diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
| commit | e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d (patch) | |
| tree | e02486c0af8f5f8bf64600f0a1a2b4904c4c123a /kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson | |
| parent | 1d9b78adfc083d1120c55e403e6b3d6317a1171f (diff) | |
add: bph report iocs
Diffstat (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson')
| -rw-r--r-- | kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson new file mode 100644 index 0000000..07c1abb --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson @@ -0,0 +1,52 @@ +{"@timestamp":1787398665343,"_id":"260822-X4nLaVzv3zJNOLl3p7BHZl0P","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24031},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977573,"ipProtocol":6,"lastPacket":1787397977573,"length":0,"network":{"bytes":66,"community_id":"1:uyfQUu9gAq+Y6XLcT0DheS6CQJo=","packets":1},"node":"spark-afae","packetPos":[-77797,2097061],"packetRange":{"gte":1787397977573,"lte":1787397977573},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":54546},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1706944210},"totDataBytes":0} +{"@timestamp":1787398665159,"_id":"260822-X4nd8srWqnROCLx7W8lIU1z_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24030},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977555,"ipProtocol":6,"lastPacket":1787397978563,"length":1008,"network":{"bytes":132,"community_id":"1:O6sIB1EGECphqiUfIK51qQTzgUA=","packets":2},"node":"spark-afae","packetPos":[-77797,2094607,116105],"packetRange":{"gte":1787397977555,"lte":1787397978563},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":54285},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1238186765},"totDataBytes":0} +{"@timestamp":1787398665194,"_id":"260822-X4mw8mYbdt1BmKXNaz68E6mR","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24029},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977533,"ipProtocol":6,"lastPacket":1787397978536,"length":1003,"network":{"bytes":132,"community_id":"1:7h3So8ldJYoA6n9nNIJtodk2XMg=","packets":2},"node":"spark-afae","packetPos":[-77797,2091375,118605],"packetRange":{"gte":1787397977533,"lte":1787397978536},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":54022},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2290323738},"totDataBytes":0} +{"@timestamp":1787398665148,"_id":"260822-X4kN0a2_eFZM46SonrPlWXA2","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24028},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977516,"ipProtocol":6,"lastPacket":1787397977516,"length":0,"network":{"bytes":66,"community_id":"1:zZRVm8nnH3TOOtXjyoMBikQzLuE=","packets":1},"node":"spark-afae","packetPos":[-77797,2088605],"packetRange":{"gte":1787397977516,"lte":1787397977516},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":53763},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1083093204},"totDataBytes":0} +{"@timestamp":1787398665208,"_id":"260822-X4n2AVKwFiJObaXqpXnC_61m","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24027},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977494,"ipProtocol":6,"lastPacket":1787397977494,"length":0,"network":{"bytes":66,"community_id":"1:990h68cQiGTChN7KirRm+wed8U8=","packets":1},"node":"spark-afae","packetPos":[-77797,2085355],"packetRange":{"gte":1787397977494,"lte":1787397977494},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":53501},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2642266677},"totDataBytes":0} +{"@timestamp":1787398665183,"_id":"260822-X4n4xbKmUyRGMIOsPR8vENs_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24026},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977477,"ipProtocol":6,"lastPacket":1787397978486,"length":1009,"network":{"bytes":132,"community_id":"1:AizbHLUae4tyDGxUJ70CM2PsOWY=","packets":2},"node":"spark-afae","packetPos":[-77797,2082001,127007],"packetRange":{"gte":1787397977477,"lte":1787397978486},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":53241},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3641959366},"totDataBytes":0} +{"@timestamp":1787398665184,"_id":"260822-X4mYIIgvZStKpY6WE_YSe4zw","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24025},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977459,"ipProtocol":6,"lastPacket":1787397977459,"length":0,"network":{"bytes":66,"community_id":"1:e/5tDr2xLWC29K5tT+8ni7mG+IQ=","packets":1},"node":"spark-afae","packetPos":[-77797,2077587],"packetRange":{"gte":1787397977459,"lte":1787397977459},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":52977},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":974859599},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4kY8d_dt-lPdLHA2Si55NMW","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24024},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977440,"ipProtocol":6,"lastPacket":1787397978454,"length":1014,"network":{"bytes":132,"community_id":"1:TeRseNppQOdihGzDZmB8sIsDCPU=","packets":2},"node":"spark-afae","packetPos":[-77797,2072859,134575],"packetRange":{"gte":1787397977440,"lte":1787397978454},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