popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 3 DNS 2 TCP 41 UDP 6 HTTP(S) 1 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
208.95.112.1 Active Moloch

GET 200 http://ip-api.com/line?fields=query
REQUEST
RESPONSE
BODY 

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49163
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49163 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49163 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49162 ->
                208.95.112.1:80
            
            2022082
            ET POLICY External IP Lookup ip-api.com
            Device Retrieving External IP Address Detected
        

        
        

            
                TCP
                192.168.56.103:49163 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49168
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49165
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49166
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49165 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49165 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                UDP
                192.168.56.103:50800 ->
                164.124.101.2:53
            
            2033966
            ET HUNTING Telegram API Domain in DNS Lookup
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49166 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49165 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49166 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49175
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49166 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49171
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49175 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49175 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49167
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49180
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49175 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49173
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49180 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49180 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49188
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49180 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49179
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49188 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49188 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49174
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49179 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49179 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49188 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49182
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49179 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49182 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49189
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49182 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49185
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49182 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49176
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49189 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49185 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49189 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49185 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49176 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49190
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49189 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49176 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49185 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49176 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49190 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49190 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49192
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49187
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49190 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49184
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49192 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49187 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49192 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49187 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49184 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49194
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49184 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49192 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49187 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49181
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49193
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49181 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49196
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49181 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49193 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49181 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49196 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49193 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49169
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49196 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49194 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49193 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49194 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49183
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49196 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49194 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49183 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49202
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49183 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                UDP
                192.168.56.103:64894 ->
                164.124.101.2:53
            
            2033966
            ET HUNTING Telegram API Domain in DNS Lookup
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49183 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49202 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49195
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49202 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49202 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49195 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49186
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49195 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49203
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49186 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49195 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49186 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49203 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49203 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49184 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49197
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49203 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49197 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49197 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49191
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49197 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49191 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49191 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49191 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49198
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49198 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49170
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49198 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49186 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49198 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49201
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49172
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49201 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49201 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49201 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49199
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49199 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49199 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49177
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49199 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49177 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49177 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49177 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49200
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49200 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49200 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                149.154.167.220:443 ->
                192.168.56.103:49178
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49200 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49178 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49178 ->
                149.154.167.220:443
            
            906200022
            SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
            undefined
        

        
        

            
                TCP
                192.168.56.103:49178 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49187 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49192 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49196 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49193 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49195 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49201 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49199 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49186 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49184 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49197 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49189 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49188 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49202 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49194 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49177 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49198 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49182 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49176 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49163 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49180 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49181 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49191 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49185 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49203 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49179 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49165 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49200 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49183 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49166 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49175 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49178 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
        

            
                TCP
                192.168.56.103:49190 ->
                149.154.167.220:443
            
            2033967
            ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
            Misc activity
        

        
    




Suricata TLS


    
No Suricata TLS




                            
Snort Alerts


    
No Snort Alerts