NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
45.133.1.47 Active Moloch
46.101.81.223 Active Moloch
67.220.184.98 Active Moloch
Name Response Post-Analysis Lookup
ieaspk.com 67.220.184.98

POST 200 http://45.133.1.47/6.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/1.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/2.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/3.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/4.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/5.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/7.jpg
REQUEST
RESPONSE
POST 200 http://45.133.1.47/main.php
REQUEST
RESPONSE
POST 200 http://45.133.1.47/
REQUEST
RESPONSE
GET 200 http://46.101.81.223/t.exe
REQUEST
RESPONSE
GET 200 http://46.101.81.223/origin.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 45.133.1.47:80 -> 192.168.56.101:49202 2026537 ET HUNTING Suspicious EXE Download Content-Type image/jpeg Potential Corporate Privacy Violation
TCP 45.133.1.47:80 -> 192.168.56.101:49202 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 45.133.1.47:80 -> 192.168.56.101:49202 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 45.133.1.47:80 -> 192.168.56.101:49202 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49214 -> 46.101.81.223:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 46.101.81.223:80 -> 192.168.56.101:49214 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 46.101.81.223:80 -> 192.168.56.101:49214 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 46.101.81.223:80 -> 192.168.56.101:49214 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 67.220.184.98:443 -> 192.168.56.101:49237 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49228 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49231 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49225 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49231 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49226 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49231 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49231 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49225 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49225 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49225 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49226 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49226 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49226 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49233 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49227 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49233 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49233 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49227 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49233 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49227 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49237 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49227 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49237 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49237 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49230 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49229 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49230 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49230 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49249 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49230 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49229 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49229 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49229 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49249 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49249 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49249 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49239 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49235 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49234 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49239 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49249 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49239 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49235 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49249 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49239 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49235 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49234 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49235 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49228 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49241 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49264 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49238 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49257 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49228 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49228 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49241 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49264 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49238 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49241 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49264 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49238 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49241 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49264 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49238 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49268 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49240 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49268 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49240 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49268 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49244 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49240 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49268 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49240 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49244 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49244 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49244 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49280 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49246 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49280 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49280 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49246 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49280 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49246 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49246 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49281 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49250 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49281 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49281 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49250 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49281 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49252 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49250 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49250 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49252 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49252 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49252 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49284 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49253 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49284 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49284 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49253 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49284 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49253 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49253 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49262 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49287 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49262 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49254 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49262 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49287 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49262 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49287 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49287 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49254 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49254 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49254 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49288 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49265 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49266 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49288 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49288 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49265 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49288 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49265 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49265 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49266 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49266 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49257 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49257 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49266 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49257 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49265 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49265 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49296 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49296 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49296 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49267 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49263 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49296 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49271 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49267 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49263 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49267 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49263 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49267 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49271 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49263 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49271 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49298 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49271 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49298 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49298 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49272 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49298 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49273 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49282 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49272 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49272 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49273 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49272 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49273 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49282 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49273 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49282 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49304 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49282 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49304 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49304 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49304 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49274 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49290 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49274 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49274 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49290 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49274 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49290 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49290 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49308 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49236 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49308 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49236 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49308 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49236 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49308 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49236 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49293 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49283 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49293 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49293 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49293 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49242 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49283 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49283 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49283 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49242 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49242 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49242 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49295 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49279 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49295 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49295 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49243 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49295 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49279 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49279 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49279 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49243 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49243 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49297 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49243 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49289 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49297 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49297 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49243 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49297 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49294 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49294 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49243 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49322 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49294 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49294 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49322 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49322 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49322 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49301 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49297 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49297 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49301 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49301 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49301 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49303 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49301 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49301 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49303 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49303 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49303 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49306 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49306 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49306 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49311 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49306 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49311 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49311 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49311 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49307 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49307 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49307 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49307 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49325 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49309 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49309 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49325 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49309 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49325 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49325 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49289 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49289 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected
TCP 192.168.56.101:49289 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49309 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49202 -> 45.133.1.47:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected
TCP 67.220.184.98:443 -> 192.168.56.101:49327 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49320 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49327 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49327 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49327 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49320 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49320 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49320 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49327 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49327 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49210 -> 46.101.81.223:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 67.220.184.98:443 -> 192.168.56.101:49323 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49210 -> 46.101.81.223:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 67.220.184.98:443 -> 192.168.56.101:49247 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49323 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49323 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49323 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49247 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49247 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49247 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49324 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49251 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49324 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49324 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49324 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49251 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49251 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49251 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49328 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49255 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49255 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49255 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49299 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49255 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49299 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49299 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49299 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49260 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49310 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49260 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49260 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49310 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49260 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49310 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49310 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49269 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49312 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49269 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49312 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49269 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49312 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49269 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49312 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49314 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49278 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49314 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49278 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49314 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49278 