NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.184.241 Active Moloch
104.21.44.66 Active Moloch
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
GET 404 https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=0a:00:27:00:00:00
REQUEST
RESPONSE
GET 200 http://icanhazip.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 149.154.167.220:443 -> 192.168.56.101:49178 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.101:49178 -> 149.154.167.220:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
UDP 192.168.56.101:53004 -> 164.124.101.2:53 2033966 ET HUNTING Telegram API Domain in DNS Lookup Misc activity
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2054169 ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49176 -> 104.16.184.241:80 2017398 ET POLICY IP Check Domain (icanhazip. com in HTTP Host) Attempted Information Leak
TCP 149.154.167.220:443 -> 192.168.56.101:49179 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49177 -> 104.21.44.66:443 2033010 ET POLICY Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI) Potential Corporate Privacy Violation
TCP 192.168.56.101:49177 -> 104.21.44.66:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.101:49179 -> 149.154.167.220:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.101:49178 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.101:49179 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49177
104.21.44.66:443
C=US, O=Google Trust Services, CN=WE1 CN=mylnikov.org 02:37:7c:02:dd:73:81:8e:66:ea:4a:15:58:23:d8:bd:6d:a6:d0:39

Snort Alerts

No Snort Alerts