diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
| commit | e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d (patch) | |
| tree | e02486c0af8f5f8bf64600f0a1a2b4904c4c123a /kevlar/2026-08-31/honeylabs | |
| parent | 1d9b78adfc083d1120c55e403e6b3d6317a1171f (diff) | |
add: bph report iocs
Diffstat (limited to 'kevlar/2026-08-31/honeylabs')
47 files changed, 2043 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson b/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson new file mode 100644 index 0000000..a22aeb5 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson @@ -0,0 +1 @@ +{"timestamp": "2026-08-27T07:59:32", "event_id": "dbbe5212-e3ec-4649-a753-7e8ad3b2bfd6", "source_ip": "154.90.37.55", "source_port": 55537, "source_domain": "", "country_code": "PH", "country_name": "Philippines", "city_name": "Manila", "asn_number": 138915, "asn_org": "Kaopu Cloud HK Limited", "dest_port": 5986, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Microsoft WinRM Client", "url_path": "/wsman?PSVersion=5.1.19041.1", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>:5986\",\"user-agent\":\"Microsoft WinRM Client\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i220900_231e334592e8_29829a46703f", "tls_client_ja3": "622a7fd6adbafa3736c1a3468db8a8e0", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0400_52fce913cf3b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 211, "dest_bytes": 77, "network_bytes": 288, "event_summary": ""} diff --git a/kevlar/2026-08-31/honeylabs/events-AS140666.ndjson b/kevlar/2026-08-31/honeylabs/events-AS140666.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS140666.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS14956.ndjson b/kevlar/2026-08-31/honeylabs/events-AS14956.ndjson new file mode 100644 index 0000000..33e3ee4 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS14956.ndjson @@ -0,0 +1,36 @@ +{"timestamp": "2026-08-24T22:17:44", "event_id": "e3652ca7-8ef2-411e-bdbe-62448b320f7c", "source_ip": "172.86.114.162", "source_port": 57239, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T22:17:40", "event_id": "987eac5e-6dc9-4c47-85ae-f09afadb2abf", "source_ip": "172.86.114.162", "source_port": 56423, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 364, "dest_bytes": 56, "network_bytes": 420, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-24T22:01:14", "event_id": "9515b94b-2e0f-450c-975a-bf0a1510453c", "source_ip": "172.86.114.162", "source_port": 55118, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 471000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T22:01:11", "event_id": "cab9eac0-2ece-43f3-8fef-368d40284229", "source_ip": "172.86.114.162", "source_port": 54322, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 471000000, "source_bytes": 364, "dest_bytes": 56, "network_bytes": 420, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-24T20:43:14", "event_id": "816fb942-ef87-435a-9d2f-1eddef1c6292", "source_ip": "172.86.114.162", "source_port": 53844, "source_domain": "", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T23:21:07", "event_id": "5a66921e-1611-416f-972c-1b2b14edfff3", "source_ip": "107.189.26.103", "source_port": 51734, "source_domain": "103.26.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "libredtail-http", "url_path": "/containers/json", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_39072d476f20", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 49, "event_duration": 21320000000, "source_bytes": 19145, "dest_bytes": 3871, "network_bytes": 23016, "event_summary": ""} +{"timestamp": "2026-08-26T13:35:07", "event_id": "d3513389-2207-4ff1-9756-1c5341ab5860", "source_ip": "107.189.17.181", "source_port": 36309, "source_domain": "181.17.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 402, "dest_bytes": 79, "network_bytes": 481, "event_summary": "OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 107.189.17.181:36309;branch=z9hG4bKf7bdb105bc304299b1846392adcc4825;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"306898751\" <sip:306898751@107.189.17.181>;tag=288630618\r\nCall-ID: 7526c76e39e0447b98e7237f13949988\r\nContact: <sip:306898751@107.189.17.181:36309>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-26T13:35:01", "event_id": "093afdf1-ad72-4792-b74a-516a5a3e24ff", "source_ip": "107.189.17.181", "source_port": 34819, "source_domain": "181.17.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 402, "dest_bytes": 79, "network_bytes": 481, "event_summary": "OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 107.189.17.181:34819;branch=z9hG4bK22d506c18ecd40bc9a52ee95354fa970;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"347968744\" <sip:347968744@107.189.17.181>;tag=780011372\r\nCall-ID: 9024c9deb5094e7a96a5584de702411a\r\nContact: <sip:347968744@107.189.17.181:34819>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-27T21:19:12", "event_id": "71901ade-895a-4cfd-b64a-6ad0f85f98a5", "source_ip": "144.172.99.12", "source_port": 55206, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 193, "dest_bytes": 78, "network_bytes": 271, "event_summary": ""} +{"timestamp": "2026-08-27T21:11:23", "event_id": "09b3fe28-4a88-492e-a54e-2135f43502c4", "source_ip": "144.172.99.12", "source_port": 59694, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 193, "dest_bytes": 78, "network_bytes": 271, "event_summary": ""} +{"timestamp": "2026-08-27T18:42:45", "event_id": "3fcc8342-6edb-41dc-b64a-8a06a58cd19c", "source_ip": "107.189.17.181", "source_port": 11207, "source_domain": "181.17.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 404, "dest_bytes": 79, "network_bytes": 483, "event_summary": "OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 107.189.17.181:11207;branch=z9hG4bK4389b244c27c4e638cef8b92266da0bd;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"539062981\" <sip:539062981@107.189.17.181>;tag=678161121\r\nCall-ID: b6891c008a1d4c52a9c7bdf7260d21bc\r\nContact: <sip:539062981@107.189.17.181:11207>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-27T17:33:12", "event_id": "ac563e81-2afc-4677-af55-6812c473a8ed", "source_ip": "144.172.94.243", "source_port": 5207, "source_domain": "243.94.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 404, "dest_bytes": 79, "network_bytes": 483, "event_summary": "OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 144.172.94.243:5207;branch=z9hG4bK9e6f7ce508844a508cc8e4c938e8d715;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"636960680\" <sip:636960680@144.172.94.243>;tag=376297213\r\nCall-ID: 736b8198516345d292c3b3ac27f11387\r\nContact: <sip:636960680@144.172.94.243:5207>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-27T16:30:48", "event_id": "4bfe9040-6a55-4a5a-8543-c2630eb82e7a", "source_ip": "45.61.182.81", "source_port": 47858, "source_domain": "81.182.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 218000000, "source_bytes": 1388, "dest_bytes": 12, "network_bytes": 1400, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Rf{8\ufffd\ufffdVU\ufffdM\u0017\ufffd'\ufffdU?\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000)\ufffd\u0004\ufffd\u070bEZZ:\ufffd\ufffd\u0010\u0014\ufffd\u000e\ufffd\ufffd"} +{"timestamp": "2026-08-27T16:30:47", "event_id": "8884740f-ff7a-43b8-8b17-07987681daec", "source_ip": "45.61.182.81", "source_port": 47852, "source_domain": "81.182.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 221000000, "source_bytes": 1388, "dest_bytes": 12, "network_bytes": 1400, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014*N\ufffdw'\u0010\ufffd=k\ufffd\u0014\ufffd\ufffd8r\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffd\ufffd\ufffd\ufffd~(\ufffdI\bIrK\ufffd\ufffd\ufffd\ufffd"} +{"timestamp": "2026-08-27T13:48:28", "event_id": "e08397c6-4ae8-4c4c-b808-7ea985fdb1ed", "source_ip": "153.75.82.185", "source_port": 51978, "source_domain": "", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 133000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd*\ufffdU5\ufffd\ufffd\u0011(V\u04bdP\ufffdz\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd*@\u0014qmO\u000e\ufffd\ufffd~ \r\ufffd\ufffd\ufffd\u001d\ufffd"} +{"timestamp": "2026-08-27T13:48:28", "event_id": "3e933299-7703-445d-922f-3f9faeb399d3", "source_ip": "153.75.82.185", "source_port": 51964, "source_domain": "", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 132000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\u0003g\ufffd\ufffd\ufffdu\ufffd\u0007\ufffd.\u0005\ufffd\b:\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001d\u03b0Jw#L\ufffd\u0011Q\ufffd\ufffdk7\u00d4\ufffd\u0001"} +{"timestamp": "2026-08-27T12:46:18", "event_id": "44f04d10-b1ae-403d-8da1-ac22416ac39c", "source_ip": "45.61.177.179", "source_port": 40906, "source_domain": "179.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 191000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00142\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&q\ufffd\ufffd\ufffd\ufffd\fb\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000j\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u000eWuLD\ufffd5\ufffd.:"} +{"timestamp": "2026-08-27T12:46:17", "event_id": "35c8367a-9ec7-4de2-983f-dfa92904fbff", "source_ip": "45.61.177.179", "source_port": 40892, "source_domain": "179.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 426000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\u6ff9\u001a\u04489\ufffdr=U\ufffd\ufffd\ufffd\ufffdI\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00000z\u000b[\ufffd\u0019\"\ufffd\ufffd\u00fbR\ufffd\ufffd\ufffd\u0005\u0003\u0014"} +{"timestamp": "2026-08-27T11:42:29", "event_id": "18346f67-3fec-4682-a407-d0e00f5d6b72", "source_ip": "144.172.99.12", "source_port": 35054, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 191, "dest_bytes": 78, "network_bytes": 269, "event_summary": ""} +{"timestamp": "2026-08-27T10:35:10", "event_id": "f9848029-509b-4477-bf14-19ef54c588be", "source_ip": "45.61.129.23", "source_port": 63690, "source_domain": "23.129.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 51, "dest_bytes": 12, "network_bytes": 63, "event_summary": "\u0000\u0000\u0000/\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd \u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp": "2026-08-27T10:35:10", "event_id": "734cc4ff-8014-4845-ac7c-378bc472453d", "source_ip": "45.61.129.23", "source_port": 63664, "source_domain": "23.129.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 51, "dest_bytes": 12, "network_bytes": 63, "event_summary": "\u0000\u0000\u0000/\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd \u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp": "2026-08-27T09:48:12", "event_id": "073137a7-f4bf-4f1b-863d-ef38dc7d33d3", "source_ip": "45.61.177.185", "source_port": 45368, "source_domain": "185.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 142000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\b\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u03a0QO\ufffd\ufffd\ufffd\ufffd>\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\\c\ufffd.e\ufffd\ufffd_\u0019@\ufffd\u0012\ufffd\ufffd\ufffd(''"} +{"timestamp": "2026-08-27T01:23:55", "event_id": "17aceb51-9c31-4de4-86ad-13b40d2b3b33", "source_ip": "45.61.177.185", "source_port": 58928, "source_domain": "185.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 132000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\u0003\ufffds\ufffd\ufffd;\ufffdV=\ufffd\ufffdc\ufffd\u001f\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0200\u001cqL\ufffd\u0007\tSp{ \u001e\ufffd\ufffd\u0005\u007f\ufffd"} +{"timestamp": "2026-08-27T00:57:33", "event_id": "80b4b385-ca8b-4315-8c83-168f3b29217f", "source_ip": "45.61.170.85", "source_port": 36984, "source_domain": "powered-by.atomicnetworks.co", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 250000000, "source_bytes": 1388, "dest_bytes": 12, "network_bytes": 1400, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffdP>u\ufffd=\ufffdY\ufffd\ufffd,\u00039\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u02dc\ufffd\r\u0019\ufffd~\ufffd\ufffdY\u0007\ufffd/n\ufffdYg"} +{"timestamp": "2026-08-28T23:50:10", "event_id": "80199e47-111b-4806-8c8e-d55e08f30a57", "source_ip": "167.88.168.121", "source_port": 60540, "source_domain": "121.168.88.167.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 164, "dest_bytes": 79, "network_bytes": 243, "event_summary": ""} +{"timestamp": "2026-08-28T23:08:44", "event_id": "7989b41a-30ef-4ae6-985a-96d2bebc5614", "source_ip": "167.88.168.121", "source_port": 32782, "source_domain": "121.168.88.167.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 164, "dest_bytes": 79, "network_bytes": 243, "event_summary": ""} +{"timestamp": "2026-08-28T21:31:40", "event_id": "01995649-8cc2-4929-b829-ab3d1b4e8bb7", "source_ip": "172.86.114.254", "source_port": 61592, "source_domain": "254.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T21:31:36", "event_id": "203d3d38-170b-443a-a261-006ccf36b8e1", "source_ip": "172.86.114.254", "source_port": 60820, "source_domain": "254.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 470000000, "source_bytes": 364, "dest_bytes": 56, "network_bytes": 420, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-30T07:11:38", "event_id": "be5e969e-3b83-4571-84f3-08a56e79d504", "source_ip": "144.172.111.21", "source_port": 33266, "source_domain": "21.111.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T06:28:55", "event_id": "28a77f01-7c47-4fb8-82d6-1aaddda981b5", "source_ip": "172.86.91.225", "source_port": 60129, "source_domain": "225.91.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 52, "network_bytes": 507, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T06:28:52", "event_id": "568c6672-5c26-48bd-9cd0-11b5ecc6bd8f", "source_ip": "172.86.91.225", "source_port": 59369, "source_domain": "225.91.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 471000000, "source_bytes": 364, "dest_bytes": 52, "network_bytes": 416, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-30T05:46:57", "event_id": "209f2087-a447-475c-adf5-9af8921767da", "source_ip": "144.172.115.222", "source_port": 45912, "source_domain": "222.115.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5061, "network_protocol": "tls", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "t13i311000_e8f1e7e78f70_d41ae481755e", "tls_client_ja3": "004556e859f3c26c5d19746b3a957c74", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 465000000, "source_bytes": 691, "dest_bytes": 15, "network_bytes": 706, "event_summary": "INVITE sip:001011972567158234@<HONEYPOT>:5061 SIP/2.0\r\nVia: SIP/2.0/TLS 144.172.115.222:45912;branch=z9hG4bK86f2e261d5;rport\r\nFrom: <sip:scanner@144.172.115.222>;tag=41bf8220\r\nTo: <sip:001011972567158234@<HONEYPOT>:5061>\r\nCall-ID: b15233ac-2733-4105-81a4-a481cce74742@144.172.115.222\r\nCSeq: 1 INVITE\r\nContact: <sip:scanner@144.172.115.222:45912>\r\nMax-Forwards: 70\r\nUser-Agent: 1001/GOLIATH\r\nAccept: application/sdp\r\nContent-Type: application/sdp\r\nContent-Length: 217\r\n\r\nv=0\r\no=- 1787742823 1787742823 IN IP4 144.172.115.222\r\ns=Call\r\nc=IN IP4 144.172.115.222\r\nt=0 0\r\nm=audio 7078 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T05:46:50", "event_id": "0262682e-0ab6-4b85-823b-e8af651fab99", "source_ip": "144.172.115.222", "source_port": 38624, "source_domain": "222.115.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5061, "network_protocol": "tls", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "t13i311000_e8f1e7e78f70_d41ae481755e", "tls_client_ja3": "004556e859f3c26c5d19746b3a957c74", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 474000000, "source_bytes": 424, "dest_bytes": 80, "network_bytes": 504, "event_summary": "OPTIONS sip:<HONEYPOT>:5061 SIP/2.0\r\nVia: SIP/2.0/TLS 144.172.115.222:38624;branch=z9hG4bK929f7920c7;rport\r\nFrom: <sip:scanner@144.172.115.222>;tag=afdcb41c\r\nTo: <sip:001011972567158234@<HONEYPOT>:5061>\r\nCall-ID: c304a861-41e9-4047-9568-490a46629140@144.172.115.222\r\nCSeq: 1 OPTIONS\r\nContact: <sip:scanner@144.172.115.222:38624>\r\nMax-Forwards: 70\r\nUser-Agent: 1001/GOLIATH\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-30T05:07:17", "event_id": "fc7ee807-c618-4aeb-8c9b-544c624f3bea", "source_ip": "172.86.91.225", "source_port": 52492, "source_domain": "225.91.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 52, "network_bytes": 507, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T05:07:14", "event_id": "f1c34577-bffc-4658-97df-5020d5e96308", "source_ip": "172.86.91.225", "source_port": 51736, "source_domain": "225.91.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 364, "dest_bytes": 52, "network_bytes": 416, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-30T00:48:19", "event_id": "51d0bf9d-938d-4f8c-8b51-c8a331f2b7cb", "source_ip": "144.172.99.12", "source_port": 43924, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 191, "dest_bytes": 78, "network_bytes": 269, "event_summary": ""} diff --git a/kevlar/2026-08-31/honeylabs/events-AS198953.ndjson b/kevlar/2026-08-31/honeylabs/events-AS198953.ndjson new file mode 100644 index 0000000..0baf647 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS198953.ndjson @@ -0,0 +1,134 @@ +{"timestamp": "2026-08-24T23:24:43", "event_id": "7b065982-1f58-4363-acc5-08e773e9e3d2", "source_ip": "176.120.22.240", "source_port": 63464, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3389, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 34, "dest_bytes": 14, "network_bytes": 48, "event_summary": "\u0003\u0000\u0000\"\u001d\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n"} +{"timestamp": "2026-08-24T23:24:43", "event_id": "64fae195-6e4a-4e1d-a740-f4eba9b30502", "source_ip": "176.120.22.240", "source_port": 63527, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 6379, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 34, "dest_bytes": 5, "network_bytes": 39, "event_summary": "\u0003\u0000\u0000\"\u001d\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n"} +{"timestamp": "2026-08-25T17:44:29", "event_id": "aeb4d906-8c02-446e-980f-b69f95d28fcd", "source_ip": "176.120.22.61", "source_port": 43023, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 7788, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:28", "event_id": "ab880744-2e86-4e22-bc41-dcf517e7f700", "source_ip": "176.120.22.61", "source_port": 33440, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1434, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:28", "event_id": "9ad6a857-0c62-4535-8ffe-23a4657f92c3", "source_ip": "176.120.22.61", "source_port": 27756, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 10443, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:27", "event_id": "71985b33-7b8c-4095-bca6-4a109d31eb58", "source_ip": "176.120.22.61", "source_port": 18067, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3005, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:27", "event_id": "a6c54efc-8670-4e23-aabb-6fc12681e0b1", "source_ip": "176.120.22.61", "source_port": 14644, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 28433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 104000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:27", "event_id": "68d7462f-241a-49b1-9423-3d2a48146606", "source_ip": "176.120.22.61", "source_port": 12782, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1501, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:27", "event_id": "dcf074b8-20cf-4e33-b065-c5ca4d08fe12", "source_ip": "176.120.22.61", "source_port": 10515, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5367, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:26", "event_id": "8bee6654-134c-42f2-a95f-aa3e0a2ecfd1", "source_ip": "176.120.22.61", "source_port": 6933, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 13433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:26", "event_id": "cc3f6a2c-20c6-4895-bcea-692ba7846e22", "source_ip": "176.120.22.61", "source_port": 1246, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1444, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:26", "event_id": "5452c6f7-3a70-4bff-8cf5-88154418d82e", "source_ip": "176.120.22.61", "source_port": 58596, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 11433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:25", "event_id": "61880cd2-865d-4760-94ff-2824abd6618f", "source_ip": "176.120.22.61", "source_port": 51637, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 2999, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:25", "event_id": "6fa93b8f-729d-4343-85b4-b31629322757", "source_ip": "176.120.22.61", "source_port": 48600, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:25", "event_id": "e1f51111-eaa0-4f18-9202-642a0ae02652", "source_ip": "176.120.22.61", "source_port": 48578, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 12433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:25", "event_id": "284ca315-7a69-4e4a-8a5b-77856806e611", "source_ip": "176.120.22.61", "source_port": 47643, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 7366, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:25", "event_id": "1affc509-74a8-44db-ba32-f5f2b0dae89c", "source_ip": "176.120.22.61", "source_port": 45262, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9999, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:24", "event_id": "9a2fcf2d-7a4d-47e7-9531-155661e4e42f", "source_ip": "176.120.22.61", "source_port": 36443, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1002, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:24", "event_id": "dc9a781d-5ea9-45d2-b29f-aa5294945b06", "source_ip": "176.120.22.61", "source_port": 36302, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 6602, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:24", "event_id": "251766e7-fa96-4619-a0a4-ee192da4194a", "source_ip": "176.120.22.61", "source_port": 36251, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 7433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:24", "event_id": "a7542363-1811-4a6d-a71a-96dca3ccafd9", "source_ip": "176.120.22.61", "source_port": 33560, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5369, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-25T17:44:24", "event_id": "0119ac2a-aa55-424d-a6eb-01dfbb37b85a", "source_ip": "176.120.22.61", "source_port": 32928, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5368, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-26T23:34:16", "event_id": "8e60c757-742e-430a-bc7a-b9ce2f52f96e", "source_ip": "176.120.22.43", "source_port": 52130, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/global-protect/login.esp", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"content-length\":\"117\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"priority\":\"u=0, i\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"sec-ch-ua\":\"\\\"Chromium\\\";v=\\\"121\\\", \\\"Not A(Brand\\\";v=\\\"99\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_792d2c6655cb", "tls_client_ja3": "03420579546b5bb7995da3f28c5d0a4d", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn18en_9a6afedbb443", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 926, "dest_bytes": 78, "network_bytes": 1004, "event_summary": ""} +{"timestamp": "2026-08-26T23:34:16", "event_id": "256b4e43-6fe7-4398-b40d-51455c79d279", "source_ip": "176.120.22.43", "source_port": 51748, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/global-protect/login.esp", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "872f0de3821c50e5dbbcb216fe2f9348", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_8b1ed2202073", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 242, "dest_bytes": 78, "network_bytes": 320, "event_summary": ""} +{"timestamp": "2026-08-26T23:03:42", "event_id": "dddacf65-63f5-4d2b-bd40-1d5413196186", "source_ip": "176.120.22.43", "source_port": 65365, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/global-protect/login.esp", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"content-length\":\"117\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"priority\":\"u=0, i\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"sec-ch-ua\":\"\\\"Chromium\\\";v=\\\"121\\\", \\\"Not A(Brand\\\";v=\\\"99\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_792d2c6655cb", "tls_client_ja3": "3c2bebcbcdf3878f1d867d465b49fc7b", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn18en_9a6afedbb443", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 926, "dest_bytes": 78, "network_bytes": 1004, "event_summary": ""} +{"timestamp": "2026-08-26T23:03:41", "event_id": "12a192ae-4a96-494c-b4ca-551b5c46fff1", "source_ip": "176.120.22.43", "source_port": 58112, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/global-protect/login.esp", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "8efc7ad36009d21e478a281093a5c37f", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0400_8b1ed2202073", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 242, "dest_bytes": 78, "network_bytes": 320, "event_summary": ""} +{"timestamp": "2026-08-26T18:55:48", "event_id": "ff5a8bb3-a482-492e-9f26-18cf9ed8747a", "source_ip": "176.120.22.43", "source_port": 