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49314 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49278 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49315 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49286 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49315 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49286 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49315 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49286 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49315 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49286 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49316 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49292 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49316 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49316 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49292 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49316 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49292 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49292 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49328 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49328 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49328 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49300 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49330 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49300 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49300 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49330 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49300 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49330 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49305 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49330 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49305 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49319 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49305 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49305 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49319 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49319 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49319 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49318 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49318 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49321 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49318 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49318 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49321 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49321 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49321 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49326 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49333 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49326 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49326 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49326 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49333 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49333 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49333 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49331 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49331 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49331 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49331 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 46.101.81.223:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49232 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49232 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49232 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49232 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49245 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49245 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49245 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49245 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49248 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49248 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49248 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49248 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49256 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49256 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49256 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49256 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49258 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49258 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49258 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49258 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49259 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49259 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49259 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49259 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49261 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49261 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49261 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49261 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49270 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49270 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49270 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49270 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49275 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49275 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49275 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49275 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49275 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49275 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49276 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49276 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49276 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49276 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49277 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49277 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49277 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49277 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49285 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49285 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49285 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49285 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49291 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49291 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49291 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49291 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49302 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49302 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49302 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49302 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49313 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49313 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49313 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49313 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49317 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49317 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49317 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49317 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49329 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49329 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49329 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49329 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49332 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49332 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49332 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49332 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49334 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49334 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49334 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49334 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49334 -> 67.220.184.98:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.101:49334 -> 67.220.184.98:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49321 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49321 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49270 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49270 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49280 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49280 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49258 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49258 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49309 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49309 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49230 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49313 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49230 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49313 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49307 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49307 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49323 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49323 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49308 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49308 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49320 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49320 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49298 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49298 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49262 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49262 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49288 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49288 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49319 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49319 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49227 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49227 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49248 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49316 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49264 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49316 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49264 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49315 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49293 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49293 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49306 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49306 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49295 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49295 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49244 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49244 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49311 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49311 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49324 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49324 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49246 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49246 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49252 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49252 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49250 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49250 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49272 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49272 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49238 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49248 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49287 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49287 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49304 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49304 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49225 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49225 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 46.101.81.223:80 -> 192.168.56.101:49210 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 67.220.184.98:443 -> 192.168.56.101:49268 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 46.101.81.223:80 -> 192.168.56.101:49210 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 67.220.184.98:443 -> 192.168.56.101:49238 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49269 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49269 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49266 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49260 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49266 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49260 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49254 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49247 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49254 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49247 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49325 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49325 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49282 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49282 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49271 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49271 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49290 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49290 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49253 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49253 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49235 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49235 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49303 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49303 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.101:49335 -> 67.220.184.98:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 67.220.184.98:443 -> 192.168.56.101:49240 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49240 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49226 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49226 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49268 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49322 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49322 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49229 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49229 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49234 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49234 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49284 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49284 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49296 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49296 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49281 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49281 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49239 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49239 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49283 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49283 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49328 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49328 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49267 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49267 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49294 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49294 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49231 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49231 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49233 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49233 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49330 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49330 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49241 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49241 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49315 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49237 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49237 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49263 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49263 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49274 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49274 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49279 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49279 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49333 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49333 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49299 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49299 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49314 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49314 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49312 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49312 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49289 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49289 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49257 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49257 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49310 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49310 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49273 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49273 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49326 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49326 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49236 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49236 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49242 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49242 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49318 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49318 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49251 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49251 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49305 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49305 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49292 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49292 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49286 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49286 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49300 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49300 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49278 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49278 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49228 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49228 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49255 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49255 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49331 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49331 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49232 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49232 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49302 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49302 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49317 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49317 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49291 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49291 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49259 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49259 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49277 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49277 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49245 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49245 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49329 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49329 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49256 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49256 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49276 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49276 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49332 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49332 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49285 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49285 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49261 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 67.220.184.98:443 -> 192.168.56.101:49261 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts