NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.56.235 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
braxsilcxfxc.net.br 104.21.56.235
GET 200 https://braxsilcxfxc.net.br/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0075978B50A566BA116EB25127B04829.html
REQUEST
RESPONSE
GET 200 https://braxsilcxfxc.net.br/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-3C7AAD4ED72F74438CD34BEC400D3DD3.html
REQUEST
RESPONSE
GET 200 https://braxsilcxfxc.net.br/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-6628EEC24B586EA652FFAAC607AFBD2C.html
REQUEST
RESPONSE
GET 301 http://braxsilcxfxc.net.br/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0075978B50A566BA116EB25127B04829.html
REQUEST
RESPONSE
GET 301 http://braxsilcxfxc.net.br/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-3C7AAD4ED72F74438CD34BEC400D3DD3.html
REQUEST
RESPONSE
GET 301 http://braxsilcxfxc.net.br/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-6628EEC24B586EA652FFAAC607AFBD2C.html
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 104.21.56.235:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
104.21.56.235:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 7c:73:22:c7:d1:20:c3:53:b5:f5:08:fc:2f:c9:56:50:cd:a3:91:2d

Snort Alerts

No Snort Alerts