63429, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/+CSCOE+/logon.html", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"ru,en;q=0.9,en-GB;q=0.8,en-US;q=0.7\",\"cache-control\":\"max-age=0\",\"cookie\":\"sdesktop=\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "70d138c17f4966d5da81466da15bedaa", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11cn06ru_b2fb244bb31f", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 335, "dest_bytes": 78, "network_bytes": 413, "event_summary": ""} +{"timestamp": "2026-08-26T17:09:58", "event_id": "892ebefb-f315-4f2c-bd5b-40a7c0a6c4aa", "source_ip": "176.120.22.43", "source_port": 53088, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/+CSCOE+/logon.html", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"ru,en;q=0.9,en-GB;q=0.8,en-US;q=0.7\",\"cache-control\":\"max-age=0\",\"cookie\":\"sdesktop=\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "117c9f03c81fe6372a3a63a910bcc349", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11cn06ru_b2fb244bb31f", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 335, "dest_bytes": 78, "network_bytes": 413, "event_summary": ""} +{"timestamp": "2026-08-26T13:12:31", "event_id": "a2f1db2c-9995-4c48-b32c-962cec95fa83", "source_ip": "193.143.1.66", "source_port": 21657, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3396, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T13:12:31", "event_id": "4b07c5d2-9ab2-4e71-8ac8-0f5cdd9bc7cf", "source_ip": "193.143.1.66", "source_port": 21564, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3396, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T13:12:31", "event_id": "53474ad4-536d-47bc-92b5-4062981d14e6", "source_ip": "193.143.1.66", "source_port": 21422, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3396, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T11:10:35", "event_id": "dc480b5b-9a53-4c42-a355-a2bf8c4c24a8", "source_ip": "193.143.1.66", "source_port": 28171, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3389, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T11:10:34", "event_id": "80761f83-e94c-4ffe-9f57-bbae14bdee4f", "source_ip": "193.143.1.66", "source_port": 25707, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3389, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T11:10:34", "event_id": "33f7b2a3-02f8-44ba-8a35-95641506e7b1", "source_ip": "193.143.1.66", "source_port": 23191, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3389, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-27T21:25:45", "event_id": "4c7e4f4a-b329-4843-8571-0128174f6145", "source_ip": "176.120.22.43", "source_port": 63611, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "aed793e929470b8ee9f387ec4a564630", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 259, "dest_bytes": 78, "network_bytes": 337, "event_summary": ""} +{"timestamp": "2026-08-27T16:54:08", "event_id": "018d7b34-6c78-4cdc-980f-4b12def6f38c", "source_ip": "176.120.22.61", "source_port": 62386, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1435, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:07", "event_id": "e736f13a-abde-45f8-af4e-8b79c9a9da62", "source_ip": "176.120.22.61", "source_port": 64448, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5367, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:07", "event_id": "8cf7e5a5-5e86-497d-9258-c15cb76ead26", "source_ip": "176.120.22.61", "source_port": 62480, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 23341, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:07", "event_id": "81050aa5-d0f5-4c06-a1fc-c979b7583a16", "source_ip": "176.120.22.61", "source_port": 62548, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 41433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:07", "event_id": "2dda33df-f9f1-44ac-bc3a-fab988fc6380", "source_ip": "176.120.22.61", "source_port": 63382, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 22433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "52b19e7e-1f86-4041-9350-a37a0ae11c28", "source_ip": "176.120.22.61", "source_port": 64142, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 14333, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "213cfbea-7316-4aa4-aeef-5f0378c2956c", "source_ip": "176.120.22.61", "source_port": 62716, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5000, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "fe883683-346a-48c6-a935-665ffcd67eb8", "source_ip": "176.120.22.61", "source_port": 62925, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 8001, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "07614720-d010-4e35-9736-5e346e877e15", "source_ip": "176.120.22.61", "source_port": 63794, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "18b07496-00dc-4747-9963-dffb88040f50", "source_ip": "176.120.22.61", "source_port": 62137, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 21433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "3b4145f3-1713-452a-93ea-35c0d7f58e6c", "source_ip": "176.120.22.61", "source_port": 62667, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "7dd1db5b-5e31-46c9-8080-6c938edf2650", "source_ip": "176.120.22.61", "source_port": 65150, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1434, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "e312dfeb-2833-4aff-8de4-b0ab327246fb", "source_ip": "176.120.22.61", "source_port": 62551, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1444, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "053b180d-fa3d-49d7-9e84-1f205478b320", "source_ip": "176.120.22.61", "source_port": 62911, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1455, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "95f40063-9ffd-4b43-b6ff-f6dc124e3c28", "source_ip": "176.120.22.61", "source_port": 63719, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 6366, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "3cee93b9-5fcc-4491-8078-d3988e2af46e", "source_ip": "176.120.22.61", "source_port": 62423, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9001, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "240e84a0-7178-4dba-9926-3fc30052e364", "source_ip": "176.120.22.61", "source_port": 64960, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1488, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "42f5be74-b078-43c7-8bd4-b8302f22ea89", "source_ip": "176.120.22.61", "source_port": 64750, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4171, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-27T16:54:06", "event_id": "315285bd-0540-4403-a526-006fc1d1be5e", "source_ip": "176.120.22.61", "source_port": 62870, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 14433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-28T22:31:54", "event_id": "539b50fc-7c89-4625-99c9-35096fd01df4", "source_ip": "176.120.22.43", "source_port": 59620, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "3a89a0cfb584ed7681562dc7c9fec664", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 259, "dest_bytes": 78, "network_bytes": 337, "event_summary": ""} +{"timestamp": "2026-08-28T19:10:21", "event_id": "0239d33d-1344-45e8-9c60-ffda3b6f8484", "source_ip": "193.143.1.66", "source_port": 31464, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3397, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:10:21", "event_id": "517a4300-7b76-4581-908e-da755838f81a", "source_ip": "193.143.1.66", "source_port": 30528, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3397, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:10:21", "event_id": "d5159e18-5898-4529-b6d5-99715838688f", "source_ip": "193.143.1.66", "source_port": 29226, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3397, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:10:21", "event_id": "aa1d2902-0fbf-4cb5-b715-a1f531982061", "source_ip": "193.143.1.66", "source_port": 31414, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3394, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:10:21", "event_id": "1574c814-c7f9-4e8d-8062-04578aed52f7", "source_ip": "193.143.1.66", "source_port": 30337, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3394, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:10:20", "event_id": "a8b066ec-b471-4012-b41a-c4c9b26984e0", "source_ip": "193.143.1.66", "source_port": 29224, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3394, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:09:31", "event_id": "ba3c7b04-728d-424d-8bf3-e95b728a7b9a", "source_ip": "193.143.1.66", "source_port": 18675, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3390, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:09:31", "event_id": "a992aadb-4528-4896-9823-6044761d546a", "source_ip": "193.143.1.66", "source_port": 18106, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3390, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T19:09:31", "event_id": "2ed6d639-0c95-423d-a236-f0784392d4c1", "source_ip": "193.143.1.66", "source_port": 15385, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3390, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:47:34", "event_id": "1f44a320-30bb-4155-bb3b-529ee88aabf8", "source_ip": "193.143.1.66", "source_port": 43008, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3397, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:47:34", "event_id": "1a12cb7a-7eac-4124-817b-ff3b3f029b25", "source_ip": "193.143.1.66", "source_port": 42863, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3394, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:47:33", "event_id": "f46ec8a2-f6d1-4273-978d-699709b220f9", "source_ip": "193.143.1.66", "source_port": 41630, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3397, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:47:33", "event_id": "2dbd567e-2a52-4de2-ac52-0f21b10866c4", "source_ip": "193.143.1.66", "source_port": 40655, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3397, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:47:33", "event_id": "7d92b520-9d52-40b4-a61c-c746b640a35e", "source_ip": "193.143.1.66", "source_port": 41617, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3394, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:47:33", "event_id": "8b9d50de-43ed-4532-ba96-0ff77d9abc82", "source_ip": "193.143.1.66", "source_port": 40650, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3394, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:46:51", "event_id": "34d71652-b3eb-4ba6-9b57-824c5a44386f", "source_ip": "193.143.1.66", "source_port": 39282, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3390, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:46:51", "event_id": "c7731289-e171-452a-8521-4a2685afd9fd", "source_ip": "193.143.1.66", "source_port": 38835, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3390, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T09:46:51", "event_id": "f3acb1a4-5a4d-449e-a29b-658d099d1a69", "source_ip": "193.143.1.66", "source_port": 34679, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "Moscow", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3390, "network_protocol": "", "application_protocol": "rdp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 44, "dest_bytes": 12, "network_bytes": 56, "event_summary": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T07:59:56", "event_id": "0597b410-526c-4c7d-af47-e773ff275c54", "source_ip": "176.120.22.61", "source_port": 41428, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 23341, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 26, "dest_bytes": 13, "network_bytes": 39, "event_summary": "\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\u000f\u0000\u0007\ufffd\u0000\u0000\u0002"} +{"timestamp": "2026-08-29T19:33:51", "event_id": "89946316-cb27-416c-b8af-876f4671988c", "source_ip": "176.120.22.43", "source_port": 64537, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "5a6ae6288fbcfde4161d1687a4fc3513", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 263, "dest_bytes": 78, "network_bytes": 341, "event_summary": ""} +{"timestamp": "2026-08-29T16:47:48", "event_id": "af9237dd-1a57-4088-9bf4-7cca3010aece", "source_ip": "176.120.22.43", "source_port": 50504, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 10443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:10443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "b46e867d24b4e8f6cba4c62bca323c64", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 265, "dest_bytes": 78, "network_bytes": 343, "event_summary": ""} +{"timestamp": "2026-08-29T16:44:51", "event_id": "4de75088-2a22-4a74-8736-2c40edd3a5db", "source_ip": "176.120.22.43", "source_port": 60143, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "10059e06caa2f42edba8a70ddaa0349c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 259, "dest_bytes": 78, "network_bytes": 337, "event_summary": ""} +{"timestamp": "2026-08-29T16:25:54", "event_id": "d746b530-9b31-4df4-93e6-041bfbbd1bff", "source_ip": "176.120.22.43", "source_port": 63357, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4433, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "6683e5cb0948aae53914e2ea9d0af75e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T15:40:52", "event_id": "4ee697fe-ec5d-455a-b253-3d2eb8cac2d8", "source_ip": "176.120.22.43", "source_port": 61115, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4439, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4439\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "d0129b32c9047e7ad3246f7920eb5971", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T15:37:05", "event_id": "c2801ce9-6605-4a8a-80b6-037c56999047", "source_ip": "176.120.22.43", "source_port": 51422, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "3044f8c83ee39bd394e020b929730509", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 259, "dest_bytes": 78, "network_bytes": 337, "event_summary": ""} +{"timestamp": "2026-08-29T15:27:31", "event_id": "23cfec6a-d08b-4539-b9d6-4678b6911814", "source_ip": "176.120.22.43", "source_port": 57321, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 2443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "7b0a3955854b645bd5b8b30eff9d3762", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T15:24:36", "event_id": "f9c68396-2473-4312-929d-9f0683643ee3", "source_ip": "176.120.22.43", "source_port": 54280, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "a393c3afe0dbf89c403ea58f815aee7a", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T15:21:23", "event_id": "435976fd-d30f-4e1c-85d9-32974a14e1fd", "source_ip": "176.120.22.43", "source_port": 51118, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4432, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4432\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "dbb41f7d149a32718210a3b6122b79bf", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T15:21:11", "event_id": "fb71a9c0-7a5d-4d84-91a3-daf3bf5d75cf", "source_ip": "176.120.22.43", "source_port": 58255, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4435, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4435\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "0a0909629ab2b016a0daa8e75cdc86fa", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T14:43:13", "event_id": "c421365e-4ea0-4c81-b5ac-dbeb2e156fc5", "source_ip": "176.120.22.43", "source_port": 54459, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4435, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4435\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "2f7bb26f5917a619b12f4f54312d9cf3", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T13:41:39", "event_id": "576e7408-4b1d-48de-af91-7bb01c6965ad", "source_ip": "176.120.22.43", "source_port": 60218, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "f633450e45aa2b2017bc60428e9686f8", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T13:39:50", "event_id": "fb7c534f-dea9-4994-9260-a7324853e537", "source_ip": "176.120.22.43", "source_port": 60919, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "b6072ffb73369edecc41fd2ca920adcb", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T13:26:00", "event_id": "43c89ca9-3d6c-49c7-b7a9-6e7d8999481b", "source_ip": "176.120.22.43", "source_port": 62803, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "660176adc5f2a0d6cbcf794a2989076b", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T12:50:17", "event_id": "c8468f91-bef5-4ee4-8e78-3effba01b0cd", "source_ip": "176.120.22.43", "source_port": 50152, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4434, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "c4a2ef792fca6616eceb254f4143570f", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T12:15:39", "event_id": "c0ea2ad4-feec-45e2-8ef6-ba84f9a48da1", "source_ip": "176.120.22.43", "source_port": 62142, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4436, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4436\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "3f8ae5c25f23e67cb36ab5c6157ea5b5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T12:07:32", "event_id": "4115346b-687e-4aae-b6a1-4831aae26a71", "source_ip": "176.120.22.43", "source_port": 59175, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 10443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:10443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "47456f8a08540c328fc4a903c6faa47d", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 265, "dest_bytes": 78, "network_bytes": 343, "event_summary": ""} +{"timestamp": "2026-08-29T12:03:27", "event_id": "fc112721-7cc5-48a1-aac8-3ded9d745729", "source_ip": "176.120.22.43", "source_port": 49328, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4433, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "bbf846d7f7301f733c16d281b2a197b8", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T11:34:54", "event_id": "da41e17c-0dcd-49e3-a057-9e53cdeba2d2", "source_ip": "176.120.22.43", "source_port": 60427, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 2443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "3f0db94e0d38e24d532ea0b9b983b088", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-29T11:14:43", "event_id": "704eb47a-6377-4ded-a7d5-17a95063281a", "source_ip": "176.120.22.43", "source_port": 52876, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5443, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "0ab9169a5aae946a2b9a23a0119c4b48", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0500_63d29dec8e1d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 264, "dest_bytes": 78, "network_bytes": 342, "event_summary": ""} +{"timestamp": "2026-08-30T14:00:29", "event_id": "f7c53913-ea89-45be-b603-feb65fdc3d95", "source_ip": "176.120.22.43", "source_port": 54293, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 10443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:10443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "7b431b0653be3522b70b57c06ccaf70d", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 269, "dest_bytes": 78, "network_bytes": 347, "event_summary": ""} +{"timestamp": "2026-08-30T13:57:28", "event_id": "f09a2a47-1f61-44b2-91c2-c7aea8a84a58", "source_ip": "176.120.22.43", "source_port": 62390, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "31b02e25c5273efb339e7bba65a69f9d", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 263, "dest_bytes": 78, "network_bytes": 341, "event_summary": ""} +{"timestamp": "2026-08-30T13:38:18", "event_id": "87beb273-335e-4886-af60-0f9a22593bed", "source_ip": "176.120.22.43", "source_port": 56251, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4433, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "1d70b097372d37b920ba597018b06f4c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T12:52:56", "event_id": "caebb65e-9d19-41f4-84b0-684b54be187a", "source_ip": "176.120.22.43", "source_port": 64571, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4439, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4439\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "4282b62271907c1a2d23bd1c4db40920", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T12:49:07", "event_id": "eaa1de84-b4a3-448c-9af9-9b4132693d2f", "source_ip": "176.120.22.43", "source_port": 52938, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "e445ba4c8424263d85c394c77cae613c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 263, "dest_bytes": 78, "network_bytes": 341, "event_summary": ""} +{"timestamp": "2026-08-30T12:39:21", "event_id": "5514a617-9ca7-41ed-ba92-036178abefe1", "source_ip": "176.120.22.43", "source_port": 53898, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 2443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "49db6577b76dbcc13126269051d44469", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T12:36:26", "event_id": "0ba5fffc-a290-4a3b-8900-11a38553aaa0", "source_ip": "176.120.22.43", "source_port": 65131, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "47e700b062aeb7ebd36f42e8ed020fec", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T12:33:09", "event_id": "8deb9aa9-f8d9-445a-90cc-54abbc37dca6", "source_ip": "176.120.22.43", "source_port": 59695, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4432, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4432\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "1d38eae37e77650d3c32f219f212b61d", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T12:33:01", "event_id": "46685f5e-560a-48af-b978-608ad97c1d80", "source_ip": "176.120.22.43", "source_port": 50736, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4435, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4435\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "38a95ee00d2b9695cdb13f233d975c33", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T11:54:55", "event_id": "2b9273cc-39d3-488f-9e41-7469116bc06c", "source_ip": "176.120.22.43", "source_port": 59785, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4435, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4435\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "b1afa34213cb9129efab621e53280356", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T10:53:13", "event_id": "38e74a50-d7bc-47b5-abf1-f892fb55ae4e", "source_ip": "176.120.22.43", "source_port": 52069, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 3443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "312a74dbd08a7366e69a0ca374423af9", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T10:51:22", "event_id": "67ed105e-15a2-4454-b5a1-ca7f9241b961", "source_ip": "176.120.22.43", "source_port": 52309, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "2ef83d2c668e22507a03840c431b0b64", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T10:37:28", "event_id": "69050b60-9f73-46f7-b6f4-0ad034aa425a", "source_ip": "176.120.22.43", "source_port": 63099, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "7bf4d7c6246e624b57d2dcc649188cd3", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T10:01:25", "event_id": "983197af-d073-412b-a585-c111bf1047c7", "source_ip": "176.120.22.43", "source_port": 58545, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 4434, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1010h1_61a7ad8aa9b6_3a8073edd8ef", "tls_client_ja3": "1a4a9c829647c94dfa19e8c87694b341", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn05en_3bd45b6f184e", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 268, "dest_bytes": 78, "network_bytes": 346, "event_summary": ""} +{"timestamp": "2026-08-30T09:31:13", "event_id": "f6d8d5b8-2bba-40f0-b6f6-ec2dacb486ae", "source_ip": "176.120.22.61", "source_port": 2104, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9999, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0001detector\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000pptp-check\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T09:31:13", "event_id": "1d6be3bf-e484-4d11-b184-5ace56aabc1e", "source_ip": "176.120.22.61", "source_port": 2085, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9433, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0001detector\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000pptp-check\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T09:31:13", "event_id": "6b9da5aa-85e9-467d-bb29-6d8109146813", "source_ip": "176.120.22.61", "source_port": 2072, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 9001, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0001detector\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000pptp-check\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T09:31:13", "event_id": "85c9cf05-c890-476f-8cad-d29d983e118f", "source_ip": "176.120.22.61", "source_port": 2069, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 8989, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0001detector\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000pptp-check\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T09:31:13", "event_id": "d6fe786d-a8c1-4d07-b0f6-8c2b128585a4", "source_ip": "176.120.22.61", "source_port": 2047, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 