52714},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2055315097},"totDataBytes":0} +{"@timestamp":1787398665185,"_id":"260822-X4kxD66oMQdNt4P30FFQH9H2","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24023},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977422,"ipProtocol":6,"lastPacket":1787397978424,"length":1002,"network":{"bytes":132,"community_id":"1:Q49sb7fg0f7P2EM0fvfcnnOP1JA=","packets":2},"node":"spark-afae","packetPos":[-77797,2068391,137169],"packetRange":{"gte":1787397977422,"lte":1787397978424},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52443},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2750823716},"totDataBytes":0} +{"@timestamp":1787398665206,"_id":"260822-X4lEjQ7FyNlMyq22l8aijtGL","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24022},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977408,"ipProtocol":6,"lastPacket":1787397978410,"length":1002,"network":{"bytes":132,"community_id":"1:fpijL4tokWqauLEQrd1iXwEjt8Y=","packets":2},"node":"spark-afae","packetPos":[-77797,2063543,140711],"packetRange":{"gte":1787397977408,"lte":1787397978410},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52165},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3512260208},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4n7e3TRO6ZAMLWBQ83sr8qb","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24021},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977386,"ipProtocol":6,"lastPacket":1787397977386,"length":0,"network":{"bytes":66,"community_id":"1:l644tk0x7iSkVzm4AAtOPMzfKIM=","packets":1},"node":"spark-afae","packetPos":[-77797,2056677],"packetRange":{"gte":1787397977386,"lte":1787397977386},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51893},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2227258719},"totDataBytes":0} +{"@timestamp":1787398665343,"_id":"260822-X4l7TKSifGxGlKu2SQfvQLAb","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24020},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977363,"ipProtocol":6,"lastPacket":1787397978363,"length":1000,"network":{"bytes":132,"community_id":"1:sqX9RGNrfoi4rSiM39dGO5EKIW0=","packets":2},"node":"spark-afae","packetPos":[-77797,2048005,151529],"packetRange":{"gte":1787397977363,"lte":1787397978363},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":51621},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1691784847},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4n6zDVBk3tIsalRNUY-bGYr","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24019},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977345,"ipProtocol":6,"lastPacket":1787397977345,"length":0,"network":{"bytes":66,"community_id":"1:c54CRPHu4j/0IWK1+VlAen0N1hs=","packets":1},"node":"spark-afae","packetPos":[-77797,2038635],"packetRange":{"gte":1787397977345,"lte":1787397977345},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51353},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3882773355},"totDataBytes":0} +{"@timestamp":1787398665160,"_id":"260822-X4ntziOxl99E8rAf3EWD8NcB","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24018},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977329,"ipProtocol":6,"lastPacket":1787397977329,"length":0,"network":{"bytes":66,"community_id":"1:jV6u8pn6syr3DniiADwUcoO6KAg=","packets":1},"node":"spark-afae","packetPos":[-77797,2029919],"packetRange":{"gte":1787397977329,"lte":1787397977329},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51077},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":950370297},"totDataBytes":0} +{"@timestamp":1787398665186,"_id":"260822-X4kYzpNxB1dNnZV-tpvWifwN","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977316,"ipProtocol":6,"lastPacket":1787397978316,"length":1000,"network":{"bytes":132,"community_id":"1:kPVwW+VbK06/azywZvJ/Q5TAL6s=","packets":2},"node":"spark-afae","packetPos":[-77797,2023619,170199],"packetRange":{"gte":1787397977316,"lte":1787397978316},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50803},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3502804748},"totDataBytes":0} +{"@timestamp":1787398665183,"_id":"260822-X4lnWOYXaqhDCK15IS_n8OcG","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24016},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977295,"ipProtocol":6,"lastPacket":1787397978299,"length":1004,"network":{"bytes":132,"community_id":"1:8Mdj3olbcc0yxCwIJq99M6QTti4=","packets":2},"node":"spark-afae","packetPos":[-77797,2011089,180117],"packetRange":{"gte":1787397977295,"lte":1787397978299},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50533},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":78548080},"totDataBytes":0} +{"@timestamp":1787398665169,"_id":"260822-X4lReoiKeblIv5nUCVC8UVJF","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977276,"ipProtocol":6,"lastPacket":1787397977276,"length":0,"network":{"bytes":66,"community_id":"1:UteZMS6bFtBhJUObRucNuP4nqxQ=","packets":1},"node":"spark-afae","packetPos":[-77797,1998311],"packetRange":{"gte":1787397977276,"lte":1787397977276},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":50260},