NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
172.67.200.114 Active Moloch
54.38.139.98 Active Moloch
Name Response Post-Analysis Lookup
jx.ax 172.67.200.114
GET 302 https://jx.ax/Ld3
REQUEST
RESPONSE
GET 301 http://jx.ax/Ld3
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 172.67.200.114:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
172.67.200.114:443
C=US, O=Google Trust Services, CN=WE1 CN=jx.ax 08:61:59:dc:8c:fb:65:d8:fe:2b:db:4d:43:d4:85:c5:67:18:41:c1

Snort Alerts

No Snort Alerts