8899, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0001detector\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000pptp-check\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T09:31:13", "event_id": "54246c34-207a-42d0-9432-bd4db6e8fe07", "source_ip": "176.120.22.61", "source_port": 2036, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 8433, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0001detector\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000pptp-check\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-31T09:44:38", "event_id": "86994bef-e65b-4c9d-8337-aa2cfc41351d", "source_ip": "176.120.22.61", "source_port": 63649, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 2433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:38", "event_id": "fdfd7923-2ad3-4d6a-8efe-e7b4f14a4bde", "source_ip": "176.120.22.61", "source_port": 62335, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 14433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:38", "event_id": "4260594a-7612-45c4-9568-46f76500ebda", "source_ip": "176.120.22.61", "source_port": 63185, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 37628, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "d9cf3028-c927-4ba9-a088-9b39ad9bd0e6", "source_ip": "176.120.22.61", "source_port": 63441, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 5433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "4208a628-3d25-4a82-964b-2a543b4f15b0", "source_ip": "176.120.22.61", "source_port": 63224, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 10443, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "6e73573f-a846-4d3e-b9a1-1d0fdecb68c6", "source_ip": "176.120.22.61", "source_port": 62307, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 8899, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "ba5c1731-b5f0-4f9c-b8b0-9984c0074791", "source_ip": "176.120.22.61", "source_port": 63745, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 55366, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "45efda38-0458-4145-9023-ffdef8884fed", "source_ip": "176.120.22.61", "source_port": 62489, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 16433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "8662493f-0a6c-40f4-b7c0-a799880eeddb", "source_ip": "176.120.22.61", "source_port": 65473, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 51234, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:37", "event_id": "04824e9f-2d7a-430e-9d6b-d3e56f8ffd94", "source_ip": "176.120.22.61", "source_port": 63895, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 1501, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "8a67ad3d-e25c-43fc-b0cc-f16f2e6c5a01", "source_ip": "176.120.22.61", "source_port": 63642, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 7366, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "f8cbc6e5-bfce-49f0-802c-73c03bf7fa2f", "source_ip": "176.120.22.61", "source_port": 63777, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 8001, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "fe5f4b04-8886-4d4e-b78f-fb1e46c6bc9e", "source_ip": "176.120.22.61", "source_port": 63833, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 61433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "a90d5ebb-a492-450b-b8dd-a51ff9d1b1bb", "source_ip": "176.120.22.61", "source_port": 62312, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 11443, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "2b90cb66-b34f-4439-90c1-8122216b3a2e", "source_ip": "176.120.22.61", "source_port": 64064, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 6433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "986c34e2-fc73-479d-ab26-ed39f3b93a9d", "source_ip": "176.120.22.61", "source_port": 64590, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 6802, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "bb880e9d-01c4-48a3-b7c5-c54690fd6b84", "source_ip": "176.120.22.61", "source_port": 64290, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 25366, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "df97152d-6f04-4d9c-85ca-cb852feaca40", "source_ip": "176.120.22.61", "source_port": 62479, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 6602, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "2af57e95-bb61-4f55-a7f2-24a2d7f7a08e", "source_ip": "176.120.22.61", "source_port": 64589, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 19433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} +{"timestamp": "2026-08-31T09:44:36", "event_id": "6ee75613-5e61-44e2-9356-87c2d7af9a19", "source_ip": "176.120.22.61", "source_port": 62171, "source_domain": "", "country_code": "RU", "country_name": "Russia", "city_name": "", "asn_number": 198953, "asn_org": "Proton66 OOO", "dest_port": 27433, "network_protocol": "", "application_protocol": "mssql-tds", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 94, "dest_bytes": 13, "network_bytes": 107, "event_summary": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\u0007\f\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0000\u0000\ufffdq>\ufffd\ufffd\u007f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0001"} diff --git a/kevlar/2026-08-31/honeylabs/events-AS200593.ndjson b/kevlar/2026-08-31/honeylabs/events-AS200593.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS200593.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS200651.ndjson b/kevlar/2026-08-31/honeylabs/events-AS200651.ndjson new file mode 100644 index 0000000..4553dee --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS200651.ndjson @@ -0,0 +1,12 @@ +{"timestamp": "2026-08-24T19:48:42", "event_id": "34b4f6af-eb90-44db-9e60-f350a6de848e", "source_ip": "185.100.87.136", "source_port": 55302, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 2222, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 231000000, "source_bytes": 888, "dest_bytes": 14, "network_bytes": 902, "event_summary": "SSH-2.0-OpenSSH_10.2p1\r\n\u0000\u0000\u0003\\\u0010\u0014\ufffd5(f\ufffd\u0001\ufffdA\ufffdP\ufffd\ufffd\u074a\u0013:\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0000Aecdsa-sha2-nistp256,ssh-rsa,rsa-sha2-512,rsa-sha2-256,ssh-ed25519\u0000\u0000\u0000\ufffdchacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000\ufffdchacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000x\ufffd\ufffd\ufffd\u000b\u069dp3\u001b\ufffd)\ufffdU-\ufffd"} +{"timestamp": "2026-08-24T18:23:10", "event_id": "ad536f82-0928-405b-a30b-c2f7141fb572", "source_ip": "185.100.87.136", "source_port": 37914, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 2222, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 145000000, "source_bytes": 888, "dest_bytes": 14, "network_bytes": 902, "event_summary": "SSH-2.0-OpenSSH_10.2p1\r\n\u0000\u0000\u0003\\\u0010\u0014\ufffd\ufffdw\ufffd0\b\u0004UA\ufffd-(\ufffd\ufffdV\ufffd\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0000Aecdsa-sha2-nistp256,ssh-rsa,rsa-sha2-512,rsa-sha2-256,ssh-ed25519\u0000\u0000\u0000\ufffdchacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000\ufffdchacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000*\ufffd\u3083>Ph\ufffdx\ufffd\ufffd9\ufffd\u0016\ufffd"} +{"timestamp": "2026-08-24T15:18:35", "event_id": "78cd8b8f-6acc-4627-bdf1-1c8f65a4b17b", "source_ip": "185.100.87.136", "source_port": 60692, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "", "application_protocol": "http", "http_method": "POST", "user_agent": "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", "url_path": "/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\"<HONEYPOT>:443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "po11nn0600_c9506d37ac14", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 741, "dest_bytes": 79, "network_bytes": 820, "event_summary": ""} +{"timestamp": "2026-08-24T15:18:34", "event_id": "08f3a2a7-c0eb-4d09-8509-78dc0eb957f7", "source_ip": "185.100.87.136", "source_port": 60688, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 181, "dest_bytes": 79, "network_bytes": 260, "event_summary": ""} +{"timestamp": "2026-08-25T11:45:33", "event_id": "8652ea7f-db7d-4ed3-8a54-5e0f6bc1ca98", "source_ip": "185.100.87.136", "source_port": 55660, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 8443, "network_protocol": "", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/api/checkin", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "po11nn0500_e4a47a99f1ac", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 213, "dest_bytes": 79, "network_bytes": 292, "event_summary": ""} +{"timestamp": "2026-08-25T10:42:31", "event_id": "7e41c811-753f-4c98-8b19-f7585e520c3d", "source_ip": "185.100.87.136", "source_port": 45876, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 8443, "network_protocol": "", "application_protocol": "http", "http_method": "POST", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/api/checkin", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "po11nn0500_e4a47a99f1ac", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 214, "dest_bytes": 79, "network_bytes": 293, "event_summary": ""} +{"timestamp": "2026-08-28T17:03:24", "event_id": "f3977816-21ce-42b8-8f11-ce64da6791df", "source_ip": "185.100.87.136", "source_port": 56908, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", "url_path": "/eventmanager", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 167, "dest_bytes": 79, "network_bytes": 246, "event_summary": ""} +{"timestamp": "2026-08-28T13:29:27", "event_id": "e11669e7-f035-4e1e-abae-98d5aa790e5d", "source_ip": "185.100.87.136", "source_port": 46970, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", "url_path": "/eventmanager", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-28T13:22:03", "event_id": "1a56d90d-0ea4-41c1-8a1f-28aa363a0f16", "source_ip": "185.100.87.136", "source_port": 39796, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", "url_path": "/eventmanager", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-31T06:06:56", "event_id": "7ae2542a-f64f-4c51-903f-b2274cc16211", "source_ip": "185.100.87.136", "source_port": 47020, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", "url_path": "/images/transparentpix.gif", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 243, "dest_bytes": 79, "network_bytes": 322, "event_summary": ""} +{"timestamp": "2026-08-31T05:00:49", "event_id": "32bde13b-d088-49bf-9f4b-c07080faae72", "source_ip": "185.100.87.136", "source_port": 54264, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", "url_path": "/images/transparentpix.gif", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 242, "dest_bytes": 79, "network_bytes": 321, "event_summary": ""} +{"timestamp": "2026-08-31T01:12:02", "event_id": "4486ee38-07be-4f89-af15-2474d6d06b49", "source_ip": "185.100.87.136", "source_port": 41682, "source_domain": "", "country_code": "RO", "country_name": "Romania", "city_name": "Bucharest", "asn_number": 200651, "asn_org": "FlokiNET ehf", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", "url_path": "/images/transparentpix.gif", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 242, "dest_bytes": 79, "network_bytes": 321, "event_summary": ""} diff --git a/kevlar/2026-08-31/honeylabs/events-AS202685.ndjson b/kevlar/2026-08-31/honeylabs/events-AS202685.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS202685.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS206728.ndjson b/kevlar/2026-08-31/honeylabs/events-AS206728.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS206728.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS209847.ndjson b/kevlar/2026-08-31/honeylabs/events-AS209847.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS209847.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS210644.ndjson b/kevlar/2026-08-31/honeylabs/events-AS210644.ndjson new file mode 100644 index 0000000..b9ce07c --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS210644.ndjson @@ -0,0 +1,44 @@ +{"timestamp": "2026-08-27T20:36:08", "event_id": "99eb9f4b-e854-4b81-bf3b-b539d4718e85", "source_ip": "217.144.190.138", "source_port": 37966, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 6363, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6363\",\"user-agent\":\"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 112000000, "source_bytes": 238, "dest_bytes": 80, "network_bytes": 318, "event_summary": ""} +{"timestamp": "2026-08-27T20:36:08", "event_id": "74d246ba-7d1f-4843-b3a0-6e3784a7ee58", "source_ip": "217.144.190.138", "source_port": 37950, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 6363, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6363\",\"user-agent\":\"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 227, "dest_bytes": 80, "network_bytes": 307, "event_summary": ""} +{"timestamp": "2026-08-27T20:35:09", "event_id": "fe1a2ae3-da08-4ed9-994b-29c56ab18489", "source_ip": "217.144.190.138", "source_port": 48222, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 6363, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6363\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 210, "dest_bytes": 80, "network_bytes": 290, "event_summary": ""} +{"timestamp": "2026-08-27T18:50:16", "event_id": "c5dd8381-ef5e-4346-97da-e7eb0b72c21f", "source_ip": "217.144.190.138", "source_port": 55096, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 105000000, "source_bytes": 249, "dest_bytes": 80, "network_bytes": 329, "event_summary": ""} +{"timestamp": "2026-08-27T18:50:16", "event_id": "972705bf-20f1-4583-8020-29be323a2f62", "source_ip": "217.144.190.138", "source_port": 55084, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 238, "dest_bytes": 80, "network_bytes": 318, "event_summary": ""} +{"timestamp": "2026-08-27T18:49:23", "event_id": "d22753a5-4f1b-4cc5-a27d-c76fc27ec431", "source_ip": "217.144.190.138", "source_port": 44554, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 210, "dest_bytes": 80, "network_bytes": 290, "event_summary": ""} +{"timestamp": "2026-08-27T18:31:31", "event_id": "e7fd6a75-2478-4831-9192-29290da36304", "source_ip": "217.144.190.138", "source_port": 44876, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 198000000, "source_bytes": 213, "dest_bytes": 80, "network_bytes": 293, "event_summary": ""} +{"timestamp": "2026-08-27T18:31:30", "event_id": "f785b8ca-9844-423d-bde3-4baf90ee0a41", "source_ip": "217.144.190.138", "source_port": 44870, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 200000000, "source_bytes": 202, "dest_bytes": 80, "network_bytes": 282, "event_summary": ""} +{"timestamp": "2026-08-27T18:30:43", "event_id": "32cf3709-d55b-4827-81f7-a93e5a995c17", "source_ip": "217.144.190.138", "source_port": 36804, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 209, "dest_bytes": 80, "network_bytes": 289, "event_summary": ""} +{"timestamp": "2026-08-27T15:11:50", "event_id": "af7af21b-2175-43f3-b8b1-04e7a5f0e077", "source_ip": "217.144.190.138", "source_port": 38514, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8989, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8989\",\"user-agent\":\"Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 197000000, "source_bytes": 206, "dest_bytes": 80, "network_bytes": 286, "event_summary": ""} +{"timestamp": "2026-08-27T15:11:49", "event_id": "5ffec258-ad81-4e59-8e54-05642a3b9b66", "source_ip": "217.144.190.138", "source_port": 38496, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8989, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8989\",\"user-agent\":\"Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 202000000, "source_bytes": 195, "dest_bytes": 80, "network_bytes": 275, "event_summary": ""} +{"timestamp": "2026-08-27T15:10:55", "event_id": "d296eb7c-61ce-4814-92fb-b249414a914e", "source_ip": "217.144.190.138", "source_port": 54030, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8989, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8989\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 209, "dest_bytes": 80, "network_bytes": 289, "event_summary": ""} +{"timestamp": "2026-08-28T22:22:51", "event_id": "eaeb173c-27e1-4e77-95b0-a3933928b498", "source_ip": "147.45.71.214", "source_port": 49820, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 202000000, "source_bytes": 233, "dest_bytes": 78, "network_bytes": 311, "event_summary": ""} +{"timestamp": "2026-08-28T22:22:50", "event_id": "dbcfbf12-17b2-4bc3-8410-9c03a475c020", "source_ip": "147.45.71.214", "source_port": 49804, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 236000000, "source_bytes": 222, "dest_bytes": 78, "network_bytes": 300, "event_summary": ""} +{"timestamp": "2026-08-28T22:20:13", "event_id": "dfb170dd-5387-4201-9c64-292704031b23", "source_ip": "147.45.71.214", "source_port": 57450, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 209, "dest_bytes": 78, "network_bytes": 287, "event_summary": ""} +{"timestamp": "2026-08-28T20:38:07", "event_id": "eb9f92d3-ef6b-40b2-a719-e7048422ab2b", "source_ip": "147.45.71.214", "source_port": 34778, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8081, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 211000000, "source_bytes": 252, "dest_bytes": 78, "network_bytes": 330, "event_summary": ""} +{"timestamp": "2026-08-28T20:38:06", "event_id": "d458170d-3f2a-4c80-a842-11e61fb9a269", "source_ip": "147.45.71.214", "source_port": 34758, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8081, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 203000000, "source_bytes": 241, "dest_bytes": 78, "network_bytes": 319, "event_summary": ""} +{"timestamp": "2026-08-28T20:36:52", "event_id": "1ba0ed2b-312f-4af5-adbb-1e5409713984", "source_ip": "147.45.71.214", "source_port": 50546, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8081, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 209, "dest_bytes": 78, "network_bytes": 287, "event_summary": ""} +{"timestamp": "2026-08-28T20:15:36", "event_id": "9522a6f4-39ac-4d1e-9d04-4cdcdf6d31d3", "source_ip": "147.45.71.214", "source_port": 33712, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8090, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 206000000, "source_bytes": 201, "dest_bytes": 78, "network_bytes": 279, "event_summary": ""} +{"timestamp": "2026-08-28T20:15:34", "event_id": "68ef2598-2a05-4b89-bcbc-a917834ea939", "source_ip": "147.45.71.214", "source_port": 33694, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8090, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 213000000, "source_bytes": 190, "dest_bytes": 78, "network_bytes": 268, "event_summary": ""} +{"timestamp": "2026-08-28T20:14:49", "event_id": "c81d2387-96f2-497d-a1e4-e47901c27cb9", "source_ip": "147.45.71.214", "source_port": 33586, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8090, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 209, "dest_bytes": 78, "network_bytes": 287, "event_summary": ""} +{"timestamp": "2026-08-28T14:20:32", "event_id": "dab653d9-a1e2-46c2-842f-b6cf6e1f7636", "source_ip": "176.124.203.177", "source_port": 44280, "source_domain": "", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Amsterdam", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 18190, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 3, "event_duration": 404000000, "source_bytes": 31, "dest_bytes": 45, "network_bytes": 76, "event_summary": "\u0000\u0000\u0000\u0001\u0000"} +{"timestamp": "2026-08-29T08:27:41", "event_id": "452ac326-661c-45c8-99e6-d91d3c3e1f54", "source_ip": "147.45.71.214", "source_port": 52038, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/v1/getinfo", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 219, "dest_bytes": 78, "network_bytes": 297, "event_summary": ""} +{"timestamp": "2026-08-29T08:24:45", "event_id": "8b6bc71a-24f2-46b7-a361-ed8a19b2d3fe", "source_ip": "147.45.71.214", "source_port": 42660, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/v1/getinfo", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 219, "dest_bytes": 78, "network_bytes": 297, "event_summary": ""} +{"timestamp": "2026-08-29T07:39:10", "event_id": "4fccdda3-2b6e-4dca-8818-7081b438ddfc", "source_ip": "147.45.71.214", "source_port": 52300, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/v1/getinfo", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 220, "dest_bytes": 78, "network_bytes": 298, "event_summary": ""} +{"timestamp": "2026-08-29T06:04:48", "event_id": "52081089-bf67-40d3-a78f-16e09d7cb014", "source_ip": "147.45.71.214", "source_port": 59232, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 106000000, "source_bytes": 253, "dest_bytes": 78, "network_bytes": 331, "event_summary": ""} +{"timestamp": "2026-08-29T06:04:48", "event_id": "e09ac5a8-7a4f-486d-b3ca-f7d87d3c873e", "source_ip": "147.45.71.214", "source_port": 39386, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 106000000, "source_bytes": 242, "dest_bytes": 78, "network_bytes": 320, "event_summary": ""} +{"timestamp": "2026-08-29T06:03:27", "event_id": "9047e065-df4f-4b23-9065-a1e703204410", "source_ip": "147.45.71.214", "source_port": 58140, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8080, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 210, "dest_bytes": 78, "network_bytes": 288, "event_summary": ""} +{"timestamp": "2026-08-29T04:07:32", "event_id": "1cace572-a2ff-44c9-acb0-2bf8961c7d17", "source_ip": "147.45.71.214", "source_port": 57844, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8989, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8989\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 124000000, "source_bytes": 254, "dest_bytes": 78, "network_bytes": 332, "event_summary": ""} +{"timestamp": "2026-08-29T04:07:32", "event_id": "a08bd56e-59af-42a6-a118-3a85964fb3a1", "source_ip": "147.45.71.214", "source_port": 57834, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8989, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8989\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 134000000, "source_bytes": 243, "dest_bytes": 78, "network_bytes": 321, "event_summary": ""} +{"timestamp": "2026-08-29T04:07:14", "event_id": "d05badbf-645f-401d-bfcc-8b704e383b14", "source_ip": "147.45.71.214", "source_port": 55904, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8989, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8989\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 211, "dest_bytes": 78, "network_bytes": 289, "event_summary": ""} +{"timestamp": "2026-08-29T03:32:41", "event_id": "fbd5ddec-a5c3-4b3d-afec-758a257d7a3a", "source_ip": "147.45.71.214", "source_port": 49148, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8085, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.27", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.27\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 202000000, "source_bytes": 250, "dest_bytes": 78, "network_bytes": 328, "event_summary": ""} +{"timestamp": "2026-08-29T03:32:40", "event_id": "bd3d5954-de6e-46d3-baae-bd5cfb4feba3", "source_ip": "147.45.71.214", "source_port": 49132, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8085, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.27", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.27\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 201000000, "source_bytes": 239, "dest_bytes": 78, "network_bytes": 317, "event_summary": ""} +{"timestamp": "2026-08-29T03:32:00", "event_id": "78b4ade9-69f2-46b2-afd5-2722e11a7c05", "source_ip": "147.45.71.214", "source_port": 50252, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8085, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 209, "dest_bytes": 78, "network_bytes": 287, "event_summary": ""} +{"timestamp": "2026-08-29T03:05:59", "event_id": "413cfb69-f8e4-4fb6-a6c2-45fd078b39e4", "source_ip": "147.45.71.214", "source_port": 46990, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8085, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.45", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.45\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 127000000, "source_bytes": 254, "dest_bytes": 78, "network_bytes": 332, "event_summary": ""} +{"timestamp": "2026-08-29T03:05:58", "event_id": "4828d7f6-e092-4791-a997-419423c95f3f", "source_ip": "147.45.71.214", "source_port": 46980, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8085, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.45", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.45\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 175000000, "source_bytes": 243, "dest_bytes": 78, "network_bytes": 321, "event_summary": ""} +{"timestamp": "2026-08-29T03:05:40", "event_id": "66c6f6eb-6fb5-458c-8667-281f2236da98", "source_ip": "147.45.71.214", "source_port": 38182, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8085, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 211, "dest_bytes": 78, "network_bytes": 289, "event_summary": ""} +{"timestamp": "2026-08-29T02:09:01", "event_id": "da17f1bc-fb43-4c5f-b5a4-61aa8635e17d", "source_ip": "147.45.71.214", "source_port": 54992, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 208000000, "source_bytes": 248, "dest_bytes": 78, "network_bytes": 326, "event_summary": ""} +{"timestamp": "2026-08-29T02:09:00", "event_id": "0dcdd1fb-fe01-40bb-b5ba-94cdd53bc572", "source_ip": "147.45.71.214", "source_port": 54968, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 201000000, "source_bytes": 237, "dest_bytes": 78, "network_bytes": 315, "event_summary": ""} +{"timestamp": "2026-08-29T02:07:54", "event_id": "16138719-1b2c-411b-b647-056774048da5", "source_ip": "147.45.71.214", "source_port": 60240, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8999, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8999\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 209, "dest_bytes": 78, "network_bytes": 287, "event_summary": ""} +{"timestamp": "2026-08-29T01:34:42", "event_id": "3172cd8e-c4e0-4436-868d-a2ec8fab8189", "source_ip": "147.45.71.214", "source_port": 57030, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8090, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", "url_path": "/favicon.ico", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 201000000, "source_bytes": 237, "dest_bytes": 78, "network_bytes": 315, "event_summary": ""} +{"timestamp": "2026-08-29T01:34:41", "event_id": "08303f7e-da8d-4c6c-abd5-b98cc25b5fa0", "source_ip": "147.45.71.214", "source_port": 57000, "source_domain": "", "country_code": "AT", "country_name": "Austria", "city_name": "Vienna", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8090, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t12i130500_2d7513195f68_e51b7354d87f", "tls_client_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_client_version": "TLSv1.2", "tls_client_cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 201000000, "source_bytes": 226, "dest_bytes": 78, "network_bytes": 304, "event_summary": ""} +{"timestamp": "2026-08-30T20:27:15", "event_id": "c7a09daf-794e-4e6c-875f-a23aadbed443", "source_ip": "185.246.217.150", "source_port": 44276, "source_domain": "", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Amsterdam", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 2222, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "19532158b559096b89b1a5f7d17175b2", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 139000000, "source_bytes": 1536, "dest_bytes": 15, "network_bytes": 1551, "event_summary": "SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005\ufffd\u000b\u0014KI=\ufffd\rO\ufffd\ufffd\ufffdfQWHL\ufffd<\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000\ufffdchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000\ufffdchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000\ufffdhmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\ufffdhmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00001\ufffd\u0011Q~n\ufffd\ufffd\ufffd\u0006\ufffd"} +{"timestamp": "2026-08-30T05:00:51", "event_id": "2c1ba5cf-f75b-440c-a1eb-39192e3de713", "source_ip": "176.124.203.177", "source_port": 60706, "source_domain": "", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Amsterdam", "asn_number": 210644, "asn_org": "Aeza Group LLC", "dest_port": 8443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 17_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 17_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190900_9dc949149365_e7c285222651", "tls_client_ja3": "d6828e30ab66774a91a96ae93be4ae4c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 238, "dest_bytes": 80, "network_bytes": 318, "event_summary": ""} diff --git a/kevlar/2026-08-31/honeylabs/events-AS211720.ndjson b/kevlar/2026-08-31/honeylabs/events-AS211720.