NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
104.20.4.235	Active	Moloch
163.172.154.142	Active	Moloch
164.124.101.2	Active	Moloch
51.15.193.130	Active	Moloch

Name	Response	Post-Analysis Lookup
xmr-eu1.nanopool.org	A 51.15.58.224 A 141.94.23.83 A 146.59.154.106 A 212.47.253.124 A 51.15.193.130 A 163.172.154.142 A 54.37.232.103 A 54.37.137.114 A 51.15.65.182 A 162.19.224.121 A 51.89.23.91	162.19.224.121
pastebin.com	A 104.20.4.235 A 172.67.19.24 A 104.20.3.235	104.20.4.235

TCP Requests

UDP Requests

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 104.20.4.235:443	906200068	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)	undefined
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2033268	ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)	Potential Corporate Privacy Violation

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49164 104.20.4.235:443	None	None	None
TLS 1.3 192.168.56.101:49163 163.172.154.142:10343	None	None	None
TLS 1.3 192.168.56.101:49165 51.15.193.130:10343	None	None	None

Snort Alerts

No Snort Alerts