts.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 https://www.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49169 -> 142.250.66.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49176 -> 142.251.220.100:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 142.251.8.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 142.251.8.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49173 -> 142.251.8.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 142.251.8.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 142.250.66.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49175 -> 142.251.220.100:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49169
142.250.66.99:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com c4:9c:27:09:1c:f7:14:c9:86:f0:b5:42:0b:8a:d2:ae:5e:ae:98:04
TLSv1
192.168.56.103:49176
142.251.220.100:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com 7d:d9:03:2a:d5:d4:39:e1:4f:69:08:1c:64:e9:f9:16:1c:b1:5b:cf
TLSv1
192.168.56.103:49166
142.251.8.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com c0:dc:0b:e4:ce:f0:67:45:f7:48:92:e3:bb:9e:40:3f:c1:59:fb:9b
TLSv1
192.168.56.103:49172
142.251.8.84:443
None None None
TLSv1
192.168.56.103:49173
142.251.8.84:443
None None None
TLSv1
192.168.56.103:49165
142.251.8.84:443
C=US, O=Google Trust Services, CN=WR2 CN=accounts.google.com c0:dc:0b:e4:ce:f0:67:45:f7:48:92:e3:bb:9e:40:3f:c1:59:fb:9b
TLSv1
192.168.56.103:49170
142.250.66.99:443
C=US, O=Google Trust Services, CN=WR2 CN=*.gstatic.com c4:9c:27:09:1c:f7:14:c9:86:f0:b5:42:0b:8a:d2:ae:5e:ae:98:04
TLSv1
192.168.56.103:49175
142.251.220.100:443
C=US, O=Google Trust Services, CN=WR2 CN=www.google.com 7d:d9:03:2a:d5:d4:39:e1:4f:69:08:1c:64:e9:f9:16:1c:b1:5b:cf

Snort Alerts

No Snort Alerts