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS211720.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS213702.ndjson b/kevlar/2026-08-31/honeylabs/events-AS213702.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS213702.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS214351.ndjson b/kevlar/2026-08-31/honeylabs/events-AS214351.ndjson new file mode 100644 index 0000000..e665127 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS214351.ndjson @@ -0,0 +1,6 @@ +{"timestamp": "2026-08-25T12:21:01", "event_id": "b68b7636-392d-4ed4-873d-d7a7ab61c4b0", "source_ip": "192.162.199.180", "source_port": 44144, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 214351, "asn_org": "Femo It Solutions Limited", "dest_port": 11434, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "python-requests/2.22.0", "url_path": "/api/tags", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"python-requests/2.22.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_2d30dc89d981", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 157, "dest_bytes": 80, "network_bytes": 237, "event_summary": ""} +{"timestamp": "2026-08-25T12:21:00", "event_id": "43b46cf8-d9da-45ef-9696-cc69a9c990fe", "source_ip": "192.162.199.180", "source_port": 44140, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 214351, "asn_org": "Femo It Solutions Limited", "dest_port": 11434, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "python-requests/2.22.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"python-requests/2.22.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_2d30dc89d981", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 149, "dest_bytes": 80, "network_bytes": 229, "event_summary": ""} +{"timestamp": "2026-08-25T10:23:24", "event_id": "41e4cda4-0fa0-4867-9e67-ec18fa138fc1", "source_ip": "62.60.226.150", "source_port": 34400, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 214351, "asn_org": "Femo It Solutions Limited", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T12:55:20", "event_id": "82dc696d-827c-42fb-87dd-c6ef5e0a4bfd", "source_ip": "62.60.226.150", "source_port": 58792, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 214351, "asn_org": "Femo It Solutions Limited", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T02:37:34", "event_id": "276d19a2-b2a6-42c6-9717-04a1ca480235", "source_ip": "62.60.226.150", "source_port": 34272, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 214351, "asn_org": "Femo It Solutions Limited", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T22:58:01", "event_id": "689d6c5c-515d-4056-ae47-b93d36c7b6d4", "source_ip": "62.60.226.150", "source_port": 55544, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 214351, "asn_org": "Femo It Solutions Limited", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 13, "network_bytes": 169, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} diff --git a/kevlar/2026-08-31/honeylabs/events-AS214940.ndjson b/kevlar/2026-08-31/honeylabs/events-AS214940.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS214940.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS216139.ndjson b/kevlar/2026-08-31/honeylabs/events-AS216139.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS216139.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS216246.ndjson b/kevlar/2026-08-31/honeylabs/events-AS216246.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS216246.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS216309.ndjson b/kevlar/2026-08-31/honeylabs/events-AS216309.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS216309.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS30823.ndjson b/kevlar/2026-08-31/honeylabs/events-AS30823.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS30823.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS33993.ndjson b/kevlar/2026-08-31/honeylabs/events-AS33993.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS33993.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS394711.ndjson b/kevlar/2026-08-31/honeylabs/events-AS394711.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS394711.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS400992.ndjson b/kevlar/2026-08-31/honeylabs/events-AS400992.ndjson new file mode 100644 index 0000000..6febabe --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS400992.ndjson @@ -0,0 +1 @@ +{"timestamp": "2026-08-30T15:38:28", "event_id": "098ea664-7e47-4ee2-b41a-1f9fb543395f", "source_ip": "194.48.142.134", "source_port": 54390, "source_domain": "", "country_code": "DE", "country_name": "Germany", "city_name": "Frankfurt am Main", "asn_number": 400992, "asn_org": "ZhouyiSat Communications", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 14, "network_bytes": 36, "event_summary": "\u0013\u0000/\r<HONEYPOT>c\ufffd\u0001\u0001\u0000"} diff --git a/kevlar/2026-08-31/honeylabs/events-AS51396.ndjson b/kevlar/2026-08-31/honeylabs/events-AS51396.ndjson new file mode 100644 index 0000000..a737ed8 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS51396.ndjson @@ -0,0 +1,156 @@ +{"timestamp": "2026-08-24T23:49:52", "event_id": "6420f476-f79c-4731-9f9c-496bbec2dc70", "source_ip": "176.65.149.27", "source_port": 58898, "source_domain": "176.65.149.27.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 37756, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 111000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-24T23:49:44", "event_id": "50df1100-4026-4dd0-96a5-b35c54497857", "source_ip": "176.65.149.212", "source_port": 38490, "source_domain": "176.65.149.212.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7737, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 119000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-24T23:46:41", "event_id": "0708de21-146e-4a00-b481-321983afa4cb", "source_ip": "45.135.194.113", "source_port": 37984, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7891, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-24T23:46:41", "event_id": "5282d73d-3be5-42c6-9f5f-9f241130b190", "source_ip": "45.135.194.113", "source_port": 37982, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7891, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-24T23:46:41", "event_id": "65926a98-a725-407b-937e-6f8252a39699", "source_ip": "45.135.194.113", "source_port": 37962, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7891, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-24T23:46:41", "event_id": "399f316a-3ef7-4037-bf07-39d4d0fd0329", "source_ip": "45.135.194.113", "source_port": 37968, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7891, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-24T23:46:36", "event_id": "a358f110-d86e-452f-888e-423259cf47ea", "source_ip": "94.183.174.77", "source_port": 41094, "source_domain": "vmfrost.net", "country_code": "AE", "country_name": "United Arab Emirates", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 5555, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 258, "dest_bytes": 13, "network_bytes": 271, "event_summary": "CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\ufffd\u0000\u0000\u0000D[\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,openscreen_mdns"} +{"timestamp": "2026-08-24T23:36:24", "event_id": "5d944171-3c07-4849-a760-9fd2da390fe1", "source_ip": "176.65.149.64", "source_port": 56752, "source_domain": "176.65.149.64.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 18079, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 147000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-24T23:29:59", "event_id": "72dd8c43-b778-4fa2-b07b-8bae3de665fb", "source_ip": "176.65.149.30", "source_port": 48992, "source_domain": "176.65.149.30.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31733, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 113000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-24T23:26:42", "event_id": "ef682699-1266-47f4-82f2-41574d346579", "source_ip": "176.65.148.29", "source_port": 44372, "source_domain": "176.65.148.29.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8332, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1, "dest_bytes": 13, "network_bytes": 14, "event_summary": "\n"} +{"timestamp": "2026-08-24T23:25:41", "event_id": "e56ca2f9-df41-4d12-9790-7dd59cdf4ee2", "source_ip": "176.65.149.236", "source_port": 18827, "source_domain": "176.65.149.236.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 9999, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 zgrab/0.x", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9999\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 114, "dest_bytes": 79, "network_bytes": 193, "event_summary": ""} +{"timestamp": "2026-08-24T23:19:41", "event_id": "9c655320-8baa-43f9-b35a-ccfc6ad1bb96", "source_ip": "204.76.203.7", "source_port": 44116, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49210, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-24T23:19:14", "event_id": "a1560adb-3946-4467-91e8-9ffab5b75e69", "source_ip": "204.76.203.7", "source_port": 52866, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49210, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-24T23:17:50", "event_id": "4390741d-fc62-4c60-a7f0-fd6b0b5734c9", "source_ip": "204.76.203.7", "source_port": 53948, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49210, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-24T23:17:01", "event_id": "9e1fcf2a-7111-4837-9880-719cdbdc4d71", "source_ip": "204.76.203.7", "source_port": 32784, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49210, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-24T23:16:36", "event_id": "8ea8db2b-6f6a-4721-91af-b0764e975579", "source_ip": "204.76.203.7", "source_port": 47550, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49210, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-24T23:15:23", "event_id": "611aaf29-b790-42c6-ae04-a7149885d47a", "source_ip": "204.76.203.7", "source_port": 37770, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49210, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-24T23:14:49", "event_id": "93db399c-1945-4a4a-8053-aee1bd3776f7", "source_ip": "176.65.149.230", "source_port": 36184, "source_domain": "176.65.149.230.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 55737, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-24T23:06:17", "event_id": "72e8614d-4eb5-49be-aada-d120ca82c991", "source_ip": "176.65.149.31", "source_port": 33922, "source_domain": "176.65.149.31.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 1642, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 114000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-24T23:01:58", "event_id": "c07a67b4-55b1-4e83-b8d1-ce562626c7a1", "source_ip": "204.76.203.49", "source_port": 47984, "source_domain": "204.76.203.49.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8080, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 13, "network_bytes": 16, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-25T23:47:46", "event_id": "a1e89135-1171-49b0-8652-5584bd5b0500", "source_ip": "176.65.148.226", "source_port": 53932, "source_domain": "176.65.148.226.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8265, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "url_path": "/api/version", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8265\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i140900_cbb2034c60b8_e7c285222651", "tls_client_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_cac2c496544b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 186, "dest_bytes": 79, "network_bytes": 265, "event_summary": ""} +{"timestamp": "2026-08-25T23:47:46", "event_id": "cf2c9611-13f3-4e5d-aa65-3bc9dd69cc5c", "source_ip": "176.65.148.226", "source_port": 53926, "source_domain": "176.65.148.226.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8265, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "url_path": "/api/version", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8265\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_cac2c496544b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 186, "dest_bytes": 79, "network_bytes": 265, "event_summary": ""} +{"timestamp": "2026-08-25T23:42:14", "event_id": "18efd0b0-50ab-4d20-8a76-78542e79082c", "source_ip": "176.65.149.212", "source_port": 58602, "source_domain": "176.65.149.212.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7760, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-25T23:42:01", "event_id": "784bd72e-0ccf-4ad9-b63a-2b86c83980ef", "source_ip": "45.135.194.113", "source_port": 36738, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7897, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-25T23:42:01", "event_id": "a53d3e74-9cd8-4ed6-a089-d3e70c9b5109", "source_ip": "45.135.194.113", "source_port": 36748, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7897, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-25T23:42:00", "event_id": "4652d82b-13f2-4053-a27e-6ad3a71053ba", "source_ip": "45.135.194.113", "source_port": 36736, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7897, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-25T23:42:00", "event_id": "c3a671d6-205a-424b-8b1d-5f409d9e5815", "source_ip": "45.135.194.113", "source_port": 36726, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7897, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-25T23:32:33", "event_id": "d3a0077c-c72e-44cf-aaaa-a4cc00f95bdb", "source_ip": "176.65.149.27", "source_port": 55136, "source_domain": "176.65.149.27.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 37778, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 316000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "7a521454-64e1-4f10-873f-475d95398e83", "source_ip": "45.135.193.193", "source_port": 43070, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8080, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "e63f28be-2b44-45bb-be31-1f5d748f6cc5", "source_ip": "45.135.193.193", "source_port": 50008, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8000, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "70a36fc8-55c4-40e0-aa5d-63e83bc75528", "source_ip": "45.135.193.193", "source_port": 50618, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 3128, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "985110cd-e6e8-4d4b-bf71-2ce306389592", "source_ip": "45.135.193.193", "source_port": 41958, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 443, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "f513889c-5ad1-4094-8768-dcd14105b73b", "source_ip": "45.135.193.193", "source_port": 40436, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 80, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "f83d6d9d-bb94-4f4f-9a64-f90b00c5df28", "source_ip": "45.135.193.193", "source_port": 47426, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8888, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "4e9fc04f-73ba-47fc-bad4-cb1223fe8e2f", "source_ip": "45.135.193.193", "source_port": 38404, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8081, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:56", "event_id": "1ed02798-829b-4179-a474-bbad9450bfcc", "source_ip": "45.135.193.193", "source_port": 59682, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 81, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-25T23:30:54", "event_id": "54fbc312-a3ec-407f-a413-1bd497b23aaf", "source_ip": "204.76.203.7", "source_port": 41968, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 48049, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-25T23:29:53", "event_id": "f5009830-c17e-4b91-9231-e3415d4d7982", "source_ip": "204.76.203.7", "source_port": 40860, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 48049, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-25T23:29:25", "event_id": "1630e1b5-7734-48cc-9950-63fc653ce8a4", "source_ip": "204.76.203.7", "source_port": 41774, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 48049, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-25T23:28:51", "event_id": "9d3c1483-328a-4b9e-95bd-012767641eab", "source_ip": "204.76.203.7", "source_port": 53648, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 48049, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T23:58:04", "event_id": "3d2e3701-82bb-42a5-8071-65bf2155adb7", "source_ip": "204.76.203.7", "source_port": 54546, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41857, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-26T23:57:05", "event_id": "0012d972-8e1e-412f-b1d7-97b1ff81a69b", "source_ip": "204.76.203.7", "source_port": 36498, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41857, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-26T23:57:04", "event_id": "5ed2cd2a-2d31-47b5-8730-7c4a82f7a9ae", "source_ip": "204.76.203.7", "source_port": 35278, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41857, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-26T23:55:50", "event_id": "51db39d8-7526-4a9b-916b-d7659e92f298", "source_ip": "204.76.203.7", "source_port": 44764, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41857, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T23:54:44", "event_id": "4eae4685-3b57-4e52-a759-749d82b6174e", "source_ip": "204.76.203.7", "source_port": 59720, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41857, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T23:54:42", "event_id": "481650ec-3fb5-48b9-b084-26722086bfd4", "source_ip": "204.76.203.7", "source_port": 52532, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41857, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T23:45:15", "event_id": "189f58ab-35ba-42fc-9125-68ff224070ed", "source_ip": "176.65.148.226", "source_port": 35452, "source_domain": "176.65.148.226.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8161, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "url_path": "/api/jolokia/version", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8161\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_cac2c496544b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 103000000, "source_bytes": 194, "dest_bytes": 79, "network_bytes": 273, "event_summary": ""} +{"timestamp": "2026-08-26T23:44:17", "event_id": "87c3bdc0-414d-4bac-aa08-5ad328ceaf0d", "source_ip": "176.65.149.31", "source_port": 51104, "source_domain": "176.65.149.31.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 1687, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-26T23:35:50", "event_id": "eff86a98-da82-4eb5-b737-b19bdf11bfbf", "source_ip": "176.65.149.64", "source_port": 53980, "source_domain": "176.65.149.64.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 18128, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 118000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-26T23:30:26", "event_id": "9f1770b8-dabd-45cd-8cc7-d1080e1b08c5", "source_ip": "45.135.194.99", "source_port": 53818, "source_domain": "45.135.194.99.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 3128, "network_protocol": "", "application_protocol": "google", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 89, "dest_bytes": 13, "network_bytes": 102, "event_summary": "CONNECT google.com:443 HTTP/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n"} +{"timestamp": "2026-08-26T23:16:35", "event_id": "fd76b50d-8aa0-45b0-8702-7293bf20699a", "source_ip": "176.65.149.67", "source_port": 43586, "source_domain": "176.65.149.67.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 14334, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-26T23:00:20", "event_id": "ef8e64c8-7e17-4e5d-9632-019d0e7945fb", "source_ip": "176.65.148.96", "source_port": 58514, "source_domain": "176.65.148.96.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8545, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1, "dest_bytes": 13, "network_bytes": 14, "event_summary": "\n"} +{"timestamp": "2026-08-26T22:59:36", "event_id": "3e5c7b73-7a4a-4124-a5b5-ce5df4fe137b", "source_ip": "204.76.203.7", "source_port": 44414, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41890, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-26T22:58:54", "event_id": "607fa9e7-c14d-451d-b9cf-aaced1e0b83c", "source_ip": "204.76.203.7", "source_port": 37344, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41890, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-26T22:58:45", "event_id": "ef37b265-33d5-417d-987c-f55e448e0584", "source_ip": "204.76.203.7", "source_port": 53860, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41890, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-26T22:57:20", "event_id": "19766504-09c8-4d4b-a9a4-4b2990822bbf", "source_ip": "204.76.203.7", "source_port": 41672, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41890, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T22:57:12", "event_id": "1f9ba221-6498-4eb6-b5f9-a02d5e6ffd57", "source_ip": "176.65.149.224", "source_port": 50750, "source_domain": "176.65.149.224.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 49797, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 781000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-26T22:56:30", "event_id": "c953e0cc-a74a-4230-b261-0add665fe0ba", "source_ip": "204.76.203.7", "source_port": 45882, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41890, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T22:56:22", "event_id": "d0a0d59f-e2f3-4475-a397-8ffde349ff49", "source_ip": "204.76.203.7", "source_port": 57094, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 41890, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-26T22:50:21", "event_id": "78a92f9c-cac2-440d-89ad-8f86f448515d", "source_ip": "176.65.149.27", "source_port": 44838, "source_domain": "176.65.149.27.