NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
172.67.187.200 Active Moloch
Name Response Post-Analysis Lookup
paste.ee 104.21.84.67
GET 200 https://paste.ee/d/V3Lmu/0
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2054041 ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) Misc activity
TCP 192.168.56.102:49164 -> 172.67.187.200:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.102:49164 -> 172.67.187.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49164
172.67.187.200:443
C=US, O=Google Trust Services, CN=WE1 CN=paste.ee db:ac:96:3c:aa:07:4d:6f:90:48:a6:34:79:1d:71:cf:4d:ef:d9:c2

Snort Alerts

No Snort Alerts