NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.67.206.206 Active Moloch
Name Response Post-Analysis Lookup
archivecloud.dev 104.21.50.142
GET 504 https://archivecloud.dev/
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 172.67.206.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 172.67.206.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49172 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
172.67.206.206:443
C=US, O=Google Trust Services, CN=WE1 CN=archivecloud.dev 7c:29:f2:4c:ae:b5:54:97:da:8f:95:91:ed:f4:5e:68:d5:46:73:63
TLSv1
192.168.56.101:49165
172.67.206.206:443
C=US, O=Google Trust Services, CN=WE1 CN=archivecloud.dev 7c:29:f2:4c:ae:b5:54:97:da:8f:95:91:ed:f4:5e:68:d5:46:73:63

Snort Alerts

No Snort Alerts