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 37800, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-27T23:42:29", "event_id": "e38b5fd1-a70a-44ac-9fcb-9adab6c10a90", "source_ip": "176.65.149.27", "source_port": 51200, "source_domain": "176.65.149.27.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 37823, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 120000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-27T23:37:52", "event_id": "1837fc78-7bd6-440d-83e2-38d28c8a79f8", "source_ip": "176.65.149.236", "source_port": 55025, "source_domain": "176.65.149.236.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 82, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 zgrab/0.x", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:82\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 112, "dest_bytes": 79, "network_bytes": 191, "event_summary": ""} +{"timestamp": "2026-08-27T23:36:30", "event_id": "4720d1e4-01f7-47bf-80ef-fb60e6a749b5", "source_ip": "204.76.203.7", "source_port": 34952, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39099, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T23:36:17", "event_id": "137bc691-670d-4e88-b0b6-5b5bfa1feeb3", "source_ip": "204.76.203.7", "source_port": 49580, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39099, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T23:36:06", "event_id": "64f0a515-8845-409e-bf9d-47d71982912f", "source_ip": "204.76.203.7", "source_port": 50212, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39099, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T23:33:57", "event_id": "e6a73ed9-734f-4612-be3b-9e54bc7f6995", "source_ip": "204.76.203.7", "source_port": 50276, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39099, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-27T23:33:43", "event_id": "ecac0513-88dc-4614-aec6-a7aca8c9eb06", "source_ip": "204.76.203.7", "source_port": 37640, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39099, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-27T23:33:32", "event_id": "a39f9b46-0315-4bcb-9127-79464835acc5", "source_ip": "204.76.203.7", "source_port": 54520, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39099, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-27T23:24:21", "event_id": "f8a09010-e16e-4a7f-a6bd-ced99dbeeda0", "source_ip": "176.65.149.230", "source_port": 48738, "source_domain": "176.65.149.230.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 55812, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 113000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-27T23:06:45", "event_id": "0ff34f7c-bef1-450a-a271-78d0489aec68", "source_ip": "176.65.149.212", "source_port": 33464, "source_domain": "176.65.149.212.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7806, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-27T22:55:22", "event_id": "3700a0e1-7297-4ee4-b5f9-ae722fbf1fe6", "source_ip": "45.135.194.113", "source_port": 43528, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 10802, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T22:55:22", "event_id": "b55ab995-3334-4279-8087-7cdca65c6d54", "source_ip": "45.135.194.113", "source_port": 43518, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 10802, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-27T22:55:22", "event_id": "89ea00bd-eff7-4f01-bbfa-d53d0e94aaf2", "source_ip": "45.135.194.113", "source_port": 43500, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 10802, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T22:55:22", "event_id": "1dd7cb42-0366-46f7-bff9-5e095aa2978e", "source_ip": "45.135.194.113", "source_port": 43510, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 10802, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-27T22:46:23", "event_id": "f63e630a-e995-4459-95f4-bffd878f5764", "source_ip": "176.65.149.201", "source_port": 50822, "source_domain": "176.65.149.201.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 3001, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/113.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3001\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/113.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 207, "dest_bytes": 79, "network_bytes": 286, "event_summary": ""} +{"timestamp": "2026-08-27T22:43:26", "event_id": "64717fa4-c4e5-46cd-99d6-b5674f1ebf16", "source_ip": "176.65.149.31", "source_port": 39782, "source_domain": "176.65.149.31.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 1708, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-27T22:43:15", "event_id": "ce799047-ad0e-49df-b769-8e2f46ceab89", "source_ip": "204.76.203.7", "source_port": 42924, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39100, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T22:42:53", "event_id": "57d14d42-4e59-4f2c-b07b-763f772ea93c", "source_ip": "204.76.203.7", "source_port": 52164, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39100, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T22:42:12", "event_id": "f2013058-4644-4af0-abc3-fafc2fc936d1", "source_ip": "204.76.203.7", "source_port": 54616, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39100, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-27T22:40:36", "event_id": "2ca76725-261b-451b-bb97-aab1cf405e61", "source_ip": "204.76.203.7", "source_port": 33666, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 39100, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-28T23:59:00", "event_id": "a44a7d8f-9e84-49bb-a241-89990df7ed7a", "source_ip": "45.135.193.198", "source_port": 33390, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 18088, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 57, "dest_bytes": 79, "network_bytes": 136, "event_summary": ""} +{"timestamp": "2026-08-28T23:57:56", "event_id": "098e94f0-6e7e-453a-8d17-1c9414c14f45", "source_ip": "45.135.194.113", "source_port": 59996, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 11443, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-28T23:57:56", "event_id": "df086b35-daab-40fc-a1d6-97284b9a571d", "source_ip": "45.135.194.113", "source_port": 59990, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 11443, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-28T23:57:56", "event_id": "68b247a3-91b9-47d7-8c18-caba930eb113", "source_ip": "45.135.194.113", "source_port": 59968, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 11443, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-28T23:57:56", "event_id": "eb8b6220-8f64-4a2b-8efa-dfce510d780a", "source_ip": "45.135.194.113", "source_port": 59984, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 11443, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-28T23:52:09", "event_id": "ce593fab-0516-4a58-a34c-407f93ff8072", "source_ip": "45.135.193.198", "source_port": 39320, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8181, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 114000000, "source_bytes": 56, "dest_bytes": 79, "network_bytes": 135, "event_summary": ""} +{"timestamp": "2026-08-28T23:50:27", "event_id": "b89ebbd1-0dba-41b9-a32c-40c483d621e4", "source_ip": "176.65.148.226", "source_port": 52150, "source_domain": "176.65.148.226.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 3000, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "url_path": "/api/session/properties", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i140900_cbb2034c60b8_e7c285222651", "tls_client_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0500_cac2c496544b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 197, "dest_bytes": 79, "network_bytes": 276, "event_summary": ""} +{"timestamp": "2026-08-28T23:50:27", "event_id": "bb9dea80-2f1a-437c-9935-52c396998333", "source_ip": "176.65.148.226", "source_port": 52136, "source_domain": "176.65.148.226.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 3000, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "url_path": "/api/session/properties", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_cac2c496544b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 197, "dest_bytes": 79, "network_bytes": 276, "event_summary": ""} +{"timestamp": "2026-08-28T23:50:27", "event_id": "303b6f15-d954-4fc0-9520-f7653b897fad", "source_ip": "45.135.193.198", "source_port": 53042, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8000, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 56, "dest_bytes": 79, "network_bytes": 135, "event_summary": ""} +{"timestamp": "2026-08-28T23:49:25", "event_id": "bfa69d27-fe9f-4551-b00b-3d616e3f3302", "source_ip": "176.65.149.31", "source_port": 50012, "source_domain": "176.65.149.31.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 1730, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-28T23:47:20", "event_id": "b0490da3-f732-4f40-895d-a7a85688e756", "source_ip": "45.135.193.198", "source_port": 47650, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 18080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 113000000, "source_bytes": 57, "dest_bytes": 79, "network_bytes": 136, "event_summary": ""} +{"timestamp": "2026-08-28T23:43:17", "event_id": "f483c47f-8a6a-412a-9628-a097f42f5d0b", "source_ip": "176.65.149.30", "source_port": 58908, "source_domain": "176.65.149.30.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31821, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-28T23:40:07", "event_id": "b3a2674b-bdd9-4912-bdfc-4dd03c4e2ad5", "source_ip": "176.65.149.212", "source_port": 47438, "source_domain": "176.65.149.212.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 7829, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-28T23:38:31", "event_id": "c9770ee3-9c0c-4d93-bafd-09bcb54495c2", "source_ip": "45.135.193.198", "source_port": 36760, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8888, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 56, "dest_bytes": 79, "network_bytes": 135, "event_summary": ""} +{"timestamp": "2026-08-28T23:36:31", "event_id": "78d5ebd7-e6be-45ef-aca8-46f332baac98", "source_ip": "45.135.193.198", "source_port": 35320, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 18080, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 56, "dest_bytes": 79, "network_bytes": 135, "event_summary": ""} +{"timestamp": "2026-08-28T23:30:20", "event_id": "cde3e328-47a9-4c6f-9da5-6615c305a26e", "source_ip": "45.135.193.198", "source_port": 36188, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8181, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 57, "dest_bytes": 79, "network_bytes": 136, "event_summary": ""} +{"timestamp": "2026-08-28T23:25:43", "event_id": "f736a3b7-c8f3-4478-94ce-bdce0fd2c8c9", "source_ip": "45.135.193.198", "source_port": 36004, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8181, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 56, "dest_bytes": 79, "network_bytes": 135, "event_summary": ""} +{"timestamp": "2026-08-28T23:20:26", "event_id": "3c2b7b51-54e8-4020-b25c-dbfbd57f8f15", "source_ip": "204.76.203.7", "source_port": 51090, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 32946, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-28T23:20:19", "event_id": "a7c36c3c-da64-423d-a0ca-ee7d688d9150", "source_ip": "45.135.193.198", "source_port": 35512, "source_domain": "45.135.193.198.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8000, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "0day", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"host\":\"<HONEYPOT>\",\"user-agent\":\"0day\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i190800_9dc949149365_97f8aa674fd9", "tls_client_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge10nn0200_3ed38b250d3d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 57, "dest_bytes": 79, "network_bytes": 136, "event_summary": ""} +{"timestamp": "2026-08-28T23:20:12", "event_id": "780b0da8-8d0e-491e-bc98-65fada0ca8a0", "source_ip": "204.76.203.7", "source_port": 38596, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 32946, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T23:57:04", "event_id": "f9ef8784-29a3-44b0-970a-9274182163af", "source_ip": "176.65.149.230", "source_port": 51448, "source_domain": "176.65.149.230.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 55862, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 112000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-29T23:46:59", "event_id": "dbe42850-4f3a-4277-a3b9-11f79a18a467", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25566, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-29T23:41:41", "event_id": "5a3e781d-cad0-4f95-9770-7cd692e72332", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-29T23:35:20", "event_id": "85c83f8d-66b3-480a-b7a0-e95ad2998aa4", "source_ip": "204.76.203.7", "source_port": 53070, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31021, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T23:34:03", "event_id": "8a35e88c-c935-4408-8c38-e0c726a210b5", "source_ip": "204.76.203.7", "source_port": 54250, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31021, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T23:33:33", "event_id": "f284dea0-1a6e-4fdd-a536-3fa200906877", "source_ip": "204.76.203.7", "source_port": 58524, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31021, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T23:32:54", "event_id": "a8ed9650-ad75-45f2-a424-17fd481ae2dd", "source_ip": "204.76.203.7", "source_port": 37050, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31021, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-29T23:32:27", "event_id": "8f16c9bc-e33f-42ce-b091-ae0e811696bb", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25564, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-29T23:32:20", "event_id": "96fcf4bf-e223-491d-b278-9bd31c2e073b", "source_ip": "176.65.149.220", "source_port": 52994, "source_domain": "176.65.149.220.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 43884, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 111000000, "source_bytes": 17, "dest_bytes": 14, "network_bytes": 31, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-29T23:32:14", "event_id": "6dd2ad8d-15ed-4fbc-9cf5-a3593e4caffb", "source_ip": "176.65.149.30", "source_port": 45310, "source_domain": "176.65.149.30.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31843, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 110000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-29T23:31:29", "event_id": "1160b7c4-0514-43b7-ab7c-728399dbeb0a", "source_ip": "204.76.203.7", "source_port": 36890, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31021, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-29T23:30:57", "event_id": "bda4f5b2-a4d9-49ff-94d4-9e2d5f46716b", "source_ip": "204.76.203.7", "source_port": 37234, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31021, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-29T23:18:30", "event_id": "b118e02d-a6ef-4e5f-aaf9-e340f8ece787", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25566, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-29T23:08:26", "event_id": "e25f6098-25fe-4c26-ad54-46fdc731dfff", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-29T23:00:22", "event_id": "483f3796-6844-4ebf-9f46-272eec87b86f", "source_ip": "176.65.148.29", "source_port": 39468, "source_domain": "176.65.148.29.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8332, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1, "dest_bytes": 13, "network_bytes": 14, "event_summary": "\n"} +{"timestamp": "2026-08-29T22:49:12", "event_id": "264aee5a-31aa-4971-86b6-474c8295f72d", "source_ip": "176.65.149.188", "source_port": 57780, "source_domain": "176.65.149.188.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 zgrab/0.x", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "tls_client_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0400_88d30a62b7ad", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 177000000, "source_bytes": 110, "dest_bytes": 79, "network_bytes": 189, "event_summary": ""} +{"timestamp": "2026-08-29T22:39:47", "event_id": "627dd179-ed3a-4638-bc9d-b8c0a3a1e8e4", "source_ip": "204.76.203.7", "source_port": 40942, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31033, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T22:39:13", "event_id": "228cfe17-e357-43cc-a06d-599b71df2aae", "source_ip": "204.76.203.7", "source_port": 39788, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31033, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T22:38:30", "event_id": "c9e79f10-3259-4afe-ab14-1f3a201e5d76", "source_ip": "204.76.203.7", "source_port": 35354, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31033, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-29T22:37:25", "event_id": "0e3b5db8-5273-4818-9ee4-e3ac616f8712", "source_ip": "204.76.203.7", "source_port": 39374, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31033, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-30T23:58:03", "event_id": "d586dfc9-b588-430b-a135-a182e86e0277", "source_ip": "176.65.148.216", "source_port": 47356, "source_domain": "176.65.148.216.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 3, "event_duration": 11622000000, "source_bytes": 63, "dest_bytes": 42, "network_bytes": 105, "event_summary": "\u0012\u0000/\f<HONEYPOT>c\ufffd\u0001\u0001\u0000"} +{"timestamp": "2026-08-30T23:56:23", "event_id": "ef67a074-0437-45e0-928f-f568456dedde", "source_ip": "176.65.134.52", "source_port": 61000, "source_domain": "176.65.134.52.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 28, "dest_bytes": 13, "network_bytes": 41, "event_summary": "\u0019\u0000\ufffd\ufffd\ufffd\ufffd\u000f\u000flocalhost\u0000FORGE\u0000\u0000\u0002\u0001\u0000"} +{"timestamp": "2026-08-30T23:50:39", "event_id": "7a92bc60-cf1b-4b47-b13d-cef4fa0a584d", "source_ip": "176.65.149.27", "source_port": 53878, "source_domain": "176.65.149.27.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 37890, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 111000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "d1b5c211-bc85-460a-b57b-4f7134e1eab2", "source_ip": "45.135.193.193", "source_port": 50530, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8080, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 103000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "6a102f57-0420-48f5-a90a-317acf26b271", "source_ip": "45.135.193.193", "source_port": 53886, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8000, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 103000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "611dc868-e77a-4c7f-ba29-681a769aadf4", "source_ip": "45.135.193.193", "source_port": 55976, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 3128, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 103000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "39188b49-ed04-44cb-b697-4b2b210165e9", "source_ip": "45.135.193.193", "source_port": 35468, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 81, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "1621605d-4e73-4cdd-b788-5d33a8a0b9d4", "source_ip": "45.135.193.193", "source_port": 40694, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 443, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 102000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "519daa90-bf5e-4725-a602-f15364ad8660", "source_ip": "45.135.193.193", "source_port": 48494, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8081, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "ae44e151-dd83-4b41-a72d-36580ab49b05", "source_ip": "45.135.193.193", "source_port": 53046, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 8888, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:49:37", "event_id": "fc29ddd5-3014-4157-b14e-75ed4a98bb1f", "source_ip": "45.135.193.193", "source_port": 54912, "source_domain": "45.135.193.193.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "Langen", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 80, "network_protocol": "", "application_protocol": "http_connect", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 89, "dest_bytes": 14, "network_bytes": 103, "event_summary": "CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp": "2026-08-30T23:38:41", "event_id": "0f5050ec-8965-42ee-972d-758e8cb3abf6", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-30T23:31:29", "event_id": "29ba20fc-94e3-42b6-a925-ba0859a8c7a9", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-30T23:30:03", "event_id": "3b77ef29-b1b4-4e18-9264-66cb09eca7e3", "source_ip": "176.65.149.30", "source_port": 43164, "source_domain": "176.65.149.30.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31865, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 111000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-30T23:27:18", "event_id": "b9eaf444-c1cc-4ce6-9248-b6190214e0f3", "source_ip": "176.65.148.216", "source_port": 44976, "source_domain": "176.65.148.216.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 3, "event_duration": 11324000000, "source_bytes": 66, "dest_bytes": 42, "network_bytes": 108, "event_summary": "\u0013\u0000/\r<HONEYPOT>c\ufffd\u0001\u0001\u0000"} +{"timestamp": "2026-08-30T23:23:59", "event_id": "b350e5ae-b4ce-4f41-ae0b-bf4fd1ff35b4", "source_ip": "204.76.203.7", "source_port": 60716, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 30001, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-31T10:43:09", "event_id": "261bac8f-b434-4775-9469-033253e16354", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25566, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-31T10:25:02", "event_id": "db024493-739c-41cc-8486-d94c721a0ad1", "source_ip": "176.65.149.30", "source_port": 45182, "source_domain": "176.65.149.30.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 31875, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 111000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-31T10:24:35", "event_id": "efd18c3a-03db-4e87-8744-552c8760d15d", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25564, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-31T10:10:15", "event_id": "c80e5cf1-eb71-4e33-8e5b-86e370a249a4", "source_ip": "204.76.203.7", "source_port": 47422, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 27202, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-31T10:09:59", "event_id": "e82b395d-18f1-4199-b8ce-9295ef904cc4", "source_ip": "204.76.203.7", "source_port": 52286, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 27202, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-31T10:08:59", "event_id": "a4f278ab-932f-4370-a204-45d4401af673", "source_ip": "204.76.203.7", "source_port": 54960, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 27202, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 3, "dest_bytes": 12, "network_bytes": 15, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-31T10:08:26", "event_id": "1cda1873-7f0e-43c1-a058-94f0bcf1f491", "source_ip": "176.65.148.71", "source_port": 38222, "source_domain": "176.65.148.71.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", "url_path": "/.env.json", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_d3a2dcb1cd63", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 219, "dest_bytes": 78, "network_bytes": 297, "event_summary": ""} +{"timestamp": "2026-08-31T10:08:26", "event_id": "006190cf-fb35-4959-b671-809b93566e3b", "source_ip": "176.65.148.71", "source_port": 38208, "source_domain": "176.65.148.71.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", "url_path": "/.env", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_d3a2dcb1cd63", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 214, "dest_bytes": 78, "network_bytes": 292, "event_summary": ""} +{"timestamp": "2026-08-31T10:08:00", "event_id": "5c64e472-ebca-4f8e-a9af-f1c3f2f16343", "source_ip": "204.76.203.7", "source_port": 57002, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 27202, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-31T10:07:44", "event_id": "dc937180-b38e-4b4e-9f6d-8a14fe1cbcf4", "source_ip": "204.76.203.7", "source_port": 36570, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 27202, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-31T10:06:46", "event_id": "75617d6e-f963-40a0-bc37-b11e7ac403c0", "source_ip": "204.76.203.7", "source_port": 59020, "source_domain": "204.76.203.7.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 27202, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://azenv.net/", "url_domain": "azenv.net", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 125, "dest_bytes": 77, "network_bytes": 202, "event_summary": ""} +{"timestamp": "2026-08-31T10:05:05", "event_id": "a63203d8-649d-4653-a038-84c3a0a6f1fc", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25566, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-31T09:55:40", "event_id": "03ec16ca-4f97-4335-b3c0-a37c81add734", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25565, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} +{"timestamp": "2026-08-31T09:52:59", "event_id": "e412f84c-4002-44aa-82cb-e7e926f4e5a8", "source_ip": "77.83.39.94", "source_port": 34432, "source_domain": "", "country_code": "UA", "country_name": "Ukraine", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36", "url_path": "/.git/index", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i251000_b78ed14e2fd0_ab7e3b40a677", "tls_client_ja3": "416eca07dcaad72dec6f76d1277b3eff", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0500_9af7e0472034", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 233, "dest_bytes": 76, "network_bytes": 309, "event_summary": ""} +{"timestamp": "2026-08-31T09:52:45", "event_id": "18afd64e-84f7-41ec-a5eb-592973fe041d", "source_ip": "176.65.149.31", "source_port": 44374, "source_domain": "176.65.149.31.