Last 24 hours Generated 2026-02-17 06:31:44 UTC

TLS Destinations

− Top TLS Server Names 15 rows
SNI Connections Clients TLS Version
login.microsoftonline.com 42,847 312 TLS 1.3
www.google.com 38,291 284 TLS 1.3
outlook.office365.com 34,827 298 TLS 1.3
api.github.com 28,472 142 TLS 1.3
cdn.cloudflare.net 24,291 234 TLS 1.3
s3.amazonaws.com 18,847 134 TLS 1.2
graph.microsoft.com 14,472 198 TLS 1.3
api.slack.com 12,291 118 TLS 1.3
registry.npmjs.org 8,847 72 TLS 1.2
pypi.org 6,472 42 TLS 1.2
docker.io 4,291 34 TLS 1.3
download.docker.com 3,847 28 TLS 1.3
updates.jenkins.io 2,472 18 TLS 1.2
grafana.internal.corp.net 1,847 84 TLS 1.2
vault.internal.corp.net 1,284 42 TLS 1.3

TLS Version Distribution

TLS Version Connections %
TLS 1.3 684,291 72.1
TLS 1.2 247,832 26.1
TLS 1.1 12,847 1.4
TLS 1.0 3,284 0.4

Rare JA3 Fingerprints

TLS client fingerprints seen from only a single host, potentially indicating custom or malware clients.

− Rare JA3 Fingerprints 5 rows
JA3 Hash Connections Unique Clients Sample Client Sample SNI
e7d705a3286e19ea42f587b344ee6865 3 1 10.1.8.50 c2-exfil-tunnel.suspicious-domain.net
6734f37431670b3ab4292b8f60f29984 7 1 10.169.112.51 raw.githubusercontent.com
72a589da586844d7f0818ce684948eea 12 1 10.6.19.21 pastebin.com
a0e9f5d64349fb13191bc781f81f42e1 2 1 10.1.8.13 transfer.sh
bd0bf25947d4a37404f0424edf4db9ad 5 1 172.16.4.10 ngrok.io

Self-Signed Certificates

TLS connections where the issuer matches the subject, indicating self-signed certificates.

− Self-Signed Certificates 3 rows
Destination IP SNI Subject Issuer Connections Clients
10.1.12.200 grafana.internal.corp.net CN=grafana.internal CN=grafana.internal 1,847 84
10.1.12.201 jenkins.internal.corp.net CN=jenkins.internal CN=jenkins.internal 623 42
10.1.12.205 dev-api.internal.corp.net CN=dev-api.internal CN=dev-api.internal 247 18