NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.184.241 Active Moloch
104.21.44.66 Active Moloch
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
194.58.114.223 Active Moloch
GET 200 https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=0a:00:27:00:00:00
REQUEST
RESPONSE
GET 200 http://icanhazip.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2033966 ET HUNTING Telegram API Domain in DNS Lookup Misc activity
TCP 149.154.167.220:443 -> 192.168.56.103:49180 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 104.16.184.241:80 2017398 ET POLICY IP Check Domain (icanhazip. com in HTTP Host) Attempted Information Leak
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2054169 ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49180 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.103:49180 -> 149.154.167.220:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49180 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 149.154.167.220:443 -> 192.168.56.103:49181 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49181 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.103:49181 -> 149.154.167.220:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49181 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.103:49179 -> 104.21.44.66:443 2033010 ET POLICY Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI) Potential Corporate Privacy Violation
TCP 192.168.56.103:49179 -> 104.21.44.66:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49181 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.103:49180 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49179
104.21.44.66:443
C=US, O=Google Trust Services, CN=WE1 CN=mylnikov.org 02:37:7c:02:dd:73:81:8e:66:ea:4a:15:58:23:d8:bd:6d:a6:d0:39

Snort Alerts

No Snort Alerts