NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
157.240.215.14 Active Moloch
157.240.215.35 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://www.facebook.com/login
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/om552iOCRxJ.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yJ/l/0,cross/JtVgZ46o85N.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yr/l/0,cross/wMc7fNlPdnA.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/0_HoU29ShlI.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/y1/r/4lCu2zih0ca.svg
REQUEST
RESPONSE
GET 302 https://facebook.com/security/hsts-pixel.gif?c=3.2.5
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yB/r/Y0L6f5sxdIV.png
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yK/r/Lzd-U--zeLf.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 302 https://fbcdn.net/security/hsts-pixel.gif?c=2.5
REQUEST
RESPONSE
GET 302 https://fbsbx.com/security/hsts-pixel.gif?c=5
REQUEST
RESPONSE
GET 200 https://connect.facebook.net/security/hsts-pixel.gif
REQUEST
RESPONSE
GET 200 https://www.facebook.com/favicon.ico
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49171 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49175 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49172 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49177 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49187 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49188 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49184 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49182 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49185 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49189 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49176
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49174
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49171
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49175
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49168
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49169
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49172
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49178
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49177
157.240.215.14:443
None None None
TLSv1
192.168.56.101:49173
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49180
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net d6:6a:95:05:2c:a4:41:0f:81:1a:10:70:ba:4f:59:d8:f3:de:8a:51
TLSv1
192.168.56.101:49179
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49187
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49181
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net d6:6a:95:05:2c:a4:41:0f:81:1a:10:70:ba:4f:59:d8:f3:de:8a:51
TLSv1
192.168.56.101:49188
157.240.215.35:443
None None None
TLSv1
192.168.56.101:49184
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net d6:6a:95:05:2c:a4:41:0f:81:1a:10:70:ba:4f:59:d8:f3:de:8a:51
TLSv1
192.168.56.101:49182
157.240.215.14:443
None None None
TLSv1
192.168.56.101:49185
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net d6:6a:95:05:2c:a4:41:0f:81:1a:10:70:ba:4f:59:d8:f3:de:8a:51
TLSv1
192.168.56.101:49186
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 45:04:8e:02:29:a1:f1:8b:1f:22:0f:34:50:09:8b:3b:b4:94:a3:0a
TLSv1
192.168.56.101:49189
157.240.215.35:443
None None None

Snort Alerts

No Snort Alerts