NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.26.12.31 Active Moloch
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.104.79.63 Active Moloch
192.0.32.59 Active Moloch
195.88.209.205 Active Moloch
74.119.193.164 Active Moloch
88.99.66.31 Active Moloch
GET 200 https://iplogger.org/1rst77
REQUEST
RESPONSE
GET 200 https://iplogger.org/1aSny7
REQUEST
RESPONSE
GET 200 https://iplogger.org/favicon.ico
REQUEST
RESPONSE
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3
185.248.101.50 192.168.56.101 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49219 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49222 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49223 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49230 -> 104.26.12.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 74.119.193.164:3214 -> 192.168.56.101:49227 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49219
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.101:49222
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.101:49223
88.99.66.31:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.101:49230
104.26.12.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e

Snort Alerts

No Snort Alerts