Network Analysis
| IP Address | Status | Action | VT | Location |
|---|---|---|---|---|
| No hosts contacted. | ||||
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
No traffic
No traffic
No traffic
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 149.154.167.99:443 -> 192.168.168.202:49233 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
| TCP 192.168.168.202:49233 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) | Misc activity |
| TCP 149.154.167.99:443 -> 192.168.168.202:49232 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
| TCP 192.168.168.202:49232 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) | Misc activity |
| TCP 192.168.168.202:49234 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) | Misc activity |
| TCP 192.168.168.202:49235 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) | Misc activity |
| TCP 149.154.167.99:443 -> 192.168.168.202:49236 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
| TCP 149.154.167.99:443 -> 192.168.168.202:49237 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
Snort Alerts
| Flow | SID | Message |
|---|---|---|
| TCP 192.168.168.202:49233 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) |
| TCP 192.168.168.202:49232 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) |
| TCP 192.168.168.202:49234 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) |
| TCP 192.168.168.202:49235 -> 149.154.167.99:443 | 2041933 | ET INFO Observed Telegram Domain (t .me in TLS SNI) |