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2683492483},"totDataBytes":0} +{"@timestamp":1787398665155,"_id":"260822-X4ktteaKUx1O4Ju3O81nGHiC","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24014},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977261,"ipProtocol":6,"lastPacket":1787397977261,"length":0,"network":{"bytes":66,"community_id":"1:QBzjmguGzyUgbiVXzwgaJrXkufM=","packets":1},"node":"spark-afae","packetPos":[-77797,1987353],"packetRange":{"gte":1787397977261,"lte":1787397977261},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49977},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4209373780},"totDataBytes":0} +{"@timestamp":1787398665171,"_id":"260822-X4kYBumUEJNMxJT1XYMBVlZv","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24013},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977237,"ipProtocol":6,"lastPacket":1787397978251,"length":1014,"network":{"bytes":132,"community_id":"1:ZCUODL8E0HtDJHG6N0o82rnv2ok=","packets":2},"node":"spark-afae","packetPos":[-77797,1969579,213591],"packetRange":{"gte":1787397977237,"lte":1787397978251},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49701},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1700359251},"totDataBytes":0} +{"@timestamp":1787398665169,"_id":"260822-X4kESF-pxkhE_KTlfI0U1p_p","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24012},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977191,"ipProtocol":6,"lastPacket":1787397977191,"length":0,"network":{"bytes":66,"community_id":"1:uxZC/MZMI6gXSSAp+MfawbzKskc=","packets":1},"node":"spark-afae","packetPos":[-77797,1932007],"packetRange":{"gte":1787397977191,"lte":1787397977191},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49422},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4166961922},"totDataBytes":0} +{"@timestamp":1787398665343,"_id":"260822-X4lAnsiXnS5L_YEGUQOWQe2R","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24011},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977177,"ipProtocol":6,"lastPacket":1787397978193,"length":1016,"network":{"bytes":132,"community_id":"1:57rsRhbsd8MgSCo4/zLOQNBRCCY=","packets":2},"node":"spark-afae","packetPos":[-77797,1919085,252049],"packetRange":{"gte":1787397977177,"lte":1787397978193},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":65528},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":918305215},"totDataBytes":0} +{"@timestamp":1787398665207,"_id":"260822-X4knW85YgYRGTYH5ARv4bU0j","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24010},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977158,"ipProtocol":6,"lastPacket":1787397977158,"length":0,"network":{"bytes":66,"community_id":"1:ljifRjMBa42O7jmqBjftrMfcRvA=","packets":1},"node":"spark-afae","packetPos":[-77797,1897079],"packetRange":{"gte":1787397977158,"lte":1787397977158},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65253},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":519800436},"totDataBytes":0} +{"@timestamp":1787398665206,"_id":"260822-X4nQZIx5ahlJG6c9rSFDlxY_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24009},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977146,"ipProtocol":6,"lastPacket":1787397977146,"length":0,"network":{"bytes":66,"community_id":"1:Uww6L25Vvf0iIGiJhb3II0qbxoE=","packets":1},"node":"spark-afae","packetPos":[-77797,1882411],"packetRange":{"gte":1787397977146,"lte":1787397977146},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64987},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2646449100},"totDataBytes":0} +{"@timestamp":1787299489035,"_id":"260821-6cvE9BYbzShI3I93qIx6Z3sH","_index":"arkime_sessions3-260821","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":9025},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77245],"firstPacket":1787298703705,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":18,"ipProtocol":6,"lastPacket":1787298708729,"length":5024,"network":{"bytes":697,"community_id":"1:Ie2LUZdJsfzMqjOMqksg6UdOMI8=","packets":10},"node":"spark-afae","packetPos":[-77245,1552857,82,0,76,0,14314,76,173,70,76],"packetRange":{"gte":1787298703705,"lte":1787298708729},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260821-6cvE9BYbzShI3I93qIx6Z3sH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":366,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":6,"port":49439},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["2185538806691242"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["recon"],"categoryCnt":1,"cves":[""],"cvesCnt":1,"description":["socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"67_64_2475171","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2362182561},"totDataBytes":107} +{"@timestamp":1787299489000,"_id":"260821-6cv6JD4vXF9LiIoSpKOoVAua","_index":"arkime_sessions3-260821","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":2135},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77245],"firstPacket":1787298371502,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1787298376529,"length":5027,"network":{"bytes":697,"community_id":"1:bqcna2qyFaPEEndWic7vSIdekYM=","packets":10},"node":"spark-afae","packetPos":[-77245,55475,82,337,76,0,16131,76,173,70,76],"packetRange":{"gte":1787298371502,"lte":1787298376529},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260821-6cv6JD4vXF9LiIoSpKOoVAua","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":366,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":6,"port":50649},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["1031945960960602"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"94_64_2479472","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":177164305},"totDataBytes":107} +{"@timestamp":1787295282368,"_id":"260821-W8tFHV_19yxORrQJlkPfP1Dz","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8868},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686198,"ipProtocol":6,"lastPacket":1787294687188,"length":990,"network":{"bytes":132,"community_id":"1:IA7BHmZO+VVOCtjN2Xnk6H1MCwE=","packets":2},"node":"spark-afae","packetPos":[-77221,3186883,208514],"packetRange":{"gte":1787294686198,"lte":1787294687188},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50672},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1945144188},"totDataBytes":0} +{"@timestamp":1787295282350,"_id":"260821-W8vUeTKqR3FMTLbvxHOEmx0P","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8867},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686174,"ipProtocol":6,"lastPacket":1787294686174,"length":0,"network":{"bytes":66,"community_id":"1:P+mZnm96l90ULzRD8X5izUsffRg=","packets":1},"node":"spark-afae","packetPos":[-77221,3180907],"packetRange":{"gte":1787294686174,"lte":1787294686174},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":50410},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":710168394},"totDataBytes":0} +{"@timestamp":1787295282314,"_id":"260821-W8uVsS0ldmxEq6vYepNhIqey","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":120,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":2,"port":8866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77221],"firstPacket":1787294686168,"initRTT":16,"ipProtocol":6,"lastPacket":1787294686236,"length":68,"network":{"bytes":366,"community_id":"1:jeVFkz3ykCaFeUe0+GHp1v2Jq1Q=","packets":6},"node":"spark-afae","packetPos":[-77221,3172913,480,19674,316,228,13406],"packetRange":{"gte":1787294686168,"lte":1787294686236},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":246,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":50144},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3125454625},"totDataBytes":0} +{"@timestamp":1787295282329,"_id":"260821-W8sSPyO4QuZC1IuUUmwSS0jq","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8865},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686145,"ipProtocol":6,"lastPacket":1787294687157,"length":1012,"network":{"bytes":132,"community_id":"1:5yWbtuhunbIhjz5+erasnVvumQE=","packets":2},"node":"spark-afae","packetPos":[-77221,3166129,226891],"packetRange":{"gte":1787294686145,"lte":1787294687157},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49881},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3819536499},"totDataBytes":0} +{"@timestamp":1787295282333,"_id":"260821-W8udM2PdVztCiZT5T1ifZYdV","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8864},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686131,"ipProtocol":6,"lastPacket":1787294687149,"length":1018,"network":{"bytes":132,"community_id":"1:zi6Pte/EDSBL3rym13tO+lFjxFc=","packets":2},"node":"spark-afae","packetPos":[-77221,3158299,233093],"packetRange":{"gte":1787294686131,"lte":1787294687149},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49602},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":707614983},"totDataBytes":0} +{"@timestamp":1787295282400,"_id":"260821-W8tsQjQGVclFrZ8dUDXyMmbo","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8863},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686111,"ipProtocol":6,"lastPacket":1787294686111,"length":0,"network":{"bytes":66,"community_id":"1:ucL0hJ+lM/fnjuaRQCKddo3AN+M=","packets":1},"node":"spark-afae","packetPos":[-77221,3144649],"packetRange":{"gte":1787294686111,"lte":1787294686111},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49335},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":83758623},"totDataBytes":0} +{"@timestamp":1787295282391,"_id":"260821-W8uXpUpbF4FEn6Z2-BRBDN9T","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8862},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686088,"ipProtocol":6,"lastPacket":1787294686088,"length":0,"network":{"bytes":66,"community_id":"1:wldU4BO25vKRSXe8V7CH2ggTiZU=","packets":1},"node":"spark-afae","packetPos":[-77221,3131463],"packetRange":{"gte":1787294686088,"lte":1787294686088},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65454},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2326875972},"totDataBytes":0} +{"@timestamp":1787295282342,"_id":"260821-W8tNXuTfZIBAJ5LGeLskt4ms","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8861},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686078,"ipProtocol":6,"lastPacket":1787294686078,"length":0,"network":{"bytes":66,"community_id":"1:px3mT4LvJV35xQysImb4FwuKB3s=","packets":1},"node