NetWork | ZeroBOX

Network Analysis

IP Address Status Action
103.129.252.45 Active Moloch
142.250.196.238 Active Moloch
142.250.71.129 Active Moloch
162.125.80.18 Active Moloch
164.124.101.2 Active Moloch
38.147.172.248 Active Moloch
69.42.215.252 Active Moloch
45.33.6.223 Active Moloch
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
REQUEST
RESPONSE
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 303 https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 404 https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
REQUEST
RESPONSE
GET 200 http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 103.129.252.45:25 -> 192.168.56.101:49168 2260002 SURICATA Applayer Detect protocol only one direction Generic Protocol Command Decode
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2015633 ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com Misc activity
TCP 192.168.56.101:49188 -> 162.125.80.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49187 -> 162.125.80.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49185 -> 142.250.196.238:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 142.250.71.129:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49185
142.250.196.238:443
C=US, O=Google Trust Services, CN=WR2 CN=*.google.com 0e:b6:5c:7b:0b:ac:b5:af:1f:df:47:14:61:b7:0d:4c:41:6f:47:53
TLSv1
192.168.56.101:49186
142.250.71.129:443
C=US, O=Google Trust Services, CN=WR2 CN=*.usercontent.google.com 02:88:52:bb:1a:d8:e4:3d:9f:a8:8f:00:8d:5c:55:f5:c4:ba:59:0d

Snort Alerts

No Snort Alerts