NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.230.132 Active Moloch
104.16.231.132 Active Moloch
162.159.134.42 Active Moloch
164.124.101.2 Active Moloch
PROPFIND 404 https://toolkit-nokia-network-alert.trycloudflare.com/AutoRun.inf
REQUEST
RESPONSE
PROPFIND 403 https://toolkit-nokia-network-alert.trycloudflare.com/deci.zip
REQUEST
RESPONSE
PROPFIND 403 https://toolkit-nokia-network-alert.trycloudflare.com/deci.zip
REQUEST
RESPONSE
PROPFIND 403 https://toolkit-nokia-network-alert.trycloudflare.com/deci.zip
REQUEST
RESPONSE
PROPFIND 403 https://toolkit-nokia-network-alert.trycloudflare.com/deci.zip
REQUEST
RESPONSE
GET 200 https://toolkit-nokia-network-alert.trycloudflare.com/b.txt
REQUEST
RESPONSE
LOCK 200 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
GET 200 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
UNLOCK 204 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
LOCK 200 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPFIND 207 https://toolkit-nokia-network-alert.trycloudflare.com/
REQUEST
RESPONSE
HEAD 200 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PUT 204 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPPATCH 207 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
UNLOCK 204 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPFIND 207 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
LOCK 200 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPPATCH 207 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
HEAD 200 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PUT 204 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPPATCH 207 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
UNLOCK 204 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPFIND 207 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE
PROPPATCH 207 https://toolkit-nokia-network-alert.trycloudflare.com/error_log.txt
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49179 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49183 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.101:49198 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49198 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49198 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49199 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49178 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49185 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49197 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.101:49197 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49197 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49199 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.101:49199 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:53004 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49198
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49162
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49196
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49172
104.16.230.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49197
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49177
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94
TLSv1
192.168.56.101:49199
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94

Snort Alerts

No Snort Alerts