":"spark-afae","packetPos":[-77221,3125967],"packetRange":{"gte":1787294686078,"lte":1787294686078},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65194},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3479844389},"totDataBytes":0} +{"@timestamp":1787295282351,"_id":"260821-W8vwZYZSKxZNK7F35cLBm2-O","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8860},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686066,"ipProtocol":6,"lastPacket":1787294687074,"length":1008,"network":{"bytes":132,"community_id":"1:TkM92ZmWl9JP/rLrBYaeqdalauQ=","packets":2},"node":"spark-afae","packetPos":[-77221,3112747,270465],"packetRange":{"gte":1787294686066,"lte":1787294687074},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":64933},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3894118945},"totDataBytes":0} +{"@timestamp":1787295282356,"_id":"260821-W8vzhVbrZn1Gia36Ar-iS1m9","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8859},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686053,"ipProtocol":6,"lastPacket":1787294686053,"length":0,"network":{"bytes":66,"community_id":"1:oiwlxAjPyIWZhAlTFZNNTGEIV9s=","packets":1},"node":"spark-afae","packetPos":[-77221,3102425],"packetRange":{"gte":1787294686053,"lte":1787294686053},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64669},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1532565211},"totDataBytes":0} +{"@timestamp":1787295282365,"_id":"260821-W8uPwTa2z25FR6A3L7Tfa7lP","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8858},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686039,"ipProtocol":6,"lastPacket":1787294687048,"length":1009,"network":{"bytes":132,"community_id":"1:CSKRqG5c/+KM25J7zkuGephZFzM=","packets":2},"node":"spark-afae","packetPos":[-77221,3093161,284010],"packetRange":{"gte":1787294686039,"lte":1787294687048},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":64406},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3504527314},"totDataBytes":0} +{"@timestamp":1787295282317,"_id":"260821-W8vTDr3R_h9EkqmIh5fMBWyu","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8857},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686023,"ipProtocol":6,"lastPacket":1787294686023,"length":0,"network":{"bytes":66,"community_id":"1:jf+L6uus9e240DsOR4JY6DQ1NHM=","packets":1},"node":"spark-afae","packetPos":[-77221,3077953],"packetRange":{"gte":1787294686023,"lte":1787294686023},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64143},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3736444422},"totDataBytes":0} +{"@timestamp":1787295282393,"_id":"260821-W8u98abx81xIWoVcChQR2N5v","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8856},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686015,"ipProtocol":6,"lastPacket":1787294687015,"length":1000,"network":{"bytes":132,"community_id":"1:obOc3V7pcOuhShBPYFKaJ4TOgbQ=","packets":2},"node":"spark-afae","packetPos":[-77221,3069767,304488],"packetRange":{"gte":1787294686015,"lte":1787294687015},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63873},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3472757763},"totDataBytes":0} +{"@timestamp":1787295282332,"_id":"260821-W8t_wXLpQQxNy7_ZoNnQNu3y","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8855},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685997,"ipProtocol":6,"lastPacket":1787294687005,"length":1008,"network":{"bytes":132,"community_id":"1:fa8+MxZUu6YaRY+NvDY/HBLEgrA=","packets":2},"node":"spark-afae","packetPos":[-77221,3056525,314390],"packetRange":{"gte":1787294685997,"lte":1787294687005},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63606},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1290248661},"totDataBytes":0} +{"@timestamp":1787295282382,"_id":"260821-W8s1Ir25kIVBKKM0nNKz8JDf","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8854},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685988,"ipProtocol":6,"lastPacket":1787294686996,"length":1008,"network":{"bytes":132,"community_id":"1:rfW5CCxW+gW4d1XgX0Q5BXxIAzE=","packets":2},"node":"spark-afae","packetPos":[-77221,3042493,326712],"packetRange":{"gte":1787294685988,"lte":1787294686996},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63333},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3577240244},"totDataBytes":0} +{"@timestamp":1787295282342,"_id":"260821-W8tlKAjZi1ZOMK9_R5sZ46-Z","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8853},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685977,"ipProtocol":6,"lastPacket":1787294685977,"length":0,"network":{"bytes":66,"community_id":"1:sGO6AOSy+AR2qPMUh38BM7cqtKk=","packets":1},"node":"spark-afae","packetPos":[-77221,3027665],"packetRange":{"gte":1787294685977,"lte":1787294685977},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":63076},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1716716909},"totDataBytes":0} +{"@timestamp":1787295282319,"_id":"260821-W8vaOlFYuDRAMLGFXWZvr2Lf","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8852},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685957,"ipProtocol":6,"lastPacket":1787294685957,"length