NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.230.132 Active Moloch
104.16.231.132 Active Moloch
164.124.101.2 Active Moloch
217.6.220.73 Active Moloch

PROPFIND 207 https://achievements-plates-station-gaming.trycloudflare.com/32
REQUEST
RESPONSE
PROPFIND 207 https://achievements-plates-station-gaming.trycloudflare.com/rx.bat
REQUEST
RESPONSE
GET 200 https://achievements-plates-station-gaming.trycloudflare.com/rx.bat
REQUEST
RESPONSE
PROPFIND 404 https://achievements-plates-station-gaming.trycloudflare.com/DavWWWRoo
REQUEST
RESPONSE
PROPFIND 404 https://achievements-plates-station-gaming.trycloudflare.com/DavWWWRoo
REQUEST
RESPONSE
PROPFIND 404 https://achievements-plates-station-gaming.trycloudflare.com/DavWWWRoo
REQUEST
RESPONSE
PROPFIND 404 https://divide-snow-pound-clip.trycloudflare.com/AutoRun.inf
REQUEST
RESPONSE
PROPFIND 207 https://achievements-plates-station-gaming.trycloudflare.com/32
REQUEST
RESPONSE
PROPFIND 404 https://characters-contrary-foster-workout.trycloudflare.com/AutoRun.inf
REQUEST
RESPONSE
PROPFIND 207 https://achievements-plates-station-gaming.trycloudflare.com/final.bat
REQUEST
RESPONSE
PROPFIND 207 https://characters-contrary-foster-workout.trycloudflare.com/
REQUEST
RESPONSE
MKCOL 201 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC
REQUEST
RESPONSE
GET 200 https://achievements-plates-station-gaming.trycloudflare.com/final.bat
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC
REQUEST
RESPONSE
PROPFIND 404 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPFIND 404 https://achievements-plates-station-gaming.trycloudflare.com/DavWWWRoo
REQUEST
RESPONSE
PUT 201 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
LOCK 200 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
HEAD 200 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPFIND 404 https://achievements-plates-station-gaming.trycloudflare.com/DavWWWRoo
REQUEST
RESPONSE
PUT 204 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
UNLOCK 204 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPFIND 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC.txt
REQUEST
RESPONSE
PROPFIND 404 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PUT 201 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
LOCK 200 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
HEAD 200 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PUT 204 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
UNLOCK 204 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PROPFIND 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PROPPATCH 207 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/test22-PC_screenshot.png
REQUEST
RESPONSE
PROPFIND 404 https://characters-contrary-foster-workout.trycloudflare.com/test22-PC/update.bat
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
UDP 192.168.56.101:53004 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.101:49193 -> 217.6.220.73:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49202 -> 217.6.220.73:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.101:49200 -> 217.6.220.73:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49175 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49175 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49175 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49186 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49186 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49194 -> 217.6.220.73:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49196 -> 217.6.220.73:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49181 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49181 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:53850 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.101:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49213 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49220 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49220 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49220 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49220 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49220 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49229 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49229 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49229 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49221 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49221 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49221 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49236 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49236 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49236 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49220 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49220 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49223 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49223 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49223 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49223 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49223 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49223 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49223 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49227 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49227 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49227 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49231 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49231 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49231 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49234 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49234 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49234 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49234 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49234 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49235 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49235 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49235 -> 104.16.230.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49235 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49235 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49235 -> 104.16.230.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49235 -> 104.16.230.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49161
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49191
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49163
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49171
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49212
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49175
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49216
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49186
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49181
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49213
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49217
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49218
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49268
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49220
104.16.230.132:443
None None None
TLSv1
192.168.56.101:49229
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49221
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49236
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49223
104.16.230.132:443
None None None
TLSv1
192.168.56.101:49265
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49227
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49231
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49234
104.16.230.132:443
None None None
TLSv1
192.168.56.101:49235
104.16.230.132:443
None None None
TLSv1
192.168.56.101:49241
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49258
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94

Snort Alerts

No Snort Alerts