NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
213.183.55.52 Active Moloch
23.41.113.9 Active Moloch
GET 200 http://x1.i.lencr.org/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49170 -> 213.183.55.52:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 213.183.55.52:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 213.183.55.52:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49172 -> 213.183.55.52:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 213.183.55.52:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 213.183.55.52:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49174
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49168
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49163
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49167
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49170
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49175
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49169
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49165
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49171
213.183.55.52:443
None None None
TLSv1
192.168.56.101:49178
213.183.55.52:443
None None None
TLSv1
192.168.56.101:49176
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49173
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49172
213.183.55.52:443
None None None
TLSv1
192.168.56.101:49179
213.183.55.52:443
None None None
TLSv1
192.168.56.101:49177
213.183.55.52:443
C=US, O=Let's Encrypt, CN=R10 CN=*.pmd-offc.info 7d:3a:19:e6:d8:31:31:bb:ee:2f:2c:12:e7:ad:f9:9a:1d:cf:06:df
TLSv1
192.168.56.101:49180
213.183.55.52:443
None None None

Snort Alerts

No Snort Alerts