":0,"network":{"bytes":66,"community_id":"1:MXy/dbcibLbyUeI5vzg7GVQPBSw=","packets":1},"node":"spark-afae","packetPos":[-77221,2997723],"packetRange":{"gte":1787294685957,"lte":1787294685957},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62811},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1130549068},"totDataBytes":0} +{"@timestamp":1787295282380,"_id":"260821-W8vWj0OWvAdCKodim-xIDEs-","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8851},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685932,"ipProtocol":6,"lastPacket":1787294685932,"length":0,"network":{"bytes":66,"community_id":"1:4gwZivz/LHzmbk9VCGAUNJbVidI=","packets":1},"node":"spark-afae","packetPos":[-77221,2957463],"packetRange":{"gte":1787294685932,"lte":1787294685932},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62548},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1856043160},"totDataBytes":0} +{"@timestamp":1787295282388,"_id":"260821-W8vJQRYUtDdNZ50cUcIktMaV","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8850},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685919,"ipProtocol":6,"lastPacket":1787294686925,"length":1006,"network":{"bytes":132,"community_id":"1:iE95t1gYhLvBo7cBrCUoLv2959o=","packets":2},"node":"spark-afae","packetPos":[-77221,2940327,415984],"packetRange":{"gte":1787294685919,"lte":1787294686925},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":62284},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2266514894},"totDataBytes":0} +{"@timestamp":1787295282329,"_id":"260821-W8uWRH0RRaZFW7V38Hsowg-Z","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8849},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685897,"ipProtocol":6,"lastPacket":1787294685897,"length":0,"network":{"bytes":66,"community_id":"1:u9Qm1TRQrdHzwzFA//dZOWKtY30=","packets":1},"node":"spark-afae","packetPos":[-77221,2914653],"packetRange":{"gte":1787294685897,"lte":1787294685897},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62017},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2003973733},"totDataBytes":0} +{"@timestamp":1787295282354,"_id":"260821-W8vTga9--79Ch5HXWEuf5N6M","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8848},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685887,"ipProtocol":6,"lastPacket":1787294686890,"length":1003,"network":{"bytes":132,"community_id":"1:H10iVoOJuAsVrH7lb2y0LVi9JWc=","packets":2},"node":"spark-afae","packetPos":[-77221,2890021,458354],"packetRange":{"gte":1787294685887,"lte":1787294686890},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":61751},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3367511455},"totDataBytes":0} +{"@timestamp":1787295282356,"_id":"260821-W8toz655PGpCZ7RnlTw6_Fh8","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8847},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685883,"ipProtocol":6,"lastPacket":1787294686872,"length":989,"network":{"bytes":132,"community_id":"1:zbpHudVmiEBqwvWE+PCw7XOPJvs=","packets":2},"node":"spark-afae","packetPos":[-77221,2864049,479956],"packetRange":{"gte":1787294685883,"lte":1787294686872},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":61484},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1245753742},"totDataBytes":0} +{"@timestamp":1787295282331,"_id":"260821-W8sziO3rAHZBwoZd2MAMwoAK","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8846},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685855,"ipProtocol":6,"lastPacket":1787294685855,"length":0,"network":{"bytes":66,"community_id":"1:xoBVpByDwDE/zOxZGZ1Y9utCcRk=","packets":1},"node":"spark-afae","packetPos":[-77221,2838141],"packetRange":{"gte":1787294685855,"lte":1787294685855},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":61219},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":176276568},"totDataBytes":0} +{"@timestamp":1785185629328,"_id":"260727-kjipZuEuiL9Bk5E9TrMcQCe9","_index":"arkime_sessions3-260727","client":{"bytes":9},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":123},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[65530],"firstPacket":1785184326416,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":21,"ipProtocol":6,"lastPacket":1785184331448,"length":5032,"network":{"bytes":700,"community_id":"1:GVbm0WqZD2jXczgeTDk1k/AjKUI=","packets":10},"node":"spark-afae","packetPos":[-65530,399560,82,246,76,79,19039,76,173,866,76],"packetRange":{"gte":1785184326416,"lte":1785184331448},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260727-kjipZuEuiL9Bk5E9TrMcQCe9","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":369,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":51533},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"0401005001010101","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"77_64_2478366","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":639078340},"totDataBytes":112} +{"@timestamp":1784793925673,"_id":"260723-6Qerye6InqFDeoYEQ1ySwMp3","_index":"arkime_sessions3-260723","client":{"bytes":159},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":515,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":591},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[63354],"firstPacket":1784793550837,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["www.google.com:443","www.google.com"],"hostCnt":2,"ja4h":["co11nn020000_818f42cc3fd7_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["co11nn020000_Host,User-Agent__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["CONNECT"],"method-CONNECT":1,"methodCnt":1,"path":["www.google.com:443"],"pathCnt":1,"requestHeader":["host","user-agent"],"requestHeaderCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["connection","server","x-powered-by","content-type","content-length","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","thu, 