NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.67.152 Active Moloch
132.226.8.169 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
Connection: Keep-Alive
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61322
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c91732e1c0902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61322
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c91747ffa0902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61322
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c9175c9f40902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61322
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c9176ebc80902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61323
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c91781dbf0902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61323
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c91796f960902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61323
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c917a992e0902-LAX
alt-svc: h3="
GET 200 https://reallyfreegeoip.org/xml/175.208.134.152
REQUEST
: GET /xml/175.208.134.152 HTTP/1.1
Host: reallyfreegeoip.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 61323
Last-Modified: Wed, 16 Oct 2024 08
Report-To: {"endpoints"
NEL: {"success_fraction"
Server: cloudflare
CF-RAY: 8d3c917bdaee0902-LAX
alt-svc: h3="
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
GET 200 http://checkip.dyndns.org/
REQUEST
: GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
RESPONSE
: HTTP/1.1 200 OK
Date: Thu, 17 Oct 2024 01
Content-Type: text/html
Content-Length: 107
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2051430 ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org) Misc activity
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2043238 ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2039190 ET INFO 404/Snake/Matiex Keylogger Style External IP Check Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49164 -> 104.21.67.152:443 2051431 ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI Misc activity
TCP 192.168.56.103:49164 -> 104.21.67.152:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49163 -> 132.226.8.169:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49164
104.21.67.152:443
C=US, O=Google Trust Services, CN=WE1 CN=reallyfreegeoip.org ec:a0:50:43:31:8c:62:5a:08:a4:90:d8:a0:2b:7a:ad:f7:c7:2d:c3

Snort Alerts

No Snort Alerts