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 1783, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 327000000, "source_bytes": 17, "dest_bytes": 13, "network_bytes": 30, "event_summary": "SSH-2.0-OpenSSH\r\n"} +{"timestamp": "2026-08-31T09:49:31", "event_id": "a5f3fd2d-af30-4ffc-9edb-dde23d7634f3", "source_ip": "45.135.194.113", "source_port": 49512, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 90, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-31T09:49:31", "event_id": "f7f10856-1878-4128-8696-20a68d792250", "source_ip": "45.135.194.113", "source_port": 49510, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 90, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-31T09:49:31", "event_id": "11ce79d5-cff5-41ea-9713-82a0ee8995a5", "source_ip": "45.135.194.113", "source_port": 49490, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 90, "network_protocol": "", "application_protocol": "socks5", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 103000000, "source_bytes": 3, "dest_bytes": 14, "network_bytes": 17, "event_summary": "\u0005\u0001\u0000"} +{"timestamp": "2026-08-31T09:49:31", "event_id": "1662863c-a4bb-4d81-97a8-5e0e4243cffb", "source_ip": "45.135.194.113", "source_port": 49500, "source_domain": "45.135.194.113.ptr.pfcloud.network", "country_code": "DE", "country_name": "Germany", "city_name": "", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 90, "network_protocol": "", "application_protocol": "http_proxy", "http_method": "GET", "user_agent": "Go-http-client/1.1", "url_path": "http://proxy.flarevpn.digital:8080/judge", "url_domain": "proxy.flarevpn.digital", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 166, "dest_bytes": 79, "network_bytes": 245, "event_summary": ""} +{"timestamp": "2026-08-31T09:31:17", "event_id": "e80395a4-0478-4815-8592-f886486dabde", "source_ip": "204.76.203.4", "source_port": 1001, "source_domain": "204.76.203.4.ptr.pfcloud.network", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Eygelshoven", "asn_number": 51396, "asn_org": "Pfcloud UG (haftungsbeschrankt)", "dest_port": 25566, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 22, "dest_bytes": 12, "network_bytes": 34, "event_summary": "\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000"} diff --git a/kevlar/2026-08-31/honeylabs/events-AS51852.ndjson b/kevlar/2026-08-31/honeylabs/events-AS51852.ndjson new file mode 100644 index 0000000..a7bc138 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS51852.ndjson @@ -0,0 +1,102 @@ +{"timestamp": "2026-08-24T22:38:47", "event_id": "371bef04-db65-47b8-a743-bf7b97fb9b76", "source_ip": "81.17.28.131", "source_port": 54774, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-24T22:38:47", "event_id": "ab8b6e0d-4c0e-41ad-a463-05282febee82", "source_ip": "81.17.28.131", "source_port": 49070, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T20:32:32", "event_id": "ae0ceca9-c273-44ad-b551-d114c3d297ca", "source_ip": "81.17.28.131", "source_port": 34620, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\"\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T15:31:30", "event_id": "113a91e4-8546-4ae9-8f46-065c9efd5a5d", "source_ip": "81.17.28.131", "source_port": 35958, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-24T15:31:29", "event_id": "70c215a8-a3aa-40b7-9e7a-be0a2880ac83", "source_ip": "81.17.28.131", "source_port": 40214, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T04:10:49", "event_id": "dfea8ef9-5f02-4c9d-afad-ea00f10ea11e", "source_ip": "141.255.165.67", "source_port": 35344, "source_domain": "cryptodocuments.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T04:10:19", "event_id": "824be3d2-25e8-4856-96f3-e09190eaece2", "source_ip": "141.255.165.67", "source_port": 57400, "source_domain": "cryptodocuments.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T04:07:48", "event_id": "a1dcd8de-760d-44ac-add6-377cc5221d51", "source_ip": "141.255.165.68", "source_port": 16960, "source_domain": "eternalpink.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T04:07:17", "event_id": "17872c66-e089-48fa-bb92-ab9ececf177f", "source_ip": "141.255.165.68", "source_port": 39966, "source_domain": "eternalpink.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T03:59:47", "event_id": "98974ba8-a9d7-470f-9675-a51c7b36ee52", "source_ip": "81.17.28.131", "source_port": 43566, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\ufffd\ufffd\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T03:14:20", "event_id": "0587f561-dd87-4a6b-9315-52cefaf64fca", "source_ip": "81.17.28.131", "source_port": 60568, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-24T03:14:20", "event_id": "7e106fb8-2915-4f34-bb6c-4aeff2e12bb1", "source_ip": "81.17.28.131", "source_port": 35932, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T02:23:36", "event_id": "cf72479e-2131-4957-9c59-045cdba5ca17", "source_ip": "81.17.28.131", "source_port": 38260, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000d\u001f\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T01:47:34", "event_id": "671ab189-de08-4d42-89ba-825a550ff4b5", "source_ip": "81.17.28.131", "source_port": 48512, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-24T01:47:33", "event_id": "6ba33f84-9131-4023-a549-d0eb1cb2421c", "source_ip": "81.17.28.131", "source_port": 57806, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T00:18:35", "event_id": "c8be86a4-f5d4-404e-b18b-beaad81fcbce", "source_ip": "81.17.28.131", "source_port": 48932, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-24T00:18:35", "event_id": "84aedd37-d285-4aa9-877a-219c961e3f71", "source_ip": "81.17.28.131", "source_port": 41092, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T17:51:25", "event_id": "429036e0-e82e-4ad5-94ae-2a7ddc7c6db0", "source_ip": "81.17.28.131", "source_port": 37162, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000TN\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T15:52:04", "event_id": "68e7553e-a190-4da6-91a2-9baa78447bdf", "source_ip": "81.17.28.131", "source_port": 39048, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-25T15:52:03", "event_id": "2be6eef2-3189-4be0-aaa1-57f92e700f0e", "source_ip": "81.17.28.131", "source_port": 44962, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T11:10:56", "event_id": "8cd3e138-4531-4c84-8be1-7386d9c584f4", "source_ip": "81.17.28.131", "source_port": 53886, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\ufffd\ufffd\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T05:37:54", "event_id": "07377bdb-596f-4650-bc29-06ac5fea7171", "source_ip": "81.17.28.131", "source_port": 50356, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-25T05:37:54", "event_id": "554df08b-8f8d-44c7-8ed4-981a468ce4db", "source_ip": "81.17.28.131", "source_port": 46344, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T05:23:37", "event_id": "074aa45b-8f78-4bb6-b7f9-3f9f83ba380b", "source_ip": "81.17.28.131", "source_port": 52578, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-25T05:23:36", "event_id": "a487ed40-8666-4827-a383-b4a1f4ad78b1", "source_ip": "81.17.28.131", "source_port": 42546, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T02:56:09", "event_id": "00048738-62f0-479d-9f6f-3e9b55e8e73b", "source_ip": "81.17.28.131", "source_port": 39456, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-25T02:56:09", "event_id": "f7c5b723-0c42-4baa-a17d-a73223fce136", "source_ip": "81.17.28.131", "source_port": 55552, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T02:20:29", "event_id": "8e8703a6-8990-431c-a59c-74fc198049da", "source_ip": "81.17.28.131", "source_port": 37222, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000:\ufffd\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T17:43:04", "event_id": "2512e47b-8ca7-41f5-b75d-7c9a89f11d95", "source_ip": "81.17.28.131", "source_port": 60562, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-26T17:43:04", "event_id": "23f126bd-9bf9-4249-aea0-f967f8768bbb", "source_ip": "81.17.28.131", "source_port": 48944, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T15:42:53", "event_id": "be54c583-e9f8-47b7-9540-e62e6a6cfc7a", "source_ip": "81.17.28.131", "source_port": 43156, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-26T15:42:52", "event_id": "137519ba-e41b-4247-8bdf-82fdebc23480", "source_ip": "81.17.28.131", "source_port": 44136, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T14:25:33", "event_id": "073364f4-9d9e-4dd8-abc5-832cf89cc230", "source_ip": "81.17.28.131", "source_port": 48414, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-26T14:25:32", "event_id": "c2188237-fed7-4b54-b159-2d4b1ebdc2df", "source_ip": "81.17.28.131", "source_port": 46214, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T10:15:41", "event_id": "03c191c2-09ff-45dc-ac19-efab2d518b32", "source_ip": "81.17.28.131", "source_port": 58074, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-26T10:15:41", "event_id": "a98706ce-a7c9-4574-a8ac-e4b443c9bc6e", "source_ip": "81.17.28.131", "source_port": 33198, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T10:15:40", "event_id": "fd6e4107-d00c-4bde-84f3-25ade62bbcf4", "source_ip": "81.17.28.131", "source_port": 42320, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T07:37:48", "event_id": "cee7a657-555e-4c89-95d6-117296f9b38e", "source_ip": "81.17.28.131", "source_port": 52306, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\ufffdY\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-26T02:14:22", "event_id": "b93f25e7-d60f-4fc8-8406-94d2f1a0de5f", "source_ip": "81.17.28.131", "source_port": 37002, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-26T02:14:22", "event_id": "ec804f99-7c27-4d4a-a16c-2b47c278ab56", "source_ip": "81.17.28.131", "source_port": 43626, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-27T20:52:20", "event_id": "ba16c52b-0198-4f7d-ab19-8e943e550a74", "source_ip": "81.17.28.131", "source_port": 52122, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-27T20:52:20", "event_id": "4c46aff4-a54d-4fae-be44-f20ec0f8ac5a", "source_ip": "81.17.28.131", "source_port": 34892, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-27T19:19:46", "event_id": "2e80af64-c265-4bc8-b545-6051a9f502df", "source_ip": "81.17.28.131", "source_port": 47292, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-27T19:19:45", "event_id": "aa4ac488-7c52-472d-8c86-50163a188a4d", "source_ip": "81.17.28.131", "source_port": 46018, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-27T18:14:42", "event_id": "ddc10565-f577-434c-bfc9-b431fe92d429", "source_ip": "185.12.44.133", "source_port": 62599, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 39131, "network_protocol": "", "application_protocol": "bittorrent", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 135, "dest_bytes": 13, "network_bytes": 148, "event_summary": "\ufffd\ufffd_\ufffd\ufffdI]\ufffd\ufffdK\u0001\ufffd@\ufffd\ufffdV/S\ufffdm lgu\ufffd\ufffd\u022b\u060e\r\ufffd\ufffd\ufffdK8pd\ufffd\ufffdU\ufffd\ufffd\ufffd\fw\u0000>Hz\u0234|\u0013iy\thE!\n\ufffdD\u007f\ufffd%'$0\ufffd\ufffd[i\r,\ufffd\ufffd\u001f$\ufffdu\ufffdg\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdla'd1\n}\ufffd\ufffd+f\ufffd\ufffd\ufffdh\ufffd\ufffd]\u000f\ufffd\u000f\ufffd\u0011X\ufffdH\ufffdfn\u0001U\u0002*\ufffd\ufffd&;!"} +{"timestamp": "2026-08-27T18:13:10", "event_id": "b9a9db0f-5c56-4a00-9e8f-72ab8c6232a3", "source_ip": "185.12.44.133", "source_port": 60585, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 39131, "network_protocol": "", "application_protocol": "bittorrent", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 68, "dest_bytes": 13, "network_bytes": 81, "event_summary": "\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b\ufffdR\u001f\ufffd\u01b8N\ufffd\u0011\ufffdY\ufffdq\u0017\u007f|O\ufffd<-UW1605-FPwfkjsgA!ei"} +{"timestamp": "2026-08-27T18:12:58", "event_id": "8303f69b-c5c6-48ea-8cab-8bf14f4fc728", "source_ip": "185.12.44.133", "source_port": 49065, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 39131, "network_protocol": "", "application_protocol": "bittorrent", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 583, "dest_bytes": 13, "network_bytes": 596, "event_summary": "i\u00b3\ufffdk\ufffd`\ufffd@G;\ufffd\ufffd6\u001fQ\ufffd\ufffd\u0002\u0014\ufffd\ufffd\ufffd~\ufffd,y\ufffdZ\ufffdO\u0f11\ufffd\ufffd:{l\ufffd\u0423\ufffdf(\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\u0394\ufffd\u0007uM\ufffd\u0002\u5d6a\ufffd3(\u0005Y\u0010\ufffd\ufffd4\ufffd\ufffd2\ufffd\ufffd^b\ufffdp\ufffdq\ufffd\ufffd\ufffd\u001bX\u000fq\ufffdy\u0004J\ufffd\ufffd1\u0011\ufffdE?F\r.\ufffd\u007fp\u000eF\ufffdFWQC\u0003\ufffd\ufffd\ufffd6\ufffd\u0017\ufffd!\ufffd\u0000\u000f\ufffd\ufffd4\ufffdi\ufffdEL\ufffd1\ufffd\ufffd\ufffd)\u0017\ufffd\ufffd\ufffdC\ufffd\ufffd\u0013\ufffd]7N\ufffd\ufffd\u0003\ufffd\u0153\ufffd\ufffdq\ufffd\u0003)|!\ufffd\u000f\ufffdE\u0013\u0489\ufffd\ufffdp\ufffd{7\ufffd\r(U\u0001\r8\ufffd\ufffdt\t\ufffd\ufffd-\ufffd\u000fI\ufffd\ufffd\ufffd\ufffd\ufffd\"\u0017\u0017\u001b\ufffd\u0014\ufffd\ufffd\ufffd1\ufffd\ufffdv\ufffd\ufffd\ufffd\u0017\u0228\ufffdE\ufffd-g\u107dD`\ufffd\u001agi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05b2@\ufffd\ufffd\ufffd\ufffd\ufffd\"\n\u01f2#P\u00b9\u0005\u03d7W\u0003\u000f\ufffd\ufffd\u00cbi\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdt\u05a7\\\u025d\u00ef$!\ufffd\ufffd\ufffd\ufffd\ufffd&\f\\\ufffd\ufffd\u0014uE\ufffd\u0005,$+\ufffd\ufffd\ufffd9\ufffdp_U\ufffdx\ufffd\ufffd-\u0019\ufffd:\ufffd\ufffdp\ufffd\ufffd\ufffd=\u0005\ufffdZ\u0012\ufffd.\r\ufffd\ufffdf\u0015\u0018\n\ufffd\ufffd\ufffd\ufffd>y\ufffd\ufffdy\u001c\ufffd\u0014\ufffdG\ufffd\u001dW\ufffdC\ufffdj\fhr\u068e\ufffd\ufffd\ufffd\ufffd\u06af\u0633C\ufffd\ufffd\u05df\ufffdw\ufffd\ufffd\u001fd\ufffdpf'[+U\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\u0011kx\ufffd\ufffdv<\ufffd\ufffd=\ufffd\u00194o!hH\ufffd\ufffd\ufffd$h\ufffd\ufffd\ufffd\ufffd\u0003{\ufffdf\ufffd3\u000f]\ufffd\ufffd\u001e\ufffd\u0016E.q\ufffd2\ufffd9#\ufffd\ufffd\ufffd\ufffd\"kCl\u001dy\ufffd\ufffdy-o\ufffd\ufffd\ufffd\u007f\ufffd\\\ufffd\ufffd\ufffd0I\ufffdu\ufffd\u0014\ufffd\ufffdul\ufffd\ufffd(x\u03d9N\ufffd\ufffd8\ufffd\u0017\ufffd\ufffd\u001c\ufffd\ufffd\ufffdaR:\ufffd\ufffd\u001d\u007f\ufffd# \u0006\u033b\ufffd\ufffd\u0368\ufffd\u0399\ufffd\ufffd\u001bX|\ufffd4GA\ufffd\u06f19\ufffd\u001e\ufffd\ufffdIM[\u001dQ\u0017EONL0#\ufffd\ufffd\r\ufffd%y\ufffd\u033c\ufffd0\ufffd\u0007\ufffdJ\ufffd\ufffd\"1\ufffd^\ufffd \ufffdji\ufffd"} +{"timestamp": "2026-08-27T18:11:27", "event_id": "24b01feb-5247-4983-ac70-fe59f53e540d", "source_ip": "185.12.44.133", "source_port": 59853, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 39131, "network_protocol": "", "application_protocol": "bittorrent", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 68, "dest_bytes": 13, "network_bytes": 81, "event_summary": "\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b\ufffdR\u001f\ufffd\u01b8N\ufffd\u0011\ufffdY\ufffdq\u0017\u007f|O\ufffd<-UW1605-C~o~sOWdmI36"} +{"timestamp": "2026-08-27T15:44:48", "event_id": "24d5a369-2d61-481e-a11b-b06710546cb7", "source_ip": "179.43.150.26", "source_port": 40646, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 9000, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0", "url_path": "/z535", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0300_341eb0d8946c", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 759000000, "source_bytes": 344, "dest_bytes": 312, "network_bytes": 656, "event_summary": ""} +{"timestamp": "2026-08-27T15:44:48", "event_id": "9e6c928f-a568-4724-a26d-59a042e7c8ab", "source_ip": "179.43.150.26", "source_port": 63056, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 9000, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0", "url_path": "/z5006", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0300_341eb0d8946c", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 767000000, "source_bytes": 345, "dest_bytes": 312, "network_bytes": 657, "event_summary": ""} +{"timestamp": "2026-08-27T15:43:20", "event_id": "8fb96a2a-4400-478c-a460-190345b39eaa", "source_ip": "179.43.150.26", "source_port": 59892, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 9000, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0", "url_path": "/z60", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0300_341eb0d8946c", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 502000000, "source_bytes": 347, "dest_bytes": 312, "network_bytes": 659, "event_summary": ""} +{"timestamp": "2026-08-28T17:40:22", "event_id": "c4cab9e6-1a2e-421d-a506-18f377a0c786", "source_ip": "81.17.28.131", "source_port": 42854, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 141, "dest_bytes": 77, "network_bytes": 218, "event_summary": ""} +{"timestamp": "2026-08-28T17:40:22", "event_id": "610ab232-5a49-4834-9019-69c46abc1932", "source_ip": "81.17.28.131", "source_port": 33694, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T17:07:15", "event_id": "beff14a7-b070-4be8-a685-c71fff164315", "source_ip": "141.255.165.68", "source_port": 35628, "source_domain": "eternalpink.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T17:06:45", "event_id": "e1b3c2d0-2698-46d8-89c0-93372a136603", "source_ip": "141.255.165.68", "source_port": 39708, "source_domain": "eternalpink.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T16:59:21", "event_id": "a06b656b-21fc-4955-bb76-0186811323c0", "source_ip": "81.17.28.131", "source_port": 32856, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8899, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 140, "dest_bytes": 77, "network_bytes": 217, "event_summary": ""} +{"timestamp": "2026-08-28T16:59:21", "event_id": "2b083ca6-c847-4fe7-b459-06206c64e7a4", "source_ip": "81.17.28.131", "source_port": 55462, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 8089, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 4, "dest_bytes": 12, "network_bytes": 16, "event_summary": "\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T15:51:00", "event_id": "de46d871-8984-4c93-a941-d2a863822a80", "source_ip": "81.17.28.131", "source_port": 41614, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000[\ufffd\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T13:47:51", "event_id": "d53c7745-a420-4f94-9e03-6457a31268b3", "source_ip": "81.17.28.131", "source_port": 51772, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 135, "network_protocol": "", "application_protocol": "dce_rpc", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 116, "dest_bytes": 12, "network_bytes": 128, "event_summary": "\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\ufffd&\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000,\u001c\ufffdl\u0012\ufffd@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T08:54:42", "event_id": "ecf44ee2-6527-4a18-b5f0-cdea01117913", "source_ip": "179.43.150.26", "source_port": 42332, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 9090, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0", "url_path": "/z2565", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9090\",\"user-agent\":\"Mozilla/5.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0300_341eb0d8946c", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 638000000, "source_bytes": 353, "dest_bytes": 312, "network_bytes": 665, "event_summary": ""} +{"timestamp": "2026-08-28T08:34:33", "event_id": "4adbbfb2-8574-43b7-af73-c0108d8f3b4b", "source_ip": "179.43.150.26", "source_port": 64360, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 9090, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0", "url_path": "/z3145", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9090\",\"user-agent\":\"Mozilla/5.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0300_341eb0d8946c", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 764000000, "source_bytes": 345, "dest_bytes": 312, "network_bytes": 657, "event_summary": ""} +{"timestamp": "2026-08-28T08:34:33", "event_id": "09fe775c-dc3a-4597-b5c5-45db1ab76e14", "source_ip": "179.43.150.26", "source_port": 43112, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 9090, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0", "url_path": "/z1271", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9090\",\"user-agent\":\"Mozilla/5.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0300_341eb0d8946c", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 772000000, "source_bytes": 345, "dest_bytes": 312, "network_bytes": 657, "event_summary": ""} +{"timestamp": "2026-08-29T23:53:37", "event_id": "bd6ab41f-7359-4f7e-b0da-c5d227a2a3ba", "source_ip": "179.43.167.2", "source_port": 23174, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:0013908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:23174;branch=z9hG4bK-524287-1---05aa8cbb53043f6d\r\nFrom: <sip:%40@<HONEYPOT>>;tag=48c88107\r\nTo: <sip:0013908351673002@<HONEYPOT>:5060>\r\nCall-ID: Jblk9d2dKb1Oz0YDfPliP6..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:23174>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T23:45:34", "event_id": "7ebbb8d0-f437-46c7-9519-c412f2212881", "source_ip": "179.43.167.2", "source_port": 18396, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:0013908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:18396;branch=z9hG4bK-524287-1---b27b2f003ad947fb\r\nFrom: <sip:%40@<HONEYPOT>>;tag=c9c8c4e0\r\nTo: <sip:0013908351673002@<HONEYPOT>:5060>\r\nCall-ID: GXZJPSoc7R5HfZBG2oEQLO..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:18396>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T23:36:28", "event_id": "0d4ea4f2-f1a1-43cb-81c5-361edb94c3e9", "source_ip": "179.43.167.2", "source_port": 30386, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:0123908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:30386;branch=z9hG4bK-524287-1---adede0b1011557e0\r\nFrom: <sip:%40@<HONEYPOT>>;tag=227ca909\r\nTo: <sip:0123908351673002@<HONEYPOT>:5060>\r\nCall-ID: grQc3QfxDnjgtze0yDlLGH..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:30386>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T23:28:24", "event_id": "96b90b03-7ee6-456b-8b86-d4dfae1b4811", "source_ip": "179.43.167.2", "source_port": 60854, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:0123908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:60854;branch=z9hG4bK-524287-1---17b5c10b8dc9ddb7\r\nFrom: <sip:%40@<HONEYPOT>>;tag=2512a90f\r\nTo: <sip:0123908351673002@<HONEYPOT>:5060>\r\nCall-ID: ckm5WHhnIg1LTZZezYiji7..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:60854>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T23:19:17", "event_id": "1b406ef5-fec2-4e3f-a84d-1464a0dd5734", "source_ip": "179.43.167.2", "source_port": 46232, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:0103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:46232;branch=z9hG4bK-524287-1---865d971970b8b82d\r\nFrom: <sip:%40@<HONEYPOT>>;tag=c87a580f\r\nTo: <sip:0103908351673002@<HONEYPOT>:5060>\r\nCall-ID: 4U95dNXLCnvjyaMaJ0HGeX..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:46232>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T23:11:13", "event_id": "87927cb6-d040-4853-9812-52c55c2db8f2", "source_ip": "179.43.167.2", "source_port": 57402, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:0103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:57402;branch=z9hG4bK-524287-1---65e8411eb928e0c3\r\nFrom: <sip:%40@<HONEYPOT>>;tag=da5e08c6\r\nTo: <sip:0103908351673002@<HONEYPOT>:5060>\r\nCall-ID: o7KK745itMGt9PfzIyG00K..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:57402>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T23:02:06", "event_id": "33e829a7-855c-400a-90c3-f156b400b775", "source_ip": "179.43.167.2", "source_port": 64538, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:00113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:64538;branch=z9hG4bK-524287-1---7674b6098e2d941e\r\nFrom: <sip:%40@<HONEYPOT>>;tag=9c9d709a\r\nTo: <sip:00113908351673002@<HONEYPOT>:5060>\r\nCall-ID: 7QFwff1dXnMJDnpHEJn8Mk..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:64538>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:54:01", "event_id": "2c004bbb-951d-4f08-8f4c-85e23dc85022", "source_ip": "179.43.167.2", "source_port": 23658, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1073, "dest_bytes": 12, "network_bytes": 1085, "event_summary": "INVITE sip:00113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:23658;branch=z9hG4bK-524287-1---ce92000b3b41920f\r\nFrom: <sip:%40@<HONEYPOT>>;tag=8cc3f9c9\r\nTo: <sip:00113908351673002@<HONEYPOT>:5060>\r\nCall-ID: pEUTZk4f49isVZaYeUhcG5..