NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.22.30.153 Active Moloch
104.22.31.153 Active Moloch
154.91.34.235 Active Moloch
164.124.101.2 Active Moloch
60.190.116.35 Active Moloch
GET 302 https://www.ipip.net/
REQUEST
RESPONSE
GET 200 https://en.ipip.net/
REQUEST
RESPONSE
GET 403 http://downapp.baidu.com/
REQUEST
RESPONSE
GET 200 http://downapp.baidu.com/appsearch/AndroidPhone/1.0.65.172/1/1012271b/20171027150542/appsearch_AndroidPhone_1-0-65-172_1012271b.apk?responseContentDisposition=attachment%3Bfilename%3D%22appsearch_AndroidPhone_v8.0.3%281.0.65.172%29_1012271b.apk%22&responseContentType=application%2Fvnd.android.package-archive&request_id=1516457256_8032127161&type=dynamic
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 104.22.30.153:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 104.22.31.153:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49164
104.22.30.153:443
C=US, O=Google Trust Services, CN=WR1 CN=www.ipip.net 5e:e0:4c:ad:06:35:8e:83:c1:b4:04:49:a7:cf:48:a8:e1:aa:f5:38
TLSv1
192.168.56.103:49165
104.22.31.153:443
C=US, O=Google Trust Services, CN=WR1 CN=en.ipip.net 40:22:3a:4f:77:4e:be:5b:e5:5a:f3:1e:14:9a:12:eb:20:ed:f3:68

Snort Alerts

No Snort Alerts