NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.251.222.193 Active Moloch
162.125.80.18 Active Moloch
164.124.101.2 Active Moloch
172.217.31.14 Active Moloch
69.42.215.252 Active Moloch
38.147.172.248 Active Moloch
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
REQUEST
RESPONSE
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 200 http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2015633 ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com Misc activity
TCP 192.168.56.101:49171 -> 142.251.222.193:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49172 -> 162.125.80.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 162.125.80.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 172.217.31.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49171
142.251.222.193:443
C=US, O=Google Trust Services, CN=WR2 CN=*.usercontent.google.com 02:88:52:bb:1a:d8:e4:3d:9f:a8:8f:00:8d:5c:55:f5:c4:ba:59:0d
TLSv1
192.168.56.101:49170
172.217.31.14:443
C=US, O=Google Trust Services, CN=WR2 CN=*.google.com 0e:b6:5c:7b:0b:ac:b5:af:1f:df:47:14:61:b7:0d:4c:41:6f:47:53

Snort Alerts

No Snort Alerts