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:23658>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:44:52", "event_id": "bec003ef-34fd-4b2d-80d5-45496c723223", "source_ip": "179.43.167.2", "source_port": 22292, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:8103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:22292;branch=z9hG4bK-524287-1---f0e4233fc6f83e9b\r\nFrom: <sip:%40@<HONEYPOT>>;tag=d7b7485a\r\nTo: <sip:8103908351673002@<HONEYPOT>:5060>\r\nCall-ID: Zm8jq9H3n9D3wwpfhcEept..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:22292>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:36:47", "event_id": "6e248050-8505-4155-866d-0eaf59b1a1cd", "source_ip": "179.43.167.2", "source_port": 28724, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:8103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:28724;branch=z9hG4bK-524287-1---b03867f4fe1b93a9\r\nFrom: <sip:%40@<HONEYPOT>>;tag=0149221f\r\nTo: <sip:8103908351673002@<HONEYPOT>:5060>\r\nCall-ID: n8EV1zzjyOkWm4Y8Q756zs..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:28724>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:27:39", "event_id": "439f7680-cca1-4178-b141-29dcfd5f29d2", "source_ip": "179.43.167.2", "source_port": 1382, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1065, "dest_bytes": 12, "network_bytes": 1077, "event_summary": "INVITE sip:0003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:1382;branch=z9hG4bK-524287-1---d632a1c303d8a2cb\r\nFrom: <sip:%40@<HONEYPOT>>;tag=72ca8833\r\nTo: <sip:0003908351673002@<HONEYPOT>:5060>\r\nCall-ID: zJenhRsRlbTCLNcuIZNfm2..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:1382>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:19:35", "event_id": "d2669f91-15b3-437c-8bb6-5a6e1eeb956b", "source_ip": "179.43.167.2", "source_port": 54284, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:0003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:54284;branch=z9hG4bK-524287-1---d16e8a8ff1aadf3a\r\nFrom: <sip:%40@<HONEYPOT>>;tag=6259ef10\r\nTo: <sip:0003908351673002@<HONEYPOT>:5060>\r\nCall-ID: nyxeFXxKNs4wtFmXPJlNA6..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:54284>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:10:27", "event_id": "6d5747ab-2116-450d-8684-23be9589ec93", "source_ip": "179.43.167.2", "source_port": 50904, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:9003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:50904;branch=z9hG4bK-524287-1---60c6a177e2c8dc41\r\nFrom: <sip:%40@<HONEYPOT>>;tag=a50fa0b2\r\nTo: <sip:9003908351673002@<HONEYPOT>:5060>\r\nCall-ID: 0wghdNSLqkpcUzXY3c6hfw..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:50904>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T22:02:22", "event_id": "c710fc59-5596-4e9e-ad73-651a32479dcf", "source_ip": "179.43.167.2", "source_port": 45274, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:9003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:45274;branch=z9hG4bK-524287-1---126d73f1f41880e9\r\nFrom: <sip:%40@<HONEYPOT>>;tag=47606ef7\r\nTo: <sip:9003908351673002@<HONEYPOT>:5060>\r\nCall-ID: KizlWgb6P30EjIJyvdmCTc..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:45274>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T21:53:14", "event_id": "68cd5bb0-d96c-4cac-bc2c-f9362186cb03", "source_ip": "179.43.167.2", "source_port": 28150, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1061, "dest_bytes": 12, "network_bytes": 1073, "event_summary": "INVITE sip:3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:28150;branch=z9hG4bK-524287-1---ea75d15952837629\r\nFrom: <sip:%40@<HONEYPOT>>;tag=bf3bbd59\r\nTo: <sip:3908351673002@<HONEYPOT>:5060>\r\nCall-ID: DfFdtnb0JVsSdhBMNRdc8l..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:28150>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T21:45:10", "event_id": "c5fc307e-7f2a-4c8b-82f5-a663d5942a79", "source_ip": "179.43.167.2", "source_port": 43322, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1065, "dest_bytes": 12, "network_bytes": 1077, "event_summary": "INVITE sip:3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:43322;branch=z9hG4bK-524287-1---9ae833af75d2df71\r\nFrom: <sip:%40@<HONEYPOT>>;tag=f679962f\r\nTo: <sip:3908351673002@<HONEYPOT>:5060>\r\nCall-ID: CzPH6TWTjDru4mE07p5ILs..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:43322>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T21:36:02", "event_id": "41369f76-c791-4728-b701-66c43133fab5", "source_ip": "179.43.167.2", "source_port": 57630, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:57630;branch=z9hG4bK-524287-1---ee37fa99ab536b75\r\nFrom: <sip:%40@<HONEYPOT>>;tag=e90729c5\r\nTo: <sip:90113908351673002@<HONEYPOT>:5060>\r\nCall-ID: LGJ9VkxfKz7DybiGpskbnB..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:57630>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T21:27:56", "event_id": "13f8d596-fff7-4a6f-936b-7677b3efea12", "source_ip": "179.43.167.2", "source_port": 53720, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1073, "dest_bytes": 12, "network_bytes": 1085, "event_summary": "INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:53720;branch=z9hG4bK-524287-1---305f8b2325565d62\r\nFrom: <sip:%40@<HONEYPOT>>;tag=a0820238\r\nTo: <sip:90113908351673002@<HONEYPOT>:5060>\r\nCall-ID: C4Do0Z4xVHEosy2f0o2GYL..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:53720>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T21:18:47", "event_id": "e30ed07c-ac99-4a45-bd09-041faf6cb71d", "source_ip": "179.43.167.2", "source_port": 59686, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1065, "dest_bytes": 12, "network_bytes": 1077, "event_summary": "INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:59686;branch=z9hG4bK-524287-1---43bb67d9fce197b4\r\nFrom: <sip:%40@<HONEYPOT>>;tag=a9faa500\r\nTo: <sip:003908351673002@<HONEYPOT>:5060>\r\nCall-ID: yvpGomNVmw4l4QMqXBInt0..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:59686>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-29T21:10:40", "event_id": "c6c3a633-27f1-4f0b-9983-a81038bae6a3", "source_ip": "179.43.167.2", "source_port": 61152, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:61152;branch=z9hG4bK-524287-1---66c6b6b5a364ac4d\r\nFrom: <sip:%40@<HONEYPOT>>;tag=695a5d56\r\nTo: <sip:003908351673002@<HONEYPOT>:5060>\r\nCall-ID: xHPt7iBd2mqRzTzI7EJ8sQ..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:61152>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T22:22:10", "event_id": "09bef26f-4f24-4992-a04e-14e8170bbfd5", "source_ip": "179.43.146.27", "source_port": 45640, "source_domain": "mta2.smartfastjoy3.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 2053, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2053\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i1310h1_f57a46bbacb6_e7c285222651", "tls_client_ja3": "faa162b5a653756fba26803ea81b362f", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 170, "dest_bytes": 78, "network_bytes": 248, "event_summary": ""} +{"timestamp": "2026-08-30T21:36:05", "event_id": "5725fe74-0760-4aad-b21e-ca3b8586e73b", "source_ip": "179.43.146.27", "source_port": 40548, "source_domain": "mta2.smartfastjoy3.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 2052, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", "url_path": "/", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2052\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 170, "dest_bytes": 78, "network_bytes": 248, "event_summary": ""} +{"timestamp": "2026-08-30T20:19:47", "event_id": "f71aa9b6-4df2-4eb4-822a-81fbc6cb0a02", "source_ip": "141.255.165.69", "source_port": 26452, "source_domain": "hooksandheels.net", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T20:19:21", "event_id": "c2d18bfb-c167-4f48-b785-9a5f7931dba1", "source_ip": "141.255.165.66", "source_port": 29980, "source_domain": "4soho.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T20:19:21", "event_id": "934aec4c-5cc2-4836-bc36-4ab37e960b51", "source_ip": "141.255.165.68", "source_port": 41322, "source_domain": "eternalpink.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T20:19:17", "event_id": "7b0eb6ae-0086-411e-9d78-f6b358c81cac", "source_ip": "141.255.165.69", "source_port": 55990, "source_domain": "hooksandheels.net", "country_code": "CH", "country_name": "Switzerland", "city_name": "Zurich", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\ufffd\ufffd\u0000\u0001local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000cananian\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T12:11:49", "event_id": "45274697-5dfe-4e13-8ddc-f48e5529ba97", "source_ip": "179.43.167.2", "source_port": 45874, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:90013908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:45874;branch=z9hG4bK-524287-1---3cc68cf71a83c441\r\nFrom: <sip:%40@<HONEYPOT>>;tag=1ed0fb8c\r\nTo: <sip:90013908351673002@<HONEYPOT>:5060>\r\nCall-ID: aRzv71qETpv1cok0jE8uoz..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:45874>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T11:58:16", "event_id": "02427af3-e60e-4c1a-972d-85cf7bf0e232", "source_ip": "179.43.167.2", "source_port": 21054, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1073, "dest_bytes": 12, "network_bytes": 1085, "event_summary": "INVITE sip:90013908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:21054;branch=z9hG4bK-524287-1---cb8f9ce8a67a1137\r\nFrom: <sip:%40@<HONEYPOT>>;tag=5a7fb685\r\nTo: <sip:90013908351673002@<HONEYPOT>:5060>\r\nCall-ID: mOYlJm7d3drR9bGCUB6Q1v..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:21054>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T11:43:02", "event_id": "7e86aad1-c71a-42b7-9f2f-99192786a568", "source_ip": "179.43.167.2", "source_port": 56274, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:90123908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:56274;branch=z9hG4bK-524287-1---995e1c7494baebf9\r\nFrom: <sip:%40@<HONEYPOT>>;tag=048f01c8\r\nTo: <sip:90123908351673002@<HONEYPOT>:5060>\r\nCall-ID: yQtmNdIEq0HTOUfOQXl8nY..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:56274>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T11:29:29", "event_id": "4934a352-4d0a-47a4-ba95-2dc151cc278b", "source_ip": "179.43.167.2", "source_port": 8882, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:90123908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:8882;branch=z9hG4bK-524287-1---75d881d353345487\r\nFrom: <sip:%40@<HONEYPOT>>;tag=71efda1c\r\nTo: <sip:90123908351673002@<HONEYPOT>:5060>\r\nCall-ID: J5MoxNcfR7cyi4LhLK5K2e..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:8882>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T11:14:15", "event_id": "3369f495-92e8-4373-8d40-7acce962258a", "source_ip": "179.43.167.2", "source_port": 24962, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 99000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:90103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:24962;branch=z9hG4bK-524287-1---9bc29b96647e6e80\r\nFrom: <sip:%40@<HONEYPOT>>;tag=5822cee3\r\nTo: <sip:90103908351673002@<HONEYPOT>:5060>\r\nCall-ID: eaFzzNBYE56JEQqKuiwtgH..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:24962>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T11:00:42", "event_id": "132523f4-f6fe-4192-828b-715d8b9f085a", "source_ip": "179.43.167.2", "source_port": 5742, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:90103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:5742;branch=z9hG4bK-524287-1---832c19cb92f65a74\r\nFrom: <sip:%40@<HONEYPOT>>;tag=41f203ce\r\nTo: <sip:90103908351673002@<HONEYPOT>:5060>\r\nCall-ID: 0nZoOiqIrchJosfUKLiQmx..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:5742>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T10:45:27", "event_id": "0e661c31-87e1-4bf7-91ac-2ac51cfe9300", "source_ip": "179.43.167.2", "source_port": 51574, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:900113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:51574;branch=z9hG4bK-524287-1---bb852e3f9f5a7173\r\nFrom: <sip:%40@<HONEYPOT>>;tag=ac66b72d\r\nTo: <sip:900113908351673002@<HONEYPOT>:5060>\r\nCall-ID: 3FNwct7jScyfZ5jPB9raP1..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:51574>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T10:31:54", "event_id": "3699b0ee-42a5-4840-a5bd-f4293965c02d", "source_ip": "179.43.167.2", "source_port": 35678, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1075, "dest_bytes": 12, "network_bytes": 1087, "event_summary": "INVITE sip:900113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:35678;branch=z9hG4bK-524287-1---a1493b2c690027e3\r\nFrom: <sip:%40@<HONEYPOT>>;tag=c5b702db\r\nTo: <sip:900113908351673002@<HONEYPOT>:5060>\r\nCall-ID: RDIOOMTABMcyAKHd9LGw5Z..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:35678>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T10:16:40", "event_id": "d674bd52-0a13-4ed8-bd86-568553c9a1af", "source_ip": "179.43.167.2", "source_port": 30314, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 99000000, "source_bytes": 1069, "dest_bytes": 12, "network_bytes": 1081, "event_summary": "INVITE sip:98103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:30314;branch=z9hG4bK-524287-1---d2be98a6327d0db1\r\nFrom: <sip:%40@<HONEYPOT>>;tag=9fdd8311\r\nTo: <sip:98103908351673002@<HONEYPOT>:5060>\r\nCall-ID: CUBKGiUfbi3DIigNW7oYrb..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:30314>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T10:03:07", "event_id": "a622c4ab-4a0c-440c-9ba2-22481f0695d5", "source_ip": "179.43.167.2", "source_port": 6420, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 98000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:98103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:6420;branch=z9hG4bK-524287-1---93b62c4878e98a97\r\nFrom: <sip:%40@<HONEYPOT>>;tag=9d84e9e5\r\nTo: <sip:98103908351673002@<HONEYPOT>:5060>\r\nCall-ID: 7USmlKzCRttc1tVRa3bbSX..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:6420>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T09:47:52", "event_id": "f59fa655-6009-48d1-99c3-ca0ba0e9ea01", "source_ip": "179.43.167.2", "source_port": 4920, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:90003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:4920;branch=z9hG4bK-524287-1---2efc8f84fc557b55\r\nFrom: <sip:%40@<HONEYPOT>>;tag=79a0a0dd\r\nTo: <sip:90003908351673002@<HONEYPOT>:5060>\r\nCall-ID: ro05azL8nMqhZbFmJcVtyd..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:4920>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T09:34:20", "event_id": "1ec7b252-6012-434c-a488-6aa07cf81978", "source_ip": "179.43.167.2", "source_port": 48364, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 99000000, "source_bytes": 1073, "dest_bytes": 12, "network_bytes": 1085, "event_summary": "INVITE sip:90003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:48364;branch=z9hG4bK-524287-1---177c7eaf6117392b\r\nFrom: <sip:%40@<HONEYPOT>>;tag=3553a58e\r\nTo: <sip:90003908351673002@<HONEYPOT>:5060>\r\nCall-ID: Frr8F6VWPBMItKOotzcW5D..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:48364>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T09:19:05", "event_id": "b6e4caf7-3076-43cf-bb0a-55217d567ac8", "source_ip": "179.43.167.2", "source_port": 14648, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 99000000, "source_bytes": 1067, "dest_bytes": 12, "network_bytes": 1079, "event_summary": "INVITE sip:0013908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:14648;branch=z9hG4bK-524287-1---1075b97d3e957570\r\nFrom: <sip:%40@<HONEYPOT>>;tag=2bfd3183\r\nTo: <sip:0013908351673002@<HONEYPOT>:5060>\r\nCall-ID: dZqR1AALEd4t7Mrsh94VzE..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:14648>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16619816341@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T09:05:33", "event_id": "ceed952a-cdb3-48ed-acb3-fd1e94c98aa3", "source_ip": "179.43.167.2", "source_port": 45800, "source_domain": "hostedby.privatelayer.com", "country_code": "CH", "country_name": "Switzerland", "city_name": "R\u00fcmlang", "asn_number": 51852, "asn_org": "Private Layer INC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 1071, "dest_bytes": 12, "network_bytes": 1083, "event_summary": "INVITE sip:0013908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.2:45800;branch=z9hG4bK-524287-1---95e80c7428d9795a\r\nFrom: <sip:%40@<HONEYPOT>>;tag=b809dbdf\r\nTo: <sip:0013908351673002@<HONEYPOT>:5060>\r\nCall-ID: HcfxNg5qer7RPKgxzokvcF..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.2:45800>\r\nUser-Agent: M800C/v.7.40A.250.440\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612133893@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.2\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.2\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n"} diff --git a/kevlar/2026-08-31/honeylabs/events-AS57043.ndjson b/kevlar/2026-08-31/honeylabs/events-AS57043.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS57043.ndjson diff --git a/kevlar/2026-08-31/honeylabs/events-AS58854.ndjson b/kevlar/2026-08-31/honeylabs/events-AS58854.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS58854.ndjson diff --git a/kevlar/2026-08-31/honeylabs/fingerprints.csv b/kevlar/2026-08-31/honeylabs/fingerprints.csv new file mode 100644 index 0000000..3fb1579 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/fingerprints.csv @@ -0,0 +1,41 @@ +asn,name,type,fingerprint,source_ip
+AS210644,AEZA-AS,JA4,t12i130500_2d7513195f68_e51b7354d87f,217.144.190.138
+AS210644,AEZA-AS,JA4H,ge11nn0500_9af7e0472034,217.144.190.138
+AS210644,AEZA-AS,JA4H,ge11nn0400_88d30a62b7ad,217.144.190.138
+AS210644,AEZA-AS,JA4,t13i1909h2_9dc949149365_97f8aa674fd9,147.45.71.214
+AS210644,AEZA-AS,HASSH,19532158b559096b89b1a5f7d17175b2,185.246.217.150
+AS210644,AEZA-AS,JA4,t13i190900_9dc949149365_e7c285222651,176.124.203.177
+AS138915,KAOPU-HK (Kaopu Cloud HK Limited),JA4,t13i220900_231e334592e8_29829a46703f,154.90.37.55
+AS138915,KAOPU-HK (Kaopu Cloud HK Limited),JA4H,po11nn0400_52fce913cf3b,154.90.37.55
+AS14956,ROUTERHOSTING (RouterHosting LLC),JA4H,ge11nn0500_39072d476f20,107.189.26.103
+AS14956,ROUTERHOSTING (RouterHosting LLC),JA4,t13i100900_61a7ad8aa9b6_88aa062a14c8,144.172.99.12
+AS14956,ROUTERHOSTING (RouterHosting LLC),JA4H,ge11nn0300_7fd797acd99d,144.172.99.12
+AS14956,ROUTERHOSTING (RouterHosting LLC),HASSH,bf7dbf67fa9b26ee9f9deb99c49320ba,45.61.182.81
+AS14956,ROUTERHOSTING (RouterHosting LLC),JA4H,ge11nn0400_9c3956fad5da,167.88.168.121
+AS14956,ROUTERHOSTING (RouterHosting LLC),JA4,t13i311000_e8f1e7e78f70_d41ae481755e,144.172.115.222
+AS51852,PLI-AS,JA4H,ge11nn0400_9c3956fad5da,81.17.28.131
+AS51852,PLI-AS,JA4H,ge11nn0300_341eb0d8946c,179.43.150.26
+AS51852,PLI-AS,JA4,t13i1310h1_f57a46bbacb6_e7c285222651,179.43.146.27
+AS51396,PFCLOUD (Pfcloud UG),JA4H,ge11nn0400_9c3956fad5da,45.135.194.113
+AS51396,PFCLOUD (Pfcloud UG),JA4H,ge11nn0400_88d30a62b7ad,176.65.149.236
+AS51396,PFCLOUD (Pfcloud UG),JA4,t13i140900_cbb2034c60b8_e7c285222651,176.65.148.226
+AS51396,PFCLOUD (Pfcloud UG),JA4H,ge11nn0500_cac2c496544b,176.65.148.226
+AS51396,PFCLOUD (Pfcloud UG),JA4H,ge11nn0500_9af7e0472034,176.65.149.201
+AS51396,PFCLOUD (Pfcloud UG),JA4,t13i190800_9dc949149365_97f8aa674fd9,45.135.193.198
+AS51396,PFCLOUD (Pfcloud UG),JA4H,ge10nn0200_3ed38b250d3d,45.135.193.198
+AS51396,PFCLOUD (Pfcloud UG),JA4,t13i1909h2_9dc949149365_97f8aa674fd9,176.65.149.188
+AS51396,PFCLOUD (Pfcloud UG),JA4H,ge11nn0500_d3a2dcb1cd63,176.65.148.71
+AS51396,PFCLOUD (Pfcloud UG),JA4,t13i251000_b78ed14e2fd0_ab7e3b40a677,77.83.39.94
+AS200651,FLOKINET,HASSH,e54ef3ec27fe1fea7ab64d3fa05359fd,185.100.87.136
+AS200651,FLOKINET,JA4H,po11nn0600_c9506d37ac14,185.100.87.136
+AS200651,FLOKINET,JA4,t13i1909h2_9dc949149365_97f8aa674fd9,185.100.87.136
+AS200651,FLOKINET,JA4H,ge11nn0400_88d30a62b7ad,185.100.87.136
+AS200651,FLOKINET,JA4H,po11nn0500_e4a47a99f1ac,185.100.87.136
+AS214351,FEMOIT,JA4H,ge11nn0500_2d30dc89d981,192.162.199.180
+AS198953,PROTON66,JA4,t13i1010h1_61a7ad8aa9b6_792d2c6655cb,176.120.22.43
+AS198953,PROTON66,JA4H,po11nn18en_9a6afedbb443,176.120.22.43
+AS198953,PROTON66,JA4,t13i1010h1_61a7ad8aa9b6_3a8073edd8ef,176.120.22.43
+AS198953,PROTON66,JA4H,ge11nn0400_8b1ed2202073,176.120.22.43
+AS198953,PROTON66,JA4H,ge11cn06ru_b2fb244bb31f,176.120.22.43
+AS198953,PROTON66,JA4H,po11nn0500_63d29dec8e1d,176.120.22.43
+AS198953,PROTON66,JA4H,ge11nn05en_3bd45b6f184e,176.120.22.43
diff --git a/kevlar/2026-08-31/honeylabs/ioc-107.189.26.103.json b/kevlar/2026-08-31/honeylabs/ioc-107.189.26.103.json new file mode 100644 index 0000000..3be0330 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-107.189.26.103.json @@ -0,0 +1,72 @@ +{ + "total_events": 148, + "first_seen": "2026-08-20T14:44:13", + "last_seen": "2026-08-25T23:21:07", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 80, + 2375 + ], + "ports_targeted_count": 2, + "tls_event_count": 0, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "libredtail-http" + ], + "top_url_paths": [ + "/containers/json", + "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" + ], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "103.26.189.107.static.cloudzy.com", + "loader_hits": 6, + "exploit_hits": 135, + "bytes_sent": 1826936, + "unique_source_ips": 1, + "ioc": "107.189.26.103", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "malicious", + "verdict": "Exploit attempts observed", + "verdict_why": [ + "135 request(s) matched a known exploit path.", + "Exploit-path hits present; HTTP verb mix unknown, so read cautiously.", + "5+ hits raise confidence to high.", + "Not in any known-scanner range.", + "Sent 1,826,936 bytes: sustained payload delivery, not a single opportunistic request." + ], + "verdict_confidence": "high", + "cve_probes": [ + { + "cve_id": "CVE-2017-9841", + "title": "PHPUnit - Remote Code Execution", + "severity": "critical", + "actively_exploited": true + }, + { + "cve_id": "CVE-2021-42013", + "title": "Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution", + "severity": "critical", + "actively_exploited": true + } + ] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-147.45.71.214.json b/kevlar/2026-08-31/honeylabs/ioc-147.45.71.214.json new file mode 100644 index 0000000..917b28b --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-147.45.71.214.json @@ -0,0 +1,64 @@ +{ + "total_events": 36, + "first_seen": "2026-08-28T20:14:49", + "last_seen": "2026-08-29T08:27:41", + "asn_number": 210644, + "asn_org": "Aeza Group LLC", + "country_name": "Austria", + "country_code": "AT", + "ports_targeted": [ + 8080, + 8090, + 8081, + 8085, + 8999, + 8989, + 8282 + ], + "ports_targeted_count": 7, + "tls_event_count": 25, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", + "Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", + "Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3", + "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18", + "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18" + ], + "top_url_paths": [ + "/", + "/favicon.ico", + "/v1/getinfo" + ], + "top_ja4_fingerprints": [ + "t12i130500_2d7513195f68_e51b7354d87f", + "t13i1909h2_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "cba7f34191ef2379c1325641f6c6c4f4", + "7c1e207beb00684bbbe144f1b0abe1d5" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8107, + "unique_source_ips": 1, + "ioc": "147.45.71.214", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "36 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 8,107 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json b/kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json new file mode 100644 index 0000000..3b57abc --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json @@ -0,0 +1,56 @@ +{ + "total_events": 7, + "first_seen": "2026-07-22T10:02:16", + "last_seen": "2026-08-27T07:59:32", + "asn_number": 138915, + "asn_org": "Kaopu Cloud HK Limited", + "country_name": "Philippines", + "country_code": "PH", + "ports_targeted": [ + 1190, + 5986, + 6666, + 11111, + 9092, + 9030 + ], + "ports_targeted_count": 6, + "tls_event_count": 1, + "top_http_methods": [ + "POST" + ], + "top_user_agents": [ + "Microsoft WinRM Client" + ], + "top_url_paths": [ + "/wsman?PSVersion=5.1.19041.1" + ], + "top_ja4_fingerprints": [ + "t13i220900_231e334592e8_29829a46703f" + ], + "top_ja3_fingerprints": [ + "622a7fd6adbafa3736c1a3468db8a8e0" + ], + "top_hassh_fingerprints": [ + "eb0e0554de9aeb368191c86016a40080" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 1124, + "unique_source_ips": 1, + "ioc": "154.90.37.55", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "7 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-176.120.22.61.json b/kevlar/2026-08-31/honeylabs/ioc-176.120.22.61.json new file mode 100644 index 0000000..2a9c203 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-176.120.22.61.json @@ -0,0 +1,89 @@ +{ + "total_events": 9934, + "first_seen": "2026-03-10T13:01:04", + "last_seen": "2026-08-31T09:44:38", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 1435, + 1433, + 1434, + 3433, + 11433, + 3005, + 14333, + 1800, + 5005, + 14330, + 8433, + 2433, + 1533, + 8888, + 18433, + 1437, + 23341, + 33000, + 7433, + 1455, + 4171, + 21433, + 6240, + 25366, + 61433, + 9999, + 41433, + 6802, + 2468, + 12433, + 10433, + 42130, + 5000, + 5367, + 43399, + 1444, + 3333, + 6433, + 6366, + 51433, + 1551, + 3341, + 6602, + 17433, + 22020, + 9433, + 14331, + 1002, + 1501, + 45366 + ], + "ports_targeted_count": 289, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 476678, + "unique_source_ips": 1, + "ioc": "176.120.22.61", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 289 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-179.43.167.2.json b/kevlar/2026-08-31/honeylabs/ioc-179.43.167.2.json new file mode 100644 index 0000000..66d5ab5 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-179.43.167.2.json @@ -0,0 +1,40 @@ +{ + "total_events": 71, + "first_seen": "2026-08-29T20:36:09", + "last_seen": "2026-08-30T12:11:49", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 5060 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "hostedby.privatelayer.