23 jul 2026 07:59:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["www.google.com:443"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0"],"useragentCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1784793550906,"length":69,"network":{"bytes":974,"community_id":"1:nHmcKWVAuQsy+nJd0pRP4OKoVzY=","packets":9},"node":"spark-afae","packetPos":[-63354,10427900,82,0,76,229,70,357,70,76],"packetRange":{"gte":1784793550837,"lte":1784793550906},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":459,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":50402},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"434f4e4e45435420","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1908087464943045"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4"],"signatureCnt":2,"signatureId":[1031486,1030991],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional."],"intention":["malicious","unknown"],"intentionCnt":2,"name":["open proxy scanner","web crawler"],"nameCnt":2},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"47_64_tcp","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":1,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2097132136},"totDataBytes":446} +{"@timestamp":1784793925634,"_id":"260723-6QdimMeQvpJKcLpaH7RV9lYm","_index":"arkime_sessions3-260723","client":{"bytes":159},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":515,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[63354],"firstPacket":1784792818465,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["www.google.com:443","www.google.com"],"hostCnt":2,"ja4h":["co11nn020000_818f42cc3fd7_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["co11nn020000_Host,User-Agent__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["CONNECT"],"method-CONNECT":1,"methodCnt":1,"path":["www.google.com:443"],"pathCnt":1,"requestHeader":["host","user-agent"],"requestHeaderCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["connection","server","x-powered-by","content-type","content-length","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","thu, 23 jul 2026 07:46:58 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["www.google.com:443"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0"],"useragentCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1784792818534,"length":69,"network":{"bytes":974,"community_id":"1:XrRrGn/otH7cYhvl7YCeljQSHG0=","packets":9},"node":"spark-afae","packetPos":[-63354,746921,164,714,76,229,70,357,70,76],"packetRange":{"gte":1784792818465,"lte":1784792818534},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":459,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":50364},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"434f4e4e45435420","srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["591728373511023"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4"],"signatureCnt":2,"signatureId":[1031486,1030991],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional."],"intention":["malicious","unknown"],"intentionCnt":2,"name":["open proxy scanner","web crawler"],"nameCnt":2},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"154_64_tcp","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":1,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4217937109},"totDataBytes":446} +{"@timestamp":1784714152127,"_id":"260722-ePxaU5a5gldDDIwhk-50R1KN","_index":"arkime_sessions3-260722","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":331,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":10087},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[62909],"firstPacket":1784712875300,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":92,"ipProtocol":6,"lastPacket":1784712880489,"length":5189,"network":{"bytes":671,"community_id":"1:RNDO+y8BaZzkQEX1D9bsBXLg2dw=","packets":10},"node":"spark-afae","packetPos":[-62909,112654,82,1082,70,74,7077,70,173,362,70],"packetRange":{"gte":1784712875300,"lte":1784712880489},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260722-ePxaU5a5gldDDIwhk-50R1KN","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":340,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":53425},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[113],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["1007713187855869"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"51_64_2409223","ja4t":["64240_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1352326926},"totDataBytes":107} |