NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.231.132 Active Moloch
162.159.134.42 Active Moloch
164.124.101.2 Active Moloch

PROPFIND 404 https://minutes-amazing-curriculum-maui.trycloudflare.com/AutoRun.inf
REQUEST
RESPONSE
PROPFIND 404 https://lu-phys-peru-goes.trycloudflare.com/AutoRun.inf
REQUEST
RESPONSE
PROPFIND 207 https://lu-phys-peru-goes.trycloudflare.com/
REQUEST
RESPONSE
MKCOL 201 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65
REQUEST
RESPONSE
PROPFIND 404 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PUT 201 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
LOCK 200 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
HEAD 200 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PUT 204 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
UNLOCK 204 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PROPFIND 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
REQUEST
RESPONSE
PROPFIND 404 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PUT 201 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
LOCK 200 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
HEAD 200 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PUT 204 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
UNLOCK 204 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PROPFIND 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PROPPATCH 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
REQUEST
RESPONSE
PROPFIND 404 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/update.bat
REQUEST
RESPONSE
GET 200 https://minutes-amazing-curriculum-maui.trycloudflare.com/update.bat
REQUEST
RESPONSE
PROPFIND 207 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65
REQUEST
RESPONSE
PROPFIND 404 https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/update.bat
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49187 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49191 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49212 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49212 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49212 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49223 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49223 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49223 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49215 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49215 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49215 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49170 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49170 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49170 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49185 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49188 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49211 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49211 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49211 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49214 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49214 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49214 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49210
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49169
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49167
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49168
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49217
104.16.231.132:443
None None None
TLSv1
192.168.56.103:49209
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49212
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49223
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49213
104.16.231.132:443
None None None
TLSv1
192.168.56.103:49215
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49218
104.16.231.132:443
None None None
TLSv1
192.168.56.103:49235
104.16.231.132:443
None None None
TLSv1
192.168.56.103:49170
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49211
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49214
104.16.231.132:443
C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b

Snort Alerts

No Snort Alerts