NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.45.223 Active Moloch
164.124.101.2 Active Moloch
172.67.219.133 Active Moloch
191.190.115.177 Active Moloch
GET 200 https://paste.ee/d/6Q39G/0
REQUEST
RESPONSE
GET 200 https://paste.ee/d/FW6Jp/0
REQUEST
RESPONSE
GET 200 https://paste.ee/d/lv0o9/0
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:54056 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 192.168.56.101:49200 -> 104.21.45.223:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49208 -> 172.67.219.133:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49200
104.21.45.223:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com e8:17:95:f3:a8:85:c4:14:59:ce:21:47:7d:34:50:64:8f:1c:2b:7f
TLSv1
192.168.56.101:49208
172.67.219.133:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com e8:17:95:f3:a8:85:c4:14:59:ce:21:47:7d:34:50:64:8f:1c:2b:7f

Snort Alerts

No Snort Alerts