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 75899, + "unique_source_ips": 1, + "ioc": "179.43.167.2", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "71 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 75,899 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-185.100.87.136.json b/kevlar/2026-08-31/honeylabs/ioc-185.100.87.136.json new file mode 100644 index 0000000..1ebcb34 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-185.100.87.136.json @@ -0,0 +1,69 @@ +{ + "total_events": 365, + "first_seen": "2026-02-16T21:48:36", + "last_seen": "2026-08-31T06:06:56", + "asn_number": 200651, + "asn_org": "FlokiNET ehf", + "country_name": "Romania", + "country_code": "RO", + "ports_targeted": [ + 443, + 80, + 8080, + 444, + 2222, + 22, + 8443 + ], + "ports_targeted_count": 7, + "tls_event_count": 97, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", + "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17" + ], + "top_url_paths": [ + "/", + "/images/transparentpix.gif", + "/eventmanager", + "/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows", + "/ajax", + "/api/checkin", + "/api/v1/update", + "/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7" + ], + "top_ja4_fingerprints": [ + "t13i1909h2_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "7c1e207beb00684bbbe144f1b0abe1d5" + ], + "top_hassh_fingerprints": [ + "e54ef3ec27fe1fea7ab64d3fa05359fd" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 38825, + "unique_source_ips": 1, + "ioc": "185.100.87.136", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "365 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 38,825 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json b/kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json new file mode 100644 index 0000000..cdbcf83 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json @@ -0,0 +1,39 @@ +{ + "total_events": 1, + "first_seen": "2026-08-30T15:38:28", + "last_seen": "2026-08-30T15:38:28", + "asn_number": 400992, + "asn_org": "ZhouyiSat Communications", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 25565 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 22, + "unique_source_ips": 1, + "ioc": "194.48.142.134", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json b/kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json new file mode 100644 index 0000000..6789dcf --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json @@ -0,0 +1,95 @@ +{ + "total_events": 3000, + "first_seen": "2026-08-10T12:50:10", + "last_seen": "2026-08-31T11:08:11", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 49226, + 10800, + 58989, + 1918, + 69, + 53000, + 2086, + 64, + 1036, + 2067, + 2081, + 60001, + 161, + 1994, + 1008, + 31276, + 38080, + 32926, + 32764, + 32626, + 31457, + 31434, + 31433, + 33142, + 31280, + 32946, + 31223, + 31220, + 31054, + 31046, + 31033, + 31021, + 30979, + 26312, + 30750, + 30501, + 31281, + 30226, + 33333, + 33761, + 34564, + 34599, + 35000, + 35452, + 35554, + 35561, + 37364, + 37647, + 37890, + 32768 + ], + "ports_targeted_count": 524, + "tls_event_count": 0, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Go-http-client/1.1" + ], + "top_url_paths": [ + "http://azenv.net/" + ], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.7.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 197734, + "unique_source_ips": 1, + "ioc": "204.76.203.7", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 524 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-62.60.226.150.json b/kevlar/2026-08-31/honeylabs/ioc-62.60.226.150.json new file mode 100644 index 0000000..01a1092 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-62.60.226.150.json @@ -0,0 +1,39 @@ +{ + "total_events": 6, + "first_seen": "2026-08-22T16:21:05", + "last_seen": "2026-08-28T22:58:01", + "asn_number": 214351, + "asn_org": "Femo It Solutions Limited", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 1723 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 936, + "unique_source_ips": 1, + "ioc": "62.60.226.150", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "6 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:107.189.26.103.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:107.189.26.103.json new file mode 100644 index 0000000..b60ba3d --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:107.189.26.103.json @@ -0,0 +1,72 @@ +{ + "total_events": 148, + "first_seen": "2026-08-20T14:44:13", + "last_seen": "2026-08-25T23:21:07", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 80, + 2375 + ], + "ports_targeted_count": 2, + "tls_event_count": 0, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "libredtail-http" + ], + "top_url_paths": [ + "/containers/json", + "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" + ], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "103.26.189.107.static.cloudzy.com", + "loader_hits": 6, + "exploit_hits": 135, + "bytes_sent": 1826936, + "unique_source_ips": 1, + "ioc": "::ffff:107.189.26.103", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "malicious", + "verdict": "Exploit attempts observed", + "verdict_why": [ + "135 request(s) matched a known exploit path.", + "Exploit-path hits present; HTTP verb mix unknown, so read cautiously.", + "5+ hits raise confidence to high.", + "Not in any known-scanner range.", + "Sent 1,826,936 bytes: sustained payload delivery, not a single opportunistic request." + ], + "verdict_confidence": "high", + "cve_probes": [ + { + "cve_id": "CVE-2017-9841", + "title": "PHPUnit - Remote Code Execution", + "severity": "critical", + "actively_exploited": true + }, + { + "cve_id": "CVE-2021-42013", + "title": "Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution", + "severity": "critical", + "actively_exploited": true + } + ] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:147.45.71.214.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:147.45.71.214.json new file mode 100644 index 0000000..6d977c1 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:147.45.71.214.json @@ -0,0 +1,64 @@ +{ + "total_events": 36, + "first_seen": "2026-08-28T20:14:49", + "last_seen": "2026-08-29T08:27:41", + "asn_number": 210644, + "asn_org": "Aeza Group LLC", + "country_name": "Austria", + "country_code": "AT", + "ports_targeted": [ + 8080, + 8090, + 8081, + 8085, + 8999, + 8989, + 8282 + ], + "ports_targeted_count": 7, + "tls_event_count": 25, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15", + "Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", + "Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3", + "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18", + "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18" + ], + "top_url_paths": [ + "/", + "/favicon.ico", + "/v1/getinfo" + ], + "top_ja4_fingerprints": [ + "t12i130500_2d7513195f68_e51b7354d87f", + "t13i1909h2_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "cba7f34191ef2379c1325641f6c6c4f4", + "7c1e207beb00684bbbe144f1b0abe1d5" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8107, + "unique_source_ips": 1, + "ioc": "::ffff:147.45.71.214", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "36 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 8,107 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json new file mode 100644 index 0000000..2fe467f --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json @@ -0,0 +1,56 @@ +{ + "total_events": 7, + "first_seen": "2026-07-22T10:02:16", + "last_seen": "2026-08-27T07:59:32", + "asn_number": 138915, + "asn_org": "Kaopu Cloud HK Limited", + "country_name": "Philippines", + "country_code": "PH", + "ports_targeted": [ + 1190, + 5986, + 6666, + 11111, + 9092, + 9030 + ], + "ports_targeted_count": 6, + "tls_event_count": 1, + "top_http_methods": [ + "POST" + ], + "top_user_agents": [ + "Microsoft WinRM Client" + ], + "top_url_paths": [ + "/wsman?PSVersion=5.1.19041.1" + ], + "top_ja4_fingerprints": [ + "t13i220900_231e334592e8_29829a46703f" + ], + "top_ja3_fingerprints": [ + "622a7fd6adbafa3736c1a3468db8a8e0" + ], + "top_hassh_fingerprints": [ + "eb0e0554de9aeb368191c86016a40080" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 1124, + "unique_source_ips": 1, + "ioc": "::ffff:154.90.37.55", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "7 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:176.120.22.61.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:176.120.22.61.json new file mode 100644 index 0000000..5f1be66 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:176.120.22.61.json @@ -0,0 +1,89 @@ +{ + "total_events": 9934, + "first_seen": "2026-03-10T13:01:04", + "last_seen": "2026-08-31T09:44:38", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 1435, + 1433, + 1434, + 3433, + 11433, + 3005, + 14333, + 1800, + 5005, + 14330, + 8433, + 2433, + 1533, + 8888, + 18433, + 1437, + 23341, + 33000, + 7433, + 1455, + 4171, + 21433, + 6240, + 25366, + 61433, + 9999, + 41433, + 6802, + 2468, + 12433, + 10433, + 42130, + 5000, + 5367, + 43399, + 1444, + 3333, + 6433, + 6366, + 51433, + 1551, + 3341, + 6602, + 17433, + 22020, + 9433, + 14331, + 1002, + 1501, + 45366 + ], + "ports_targeted_count": 289, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 476678, + "unique_source_ips": 1, + "ioc": "::ffff:176.120.22.61", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 289 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:179.43.167.2.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:179.43.167.2.json new file mode 100644 index 0000000..285932a --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:179.43.167.2.json @@ -0,0 +1,40 @@ +{ + "total_events": 71, + "first_seen": "2026-08-29T20:36:09", + "last_seen": "2026-08-30T12:11:49", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 5060 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "hostedby.privatelayer.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 75899, + "unique_source_ips": 1, + "ioc": "::ffff:179.43.167.2", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "71 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 75,899 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:185.100.87.136.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:185.100.87.136.json new file mode 100644 index 0000000..f59a926 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:185.100.87.136.json @@ -0,0 +1,69 @@ +{ + "total_events": 365, + "first_seen": "2026-02-16T21:48:36", + "last_seen": "2026-08-31T06:06:56", + "asn_number": 200651, + "asn_org": "FlokiNET ehf", + "country_name": "Romania", + "country_code": "RO", + "ports_targeted": [ + 443, + 80, + 8080, + 444, + 2222, + 22, + 8443 + ], + "ports_targeted_count": 7, + "tls_event_count": 97, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", + "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17" + ], + "top_url_paths": [ + "/", + "/images/transparentpix.gif", + "/eventmanager", + "/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows", + "/ajax", + "/api/checkin", + "/api/v1/update", + "/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7" + ], + "top_ja4_fingerprints": [ + "t13i1909h2_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "7c1e207beb00684bbbe144f1b0abe1d5" + ], + "top_hassh_fingerprints": [ + "e54ef3ec27fe1fea7ab64d3fa05359fd" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 38825, + "unique_source_ips": 1, + "ioc": "::ffff:185.100.87.136", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "365 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 38,825 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:194.48.142.134.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:194.48.142.134.json new file mode 100644 index 0000000..f57517c --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:194.48.142.134.json @@ -0,0 +1,39 @@ +{ + "total_events": 1, + "first_seen": "2026-08-30T15:38:28", + "last_seen": "2026-08-30T15:38:28", + "asn_number": 400992, + "asn_org": "ZhouyiSat Communications", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 25565 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 22, + "unique_source_ips": 1, + "ioc": "::ffff:194.48.142.134", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:204.76.203.7.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:204.76.203.7.json new file mode 100644 index 0000000..7bcab22 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:204.76.203.7.json @@ -0,0 +1,95 @@ +{ + "total_events": 3000, + "first_seen": "2026-08-10T12:50:10", + "last_seen": "2026-08-31T11:08:11", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 49226, + 10800, + 58989, + 1918, + 53000, + 2086, + 2081, + 69, + 64, + 1036, + 2067, + 1994, + 60001, + 161, + 1008, + 32768, + 31434, + 38159, + 38157, + 38080, + 37890, + 30051, + 37364, + 38582, + 35561, + 35554, + 35452, + 35000, + 34599, + 34564, + 33761, + 33333, + 33142, + 38777, + 32946, + 32926, + 37647, + 32764, + 30081, + 30115, + 30116, + 30127, + 30129, + 30226, + 30501, + 30750, + 30979, + 31021, + 31033, + 38414 + ], + "ports_targeted_count": 524, + "tls_event_count": 0, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Go-http-client/1.1" + ], + "top_url_paths": [ + "http://azenv.net/" + ], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.7.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 197734, + "unique_source_ips": 1, + "ioc": "::ffff:204.76.203.7", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 524 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:62.60.226.150.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:62.60.226.150.json new file mode 100644 index 0000000..9496e4f --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:62.60.226.150.json @@ -0,0 +1,39 @@ +{ + "total_events": 6, + "first_seen": "2026-08-22T16:21:05", + "last_seen": "2026-08-28T22:58:01", + "asn_number": 214351, + "asn_org": "Femo It Solutions Limited", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 1723 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 936, + "unique_source_ips": 1, + "ioc": "::ffff:62.60.226.150", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "6 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/observed-ips.json b/kevlar/2026-08-31/honeylabs/observed-ips.json new file mode 100644 index 0000000..5cc8edc --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/observed-ips.json @@ -0,0 +1,179 @@ +{ + "AS57043": { + "name": "HOSTKEY-AS", + "ips": [] + }, + "AS209847": { + "name": "THE", + "ips": [] + }, + "AS210644": { + "name": "AEZA-AS", + "ips": [ + "147.45.71.214", + "176.124.203.177", + "185.246.217.150", + "217.144.190.138" + ] + }, + "AS138915": { + "name": "KAOPU-HK (Kaopu Cloud HK Limited)", + "ips": [ + "154.90.37.55" + ] + }, + "AS14956": { + "name": "ROUTERHOSTING (RouterHosting LLC)", + "ips": [ + "107.189.17.181", + "107.189.26.103", + "144.172.100.235", + "144.172.111.21", + "144.172.115.222", + "144.172.116.49", + "144.172.94.243", + "144.172.99.12", + "153.75.82.185", + "167.88.168.121", + "172.86.114.162", + "172.86.114.254", + "172.86.91.225", + "45.61.129.23", + "45.61.170.85", + "45.61.177.179", + "45.61.177.185", + "45.61.182.81" + ] + }, + "AS216139": { + "name": "IRONHOST", + "ips": [] + }, + "AS51852": { + "name": "PLI-AS", + "ips": [ + "141.255.165.66", + "141.255.165.67", + "141.255.165.68", + "141.255.165.69", + "179.43.146.27", + "179.43.150.26", + "179.43.167.2", + "185.12.44.133", + "81.17.28.131" + ] + }, + "AS400992": { + "name": "ZHOUYISAT-COMMUNICATIONS", + "ips": [ + "194.48.142.134" + ] + }, + "AS33993": { + "name": "UFO-AS", + "ips": [] + }, + "AS51396": { + "name": "PFCLOUD (Pfcloud UG)", + "ips": [ + "176.65.134.52", + "176.65.148.216", + "176.65.148.226", + "176.65.148.29", + "176.65.148.71", + "176.65.148.96", + "176.65.149.188", + "176.65.149.201", + "176.65.149.212", + "176.65.149.220", + "176.65.149.224", + "176.65.149.230", + "176.65.149.236", + "176.65.149.27", + "176.65.149.30", + "176.65.149.31", + "176.65.149.64", + "176.65.149.67", + "204.76.203.14", + "204.76.203.4", + "204.76.203.49", + "204.76.203.7", + "45.135.193.193", + "45.135.193.198", + "45.135.194.113", + "45.135.194.99", + "77.83.39.94", + "94.183.174.77" + ] + }, + "AS213702": { + "name": "QWINS-LTD", + "ips": [] + }, + "AS216246": { + "name": "RU-AEZA-AS", + "ips": [] + }, + "AS200651": { + "name": "FLOKINET", + "ips": [ + "185.100.87.136" + ] + }, + "AS30823": { + "name": "AUROLOGIC (aurologic GmbH)", + "ips": [] + }, + "AS140666": { + "name": "ADPL-AS-AP (ANY DIGITAL PTE. LTD.)", + "ips": [] + }, + "AS214351": { + "name": "FEMOIT", + "ips": [ + "192.162.199.180", + "62.60.226.150" + ] + }, + "AS198953": { + "name": "PROTON66", + "ips": [ + "176.120.22.240", + "176.120.22.43", + "176.120.22.61", + "193.143.1.66" + ] + }, + "AS200593": { + "name": "PROSPERO-AS", + "ips": [] + }, + "AS214940": { + "name": "KPRONET", + "ips": [] + }, + "AS206728": { + "name": "MEDIALAND-AS", + "ips": [] + }, + "AS211720": { + "name": "Datashield, Inc.", + "ips": [] + }, + "AS216309": { + "name": "INVISIONTECH-GROUP-SRL", + "ips": [] + }, + "AS58854": { + "name": "KAOPY (Kaopu Cloud)", + "ips": [] + }, + "AS202685": { + "name": "TR-ARKEL", + "ips": [] + }, + "AS394711": { + "name": "KORGRID (KorGrid LLC)", + "ips": [] + } +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/summary.json b/kevlar/2026-08-31/honeylabs/summary.json new file mode 100644 index 0000000..d7e2850 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/summary.json @@ -0,0 +1,127 @@ +{ + "AS57043": { + "name": "HOSTKEY-AS", + "events": 0, + "uniq_ips": 0 + }, + "AS209847": { + "name": "THE", + "events": 0, + "uniq_ips": 0 + }, + "AS210644": { + "name": "AEZA-AS", + "events": 44, + "uniq_ips": 4 + }, + "AS138915": { + "name": "KAOPU-HK (Kaopu Cloud HK Limited)", + "events": 1, + "uniq_ips": 1 + }, + "AS14956": { + "name": "ROUTERHOSTING (RouterHosting LLC)", + "events": 36, + "uniq_ips": 18 + }, + "AS216139": { + "name": "IRONHOST", + "events": 0, + "uniq_ips": 0 + }, + "AS51852": { + "name": "PLI-AS", + "events": 102, + "uniq_ips": 9 + }, + "AS400992": { + "name": "ZHOUYISAT-COMMUNICATIONS", + "events": 1, + "uniq_ips": 1 + }, + "AS33993": { + "name": "UFO-AS", + "events": 0, + "uniq_ips": 0 + }, + "AS51396": { + "name": "PFCLOUD (Pfcloud UG)", + "events": 156, + "uniq_ips": 28 + }, + "AS213702": { + "name": "QWINS-LTD", + "events": 0, + "uniq_ips": 0 + }, + "AS216246": { + "name": "RU-AEZA-AS", + "events": 0, + "uniq_ips": 0 + }, + "AS200651": { + "name": "FLOKINET", + "events": 12, + "uniq_ips": 1 + }, + "AS30823": { + "name": "AUROLOGIC (aurologic GmbH)", + "events": 0, + "uniq_ips": 0 + }, + "AS140666": { + "name": "ADPL-AS-AP (ANY DIGITAL PTE. LTD.)", + "events": 0, + "uniq_ips": 0 + }, + "AS214351": { + "name": "FEMOIT", + "events": 6, + "uniq_ips": 2 + }, + "AS198953": { + "name": "PROTON66", + "events": 134, + "uniq_ips": 4 + }, + "AS200593": { + "name": "PROSPERO-AS", + "events": 0, + "uniq_ips": 0 + }, + "AS214940": { + "name": "KPRONET", + "events": 0, + "uniq_ips": 0 + }, + "AS206728": { + "name": "MEDIALAND-AS", + "events": 0, + "uniq_ips": 0 + }, + "AS211720": { + "name": "Datashield, Inc.", + "events": 0, + "uniq_ips": 0 + }, + "AS216309": { + "name": "INVISIONTECH-GROUP-SRL", + "events": 0, + "uniq_ips": 0 + }, + "AS58854": { + "name": "KAOPY (Kaopu Cloud)", + "events": 0, + "uniq_ips": 0 + }, + "AS202685": { + "name": "TR-ARKEL", + "events": 0, + "uniq_ips": 0 + }, + "AS394711": { + "name": "KORGRID (KorGrid LLC)", + "events": 0, + "uniq_ips": 0 + } +}
\ No newline at end of file diff --git a/kevlar/2026-08-31/honeylabs/top-attackers.csv b/kevlar/2026-08-31/honeylabs/top-attackers.csv new file mode 100644 index 0000000..00a064b --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/top-attackers.csv @@ -0,0 +1,78 @@ +asn,name,kind,value,count
+AS210644,AEZA-AS,ip,147.45.71.214,36
+AS210644,AEZA-AS,ip,217.144.190.138,12
+AS210644,AEZA-AS,ip,176.124.203.177,4
+AS210644,AEZA-AS,ip,185.246.217.150,1
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15",18
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0,2
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0,2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",2
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0,2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16",2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",2
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0,2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18",2
+AS138915,KAOPU-HK (Kaopu Cloud HK Limited),ip,154.90.37.55,1
+AS138915,KAOPU-HK (Kaopu Cloud HK Limited),user_agent,Microsoft WinRM Client,1
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,107.189.26.103,49
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.114.162,32
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.91.225,16
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.114.254,8
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.116.49,8
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.99.12,4
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,107.189.17.181,3
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,45.61.177.185,2
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,45.61.177.179,2
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.100.235,2
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,libredtail-http,49
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",4
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,zern-scanner (+https://zern.io),2
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0,2
+AS51852,PLI-AS,ip,179.43.167.2,71
+AS51852,PLI-AS,ip,81.17.28.131,56
+AS51852,PLI-AS,ip,179.43.150.26,28
+AS51852,PLI-AS,ip,141.255.165.68,5
+AS51852,PLI-AS,ip,185.12.44.133,4
+AS51852,PLI-AS,ip,141.255.165.69,2
+AS51852,PLI-AS,ip,179.43.146.27,2
+AS51852,PLI-AS,ip,141.255.165.67,2
+AS51852,PLI-AS,ip,141.255.165.66,1
+AS51852,PLI-AS,user_agent,Mozilla/5.0,28
+AS51852,PLI-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64),21
+AS51852,PLI-AS,user_agent,Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0,2
+AS400992,ZHOUYISAT-COMMUNICATIONS,ip,194.48.142.134,1
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.7,1095
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.14,424
+AS51396,PFCLOUD (Pfcloud UG),ip,45.135.193.193,416
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.49,338
+AS51396,PFCLOUD (Pfcloud UG),ip,45.135.194.113,264
+AS51396,PFCLOUD (Pfcloud UG),ip,45.135.193.198,192
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.4,171
+AS51396,PFCLOUD (Pfcloud UG),ip,176.65.148.226,111
+AS51396,PFCLOUD (Pfcloud UG),ip,176.65.149.30,103
+AS51396,PFCLOUD (Pfcloud UG),ip,176.65.149.27,103
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Go-http-client/1.1,703
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (compatible; research-scan/1.0),424
+AS51396,PFCLOUD (Pfcloud UG),user_agent,0day,192
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36,111
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 zgrab/0.x,65
+AS51396,PFCLOUD (Pfcloud UG),user_agent,"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36",10
+AS51396,PFCLOUD (Pfcloud UG),user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",3
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0,3
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.14,2
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0,1
+AS200651,FLOKINET,ip,185.100.87.136,12
+AS200651,FLOKINET,user_agent,Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0,3
+AS200651,FLOKINET,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safar",3
+AS200651,FLOKINET,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64),2
+AS200651,FLOKINET,user_agent,SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17,1
+AS200651,FLOKINET,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0,1
+AS214351,FEMOIT,ip,62.60.226.150,4
+AS214351,FEMOIT,ip,192.162.199.180,2
+AS214351,FEMOIT,user_agent,python-requests/2.22.0,2
+AS198953,PROTON66,ip,176.120.22.61,1141
+AS198953,PROTON66,ip,176.120.22.43,134
+AS198953,PROTON66,ip,193.143.1.66,31
+AS198953,PROTON66,ip,176.120.22.240,2
+AS198953,PROTON66,user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.",134
|