popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 3 DNS 2 TCP 48 UDP 5 HTTP(S) 1 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
208.95.112.1 Active Moloch

GET 200 http://ip-api.com/line?fields=query
REQUEST
RESPONSE
BODY 

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49165
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49166
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49165 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49166 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49165 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49166 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49165 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49166 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49169
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49176
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49169 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49169 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49176 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49169 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49176 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49176 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49173
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49179
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49173 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49173 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49179 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49173 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49168
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49174
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49168 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49174 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49168 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49174 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49168 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49174 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49171
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49185
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49171 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49185 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49171 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49185 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49171 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49185 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49183
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49190
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49183 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49190 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49183 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49190 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49183 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49190 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49187
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49197
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49187 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49187 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49187 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49188
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49188 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49188 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49188 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49191
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49191 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49191 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49191 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49192
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49192 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49192 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49192 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49204
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49204 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49204 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49204 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49208
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49208 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49208 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49208 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49179 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49179 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49180
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49180 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49180 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49180 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49193
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49193 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49193 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49193 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49199
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49199 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49199 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49199 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49202
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49202 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49202 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49202 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49210
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49210 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49210 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49210 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49197 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49197 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49197 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49170
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49203
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49170 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49205
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49170 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                UDP
                192.168.56.101:54148 ->
                164.124.101.2:53
            
            2033966
            ET HUNTING Telegram API Domain in DNS Lookup
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49170 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49172
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49182
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49164 ->
                208.95.112.1:80
            
            2022082
            ET POLICY External IP Lookup ip-api.com
            Device Retrieving External IP Address Detected
        

        
        

            
                TCP
                192.168.56.101:49172 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49172 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49172 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49209
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49175
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49177
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49182 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49175 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49177 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49209 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49175 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49177 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49209 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49175 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49177 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49182 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49182 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49186
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49178
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49184
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49178 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49186 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49178 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49186 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49184 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49178 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49209 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49186 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49184 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49181
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49189
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49211
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49184 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49181 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49189 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49211 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49181 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49189 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49211 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49181 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49189 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49194
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49211 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49194 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49194 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49200
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49194 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49200 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49196
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49200 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49200 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49195
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49196 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49196 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49195 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49196 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49207
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49195 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49207 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49207 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49206
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49195 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49207 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49206 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49206 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49206 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49198
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49212
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49198 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49198 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49212 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49198 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49212 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49212 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.101:49201
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.101:49201 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49201 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.101:49201 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49194 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49181 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49184 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49166 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49207 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49168 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49211 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49195 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49185 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49201 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49199 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49175 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49171 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49210 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49197 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49173 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49192 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49188 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49176 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49208 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49190 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49172 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49212 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49200 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49196 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49198 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49179 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49182 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49177 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49193 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49170 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49187 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49180 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49183 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49165 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49202 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49204 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49191 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49169 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49174 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49178 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49209 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49206 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49189 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.101:49186 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
    




Suricata TLS


    
No Suricata TLS




                            
Snort Alerts


    
No Snort Alerts